7 data privacy reasons to switch your web scraping provider

this is general information, not legal advice.

your scraper works. the data arrives, the reports fill up. then someone asks a question that was never on the project plan:

how does your scraping provider handle the personal data in the pages you scrape?

the one asking may be your DPO, a procurement review, or a new client that wants the answer in writing. the EU regulators' draft guidelines on web scraping, open for comment until 30 October 2026, are one more reason to check.

this post gives you seven questions to put to your current web scraping provider, why each one matters under the GDPR, and what a good answer looks like. if the answers come back clear, great! no reason to switch away from your current scraping provider. if they don't, switching is usually a small job, and the end of this post shows what it takes.

TL;DR

does every scraping setup need this review? → not always, but it's worth doing anyway. a project with no personal data, like price tracking, is low risk today, but its next version may start collecting names. once the pages carry names or contact details, your vendor handles personal data for you, and your DPO will want its answers.
what should I ask my current vendor? → seven questions: where it runs, the contract, how long it keeps data, AI use, logs, zero data retention and screenshot links.
what does a good answer look like? → a link to a public document, a clause in it, or a number. "we take privacy seriously" is not an answer.
is switching a big job? → usually not. the scraping step is often one api call in your workflow, so it's a quick swap and a test.
will a new vendor make me GDPR compliant? → no vendor can do that for you → a good one makes its part easy to check.

first: does this apply to your project?

before the questions, check one thing: does your project touch personal data? a price tracker with no names in it stays simple. but product pages show reviewer names, tender notices name contact people, and team pages list staff.

once personal data passes through your vendor, the vendor should act as your processor: it handles the pages only on your instructions, and you are the controller. that is not a given.

a vendor that also uses the pages for its own ends, for example to train AI models or to build and sell its own datasets sourced from your scrape requests, becomes a controller for that use. that is worse for you: you are handing personal data to a company that decides for itself what happens to it, so you need a legal basis for that, and the people in the data may have to be told who received it.

the GDPR asks you to use only processors that give "sufficient guarantees" that they protect the data. the seven questions test both: that the vendor stays your processor, and that it protects the data. to find your project's risk level first, read is web scraping legal in the EU in 2026?

the seven questions

each question below comes with why it matters to your DPO, what a good answer looks like, and how we answer it ourselves.

question 1: where do fetching, rendering, caching, stored results and logs run? which parts reach outside the EU?

sending personal data outside the EU and EEA needs a legal tool, such as the EU's standard contractual clauses. "hosted in the EU" can describe the main servers only, or the database, but not the other parts of the system → ask about each step.

a good answer → a location for every step, and a written list of the exceptions, each with its legal tool.

with crawlbrulee

processing and long-term storage run on EU servers, in France. the exceptions are written down:

screenshots, if you ask for them, are delivered through a content delivery network that can serve them from outside the EU;
our diagnostic logs sit in the EU with a US-owned provider (Grafana), under the standard contractual clauses (SCCs, module three);
scrape requests go out through proxies from an EU country by default, unless you pick another.

question 2: is the data processing agreement public, and does it apply from day one, or do we need a sales call?

the first question was about where your data goes. the second is about the contract that covers it.

the GDPR asks for a written contract between you and your processor, and lists what it must cover. an electronic contract counts. a DPA you only see after a sales call slows down every review.

a good answer → a public, dated DPA that names the vendor as your processor and covers the points the GDPR lists.

with crawlbrulee

our DPA is public, part of our terms, and applies to every customer automatically, with nothing to sign. if your procurement process needs a countersigned copy, we sign the same version as a pdf.

question 3: how long do you keep results, backups included? what happens when we leave?

a contract is only as good as its numbers. the first number to ask for is time.

personal data may be kept no longer than needed. at the end of the contract, the processor must delete or return the data, at your choice. backups and caches are copies too, so they need a number as well.

a good answer → a number of days for each copy, and a clear step at the end of the contract.

with crawlbrulee

every copy is deleted after 90 days at most, backups and content delivery copies included. when you close your account, you can first download any results we still hold through the api, or ask us to delete them right away. if you don't tell us, we delete them.

question 4: is our content sent to an AI provider, or used to train or improve AI models?

keeping data only as long as needed is one limit. using it only for your project is the other.

a processor that uses your data for its own purposes counts as a controller for that use. an AI provider in the chain is also one more processor your DPO has to check, maybe outside the EU.

a good answer → a written "no" in the privacy policy or the terms. if the product has AI features, they are opt-in, and the AI provider is on the subprocessor list.

with crawlbrulee

we don't send scraped content or results to any AI provider, and we don't train on them.

if we ever add a feature that uses an AI provider, we list that provider as a subprocessor before it can touch your data, and your content isn't used for training without your explicit agreement.

question 5: what goes into your logs, where are they stored, and for how long?

the questions so far were about the results. logs are a copy that is easy to forget. a url can carry personal data by itself, like an email address in a query string. logs also have a retention time of their own.

a good answer → a plain list of what is logged and what isn't, with a retention number.

