GDPR-compliant web scraping
every page you scrape has people in it
- names
- email addresses
- faces
- phone numbers
no provider can make your scraping GDPR-compliant. under GDPR you also answer for what your provider does with the scraped personal data.
most providers never say what that is.
we do
we don’t use what you scrape
your processor, not a controller: we act on your instruction only
no AI training
your pages never reach a model, ours or anyone’s
zero data retention
available for enterprise plans. scrape data deleted within 90 days even when zero data retention is off
a public DPA
covers you from signup, nothing to sign
EU servers, EU proxy exit
end-to-end EU request chain & data residency by default*
* processing and long-term storage run on EU servers. screenshots, if you ask for them, are delivered through a content delivery network that can serve them from outside the EU.
no credit card · EU servers · dpa applies at signup
where a page goeswhere it never goes
ten things your DPO will check.
the middle column is what we found in the public legal documents of multiple scraping vendors. no names, on purpose.
- named as your processormost providers: not mentionedcrawlbrulee: yes, in the dpa dpa §1
- a dpa without a sales callmost providers: ask salescrawlbrulee: public, applies at signup dpa
- every step in the EUmost providers: a region, at bestcrawlbrulee: fetch, render, cache, result* privacy §8
- pages sent to ai providers or trainingmost providers: unsaidcrawlbrulee: never privacy §5
- retention, backups includedmost providers: vague or missingcrawlbrulee: 90 days at most privacy §9
- a way out of the shared cachemost providers: a cache flag, at bestcrawlbrulee: zero data retention: 24 hours, then deleted dpa annex 2
- what the logs holdmost providers: not disclosedcrawlbrulee: never page content or your cookies privacy §4.3
- sub-processorsmost providers: a list on requestcrawlbrulee: public list, 14 days’ email notice sub-processors
- removal requests from people in the pagesmost providers: no channelcrawlbrulee: one email, cached copies removed privacy §5
- banned usesmost providers: few, or nonecrawlbrulee: six, in the policy every customer accepts acceptable use §3–4
* processing and long-term storage run on EU servers. screenshots, if you ask for them, are delivered through a content delivery network that can serve them from outside the EU.
still comparing vendors?
not an EU company? this still lands on your desk.
data protection law goes by where the people in the pages are, not where your servers are. and it isn’t only Europe’s.
the law follows the people
GDPR covers the data of people in the EU, whoever holds it and wherever they sit. the UK, Brazil, California and a growing list of others wrote their laws the same way. a page with people in it is regulated somewhere, whatever your address.
your customers will ask
security questionnaires ask where data goes, who touches it and how long it stays. a scraping provider that answers in public clauses saves you a round of email, in any time zone.
less data, less to lose
nothing kept past 90 days, or past 24 hours with zero data retention. no page content in the logs, no training set. what a provider doesn’t hold can’t leak, whichever law you answer to.
the rules caught up this year.
- july 2026
- the EDPB, the body behind GDPR enforcement, published its guidelines on web scraping. the first thing they ask is who scraped, and on whose instructions. your vendor is now part of your answer.
- read the guidelines
- august 2026
- the AI Act’s duties for general-purpose models became enforceable, including a public summary of what went into training. what a vendor does with scraped pages is now a question with teeth.
- the AI Act
the compliant call is the normal call.
no flag to set, no form to sign. the EU exit, the 90-day cache and the dpa are what you get by default.
curl -X POST "https://api.crawlbrulee.com/api/scrape" \
-H "Authorization: Bearer $CRAWLBRULEE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"url": "https://example.com/team",
"extract": { "markdown": true }
}'that is the whole call
EU servers, EU proxy exit, 90-day cache. nothing to switch on, no tier to unlock.
to look local somewhere else
add
"location": { "country": "US" }and the proxy exits there.the rest still runs in the EU
the fetch, the render, the cache and the result, whichever exit you pick.
to keep your result out of the shared cache
add
"zero_data_retention": trueand the result is never served to another customer. anything we must store to hand it over is kept for 24 hours, then deleted. enterprise, or on request
day one for your DPO.
the answers a security questionnaire asks for, already public. no call, no NDA, no waiting.
- 90 days
- the longest we keep a result, backups and cdn copies included. 24 hours with zero data retention.
- 0
- pages sent to an ai provider, used for training, or sold.
- 14 days
- notice by email before a new sub-processor, with a right to object.
- the data processing agreement
part of the terms, no signature needed. a countersigned pdf on request.
- the sub-processor list
who else touches the data, where each one is, and what they see.
- the acceptable-use policy
people search, surveillance and screening are banned for every customer.
before you sign up.
scrape with a vendor that can answer for the people in the pages.
start on the free plan. the dpa already applies, so your DPO can read it while you write the first three lines of code.
no credit card · 750 free credits a month · cancel anytime
found yourself in a page we scraped and want your data gone? one email: contact@crawlbrulee.com. send the urls; we remove the cached copies we can identify.