Privacy Policy
How we handle personal data, process data for you and which providers we use.
Effective date: 21 October 2026
Questions? Contact us
This policy explains how TeraShift GmbH processes personal data when you use Scrape.ly, and contains our processor terms and subprocessor list. "We", "us" and "our" mean TeraShift GmbH, Hauptstrasse 35a, 8272 Ermatingen, Switzerland.
1. Controller and contact
TeraShift GmbH is the controller for the processing described here. Data protection questions and requests: privacy@scrape.ly, the live chat, or the postal address above. We have not appointed a data protection officer; the law does not require one for us.
Our representative in the EU under Article 27 GDPR, who can be contacted instead of us: Prighter Germany GmbH, Heidestraße 40, 10557 Berlin, Germany.
2. What we process and why
| Purpose | Data | Legal basis |
|---|---|---|
| Delivering and securing the websites and dashboard | IP address, browser and device data, page and request logs, bot-check results | Our legitimate interests (Art. 6(1)(f) GDPR) |
| Creating and running your account | Name, email, password (hashed), account and team settings, API keys, session data, Google sign-in data, acceptance records | Contract (Art. 6(1)(b)); legitimate interests for fraud prevention (Art. 6(1)(f)) |
| Billing and purchases | Plan, subscription, order and transaction data, amounts, billing country, renewals, refunds, credit and usage | Contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) |
| Running Actors and storing results | Account identifier, run and build metadata, resource use, charges, logs, storage metadata | Contract (Art. 6(1)(b)); legitimate interests in security (Art. 6(1)(f)) |
| The Store, profiles and reviews | Public profile, published Actors, reviews, issues, bookmarks, Store page views | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Creators and payouts | Payout details, tax details, wallet or bank details, Earnings, ledger, self-billing, review and appeal records | Contract; legal obligations; legitimate interests (Art. 6(1)(b)–(f)) |
| Identity verification | Identity document data, selfie and liveness capture, face comparison, verification result, sanctions screening | Contract; legal obligations; legitimate interests; explicit consent for biometric data (Art. 9(2)(a)) |
| Live chat and support | Name, email, account identifier, messages and files, browser data | Contract or pre-contract steps (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| AI features | Your prompts, the context we add, and the responses | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Analytics, advertising measurement and fraud prevention | Usage events, heatmaps, session recordings (which can include what you type and data exchanged with our servers), a browser identifier, ad conversion data | Our legitimate interests (Art. 6(1)(f)) |
| Emails | Account and service emails; occasional emails about our similar products to customers | Contract (Art. 6(1)(b)); legitimate interests in direct marketing (Art. 6(1)(f)) |
| x402 payments | Wallet address, transaction hash, amount, time, linked account | Contract (Art. 6(1)(b)); legitimate interests in fraud prevention (Art. 6(1)(f)) |
| Notices, complaints and legal matters | Correspondence, notices data, records needed to defend claims | Legal obligations (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
The tools we use to deliver the websites, operate the dashboard, measure use and provide live chat are described in the Cookie Policy. We also disclose personal data to courts and authorities where the law requires it, and to a buyer or successor in a merger or sale under confidentiality. Some tools load when the page loads, without a consent banner; you can block them as described in the Cookie Policy.
3. Your content, AI and other people's data
You decide what your Actors, runs and AI requests collect and process, which can include personal data about other people. We process that data only on your instructions, as your processor, under section 9 below; you are the controller and are responsible for it. If someone's data appears in another user's content and they want to exercise their rights, they should contact that user, or us and we will pass the request on where we can.
When you use the AI features, we send your inputs and context through our routing provider to third-party AI model providers. Those providers may process and retain inputs and outputs under their own terms, including outside Switzerland and the EU. We do not train AI models on your content. We store AI chat transcripts, with credentials removed, to operate, secure and improve the features and to investigate misuse. Our staff can access them.
4. Recipients and international transfers
Recipients include our hosting, network, email, analytics, support-chat and internal-communication providers; our identity verification provider; AI model providers through our routing provider; the x402 facilitator and the public blockchain; our payment reseller PayPro Global, which is a separate controller for payment data; and integrations you connect. Our subprocessors that may process your content on your behalf are listed in section 10.
We are based in Switzerland, which the European Commission recognises as adequate, and host the platform in Germany. Some recipients process data in the USA and other countries. Where a country is not recognised as adequate, we rely on an adequacy decision (including the EU-U.S. and Swiss-U.S. Data Privacy Framework where the recipient is certified), on standard contractual clauses, or on a legal exception. You can ask us for a copy of the safeguards.
5. Retention
We keep personal data for as long as we need it for the purposes above and for as long as the law requires. This means, in outline: account data while the account exists; run results, logs and storages according to your Plan and then deleted; AI and support transcripts as long as needed to operate, secure and defend the Services; and billing, ledger, self-billing and identity verification records for the periods required by accounting, tax and fraud-prevention law, which can be up to 10 years after the account ends. Backups roll off within 7 days. When a period ends we delete or anonymise the data.
You can ask us to delete your account through the live chat or at privacy@scrape.ly; we do so within one month. Records listed above are kept after deletion, and unpaid Creator Earnings are handled under the Terms of Service.
6. Automated decisions, security and your rights
We use automated checks to detect fraud, bots, abuse of free credit and breaches of these Terms, and our identity verification provider uses automated document and face checks. These can lead to a sign-up being refused, a payment or payout being held, or an account being restricted. Where a decision with legal or similarly significant effects is based solely on automated processing, you may ask for a review by a person and contest the decision, using the contacts in section 1.