with crawlbrulee

we never log page content. our normal logs do hold the full target urls you send, and we say so plainly. they are kept for up to 90 days. they sit in the EU, with Grafana Labs (see question 1). headers and cookies you send are kept out. with zero data retention (question 6), your url stays out of our logs; we keep only the site's domain name, to prevent abuse.

question 6: do you offer zero data retention?

stored results, cached copies and logs are all copies a vendor keeps by default. the next question is whether you can turn those copies off.

personal data may be kept no longer than needed, and a processor may act only on your documented instructions. data the vendor never keeps can't leak, can't reach another customer, and needs no deletion request later. for a project with personal data, it is the shortest answer to many of your DPO's questions.

a good answer → a documented option, per request and for the whole account, that says what is still stored, for how long, and what the logs keep, backed by a clause in the contract.

with crawlbrulee

send zero_data_retention: true, or we can force it on for every request in your organization. your new results stay out of our shared cache, and the docs explain the option in full. anything we must store to deliver them, such as an async result or a screenshot, is kept for 24 hours, then deleted. your url stays out of our logs too; we keep only the site's domain name. it comes with our enterprise plan.

question 7: who can open our screenshots, and do the links expire?

the last question is about the one result you can see at a glance: the screenshot.

a screenshot can show names, faces or contact details. a link that anyone can open, for as long as it exists, is a copy outside your control. the GDPR asks for security that fits the risk.

a good answer → links that need a signature and expire, and stored files that are not public.

with crawlbrulee

screenshots are delivered as signed links that expire 24 hours after the scrape. the stored images are not public: a request without a valid signature, or after the link expired, is refused.

the seven questions, ready to send

here are the questions again as one list, to paste into an email to your current provider:

where do fetching, rendering, caching, stored results and logs run, and which parts reach outside the EU?
is your DPA public, and does it apply without a sales call?
how long do you keep results, cached copies and backups, and what happens when we leave?
do you send fetched content to an AI provider, or train models with it?
what goes into your logs, where are they stored, and for how long?
do you offer zero data retention, and what do you still keep when it is on?
are screenshot links public, and do they expire?

these seven are about privacy. a full vendor review asks more: subprocessors, breach notices, audits, removal requests and banned uses. our DPO pack answers each one for crawlbrulee.

switching is usually a small job

if the answers come back vague, moving is easier than it sounds.

the change in code is small. the scraping step is often one api call. with crawlbrulee it is one POST to /api/scrape, which returns markdown, html, links, images or a screenshot. the quickstart takes a few minutes.
the tools are ready. official js/ts and python sdks, a cli, an mcp server for AI agents, and a verified n8n node.
the paperwork is light. the DPA applies from signup, and personal data at crawlbrulee sums up our answers on one page.
close the old account properly. ask your old provider to delete or return your data, at your choice, and to confirm it in writing. a processor contract must cover this step.

questions people ask

the questions we hear most, with short answers.

do I have to switch if my vendor runs outside the EU?

not by itself. a transfer outside the EU can be lawful with the right legal tool, like the standard contractual clauses. what matters is that the tool exists, is written down, and your DPO has checked it.

is a shared cache against the GDPR?

not by itself. it should be written into the contract, and you should be able to keep your results out of it when they carry personal data.

will my DPO need to review crawlbrulee too?

yes, every new processor gets a review. our DPO pack answers the usual questions in one place, each linked to its clause.

already scraping? send these seven questions to your current provider, and see how the answers hold up.

references

GDPR:
- processors, "sufficient guarantees", the written contract, documented instructions, delete or return at the end, using data for your own purposes (first section, questions 2, 3, 4 and 6, closing the old account): Article 28
- purpose limits and storage limits (questions 3 and 6): Article 5
- security that fits the risk (question 7): Article 32
- transfers outside the EU and EEA (question 1, FAQ): Articles 44–49, and the standard contractual clauses in Decision (EU) 2021/914
our documents, behind the "with crawlbrulee" notes: crawlbrulee.com/legal
personal data at crawlbrulee, the same answers in short
EDPB web scraping (draft, July 2026, open for comment until 30 October 2026): EDPB Guidelines 03/2026

this is not legal advice. for a decision on a real project, talk to a lawyer or your DPO.

7 data privacy reasons to switch your web scraping provider

TL;DR

first: does this apply to your project?

the seven questions

question 1: where do fetching, rendering, caching, stored results and logs run? which parts reach outside the EU?

question 2: is the data processing agreement public, and does it apply from day one, or do we need a sales call?

question 3: how long do you keep results, backups included? what happens when we leave?

question 4: is our content sent to an AI provider, or used to train or improve AI models?

question 5: what goes into your logs, where are they stored, and for how long?

question 6: do you offer zero data retention?

question 7: who can open our screenshots, and do the links expire?

the seven questions, ready to send

switching is usually a small job

questions people ask

do I have to switch if my vendor runs outside the EU?

is a shared cache against the GDPR?

will my DPO need to review crawlbrulee too?

references

crawlbrulee for your DPO

new in crawlbrulee: zero data retention 🎉

GDPR-compliant web scraping: what a provider can and can't do

ready when you are