We use technical and organisational measures to protect personal data, including encrypted connections, access controls, separation of customer data, monitoring and backups. No system is completely secure. You are responsible for keeping your password and API keys secret.
Subject to the conditions and exceptions in the law, you have the right to access, rectify, erase, restrict and port your personal data, and to object to processing based on our legitimate interests. You can withdraw a consent at any time with effect for the future. To exercise a right, use the live chat or the contacts in section 1; we may need to confirm your identity first, and we answer within one month. You can complain to a supervisory authority: in Switzerland the FDPIC, or in the EU the authority where you live, work or where the alleged infringement took place. You can object to direct marketing at any time, and each marketing email has an unsubscribe link.
7. Age
The Services are for people aged 18 and over. We do not knowingly collect data from anyone under 18.
8. Changes and contact
We may update this policy. The current version is always at /legal/privacy, with its effective date. Contact: privacy@scrape.ly · live chat on scrape.ly and my.scrape.ly · +41 91 239 14 85.
EU representative (Art. 27 GDPR): Prighter Germany GmbH, Heidestraße 40, 10557 Berlin, Germany.
9. Processor terms (Data Processing Addendum)
9.1 Roles
Where your content includes personal data, you are the controller of that data (or, if you act for your own client, a processor) and we are your processor. You decide what your Actors, runs, automations, AI requests and integrations collect and process, from which sources, for which purposes and for how long. If you act as a processor you confirm your instructions to us, including the appointment of us and our subprocessors, are authorised by the controller, and you are our sole point of contact.
These terms meet Article 28 GDPR, the UK GDPR where it applies, and Article 9 FADP, and form part of the Terms of Service without signature. "Subprocessor" means a processor we engage. Where the standard contractual clauses in section 9.6 conflict with these terms, the clauses prevail. This section does not cover personal data we process as controller, which is described in sections 1 to 8.
9.2 Your responsibilities
You warrant and are responsible for having a valid legal basis for all the data you collect or instruct us to process, including data collected from websites and APIs; for giving the notices and obtaining the consents the law requires; for instructions that comply with law and with the terms of the sources you access; for not using the Services for special categories or criminal-conviction data without the required conditions; and for handling data subject requests, notifications and impact assessments that apply to your processing. We do not check whether the data you collect is lawful, do not monitor your content, and you remain solely responsible for it.
9.3 Our obligations
Instructions. We process the data only on your documented instructions, unless the law requires otherwise. Your complete instructions are the Terms, this policy, your configuration and use of the Services, and your requests through the dashboard, API, SDKs, CLI and MCP server. Different instructions need our written agreement and may be charged.
Confidentiality and security. Everyone we authorise is bound by confidentiality. We implement the measures in section 9.7 and may update them without reducing the overall protection. You confirm they give an appropriate level of security, and you are responsible for the measures in your control, such as keeping keys secret.
Requests and assistance. If we receive a request about your data we refer the data subject to you where we can identify you, and do not answer it ourselves unless the law requires it. The Services let you access, correct, export and delete your content yourself; anything beyond minimal effort is charged at our then-current rates.
Breaches. We notify you without undue delay after becoming aware of a personal data breach affecting your data, by email to your account address, with the available information and in stages if needed. Our notice is not an acknowledgement of fault or liability.
9.4 Deletion
While your account is active you can access, export and delete your content yourself; that is your choice of return or deletion. When the account is closed, or a storage reaches the end of its retention period, we delete the data: storages after the retention period of your Plan, files and logs in the background, and backups within 7 days. We may keep it longer where the law requires.
9.5 Information, audits and subprocessors
On request we make available the information needed to show our compliance with Article 28 GDPR: this section, section 9.7, the subprocessor list and written answers to reasonable security questions. If that is not enough, you may audit us no more than once in any 12-month period, on at least 30 days' notice with an agreed scope, by you or an independent auditor bound by confidentiality and not our competitor, during business hours, at your cost and without disrupting us; you give us the report free of charge.
You give us general authorisation to engage subprocessors, listed in section 10. We update that list at least 14 days before a new subprocessor starts processing your data. You may object in writing to privacy@scrape.ly within that period on reasonable data-protection grounds; if we cannot address the objection your sole remedy is to terminate the affected service. We impose substantially equivalent obligations on each subprocessor and remain responsible for their performance, subject to the limits in the Terms.
9.6 Third parties, AI and transfers
Third-party Actors run in your account on our infrastructure. Their Creators do not receive your data from runs by default and are not our subprocessors; if an Actor sends data outside the platform its listing must say so, and choosing to run it is your instruction to a recipient that is yours. Data you send to integrations goes to recipients you choose. When you use the AI features your inputs go to model providers through our routing subprocessor, which may retain them; do not submit personal data unless you are entitled to have it processed this way.
We are established in Switzerland, which the European Commission recognises as adequate, and host the platform in Germany. Where data subject to the GDPR or FADP is transferred to a country without adequate protection, the transfer relies on an adequacy decision (including the EU-U.S. or Swiss-U.S. Data Privacy Framework where the recipient is certified) or on the standard contractual clauses of Implementing Decision (EU) 2021/914, with any supplementary measures required. Between us and our subprocessors we use Module 3; between you and us Module 2 or 3 applies as appropriate, and the clauses are incorporated by reference. Under those clauses, clause 7 does not apply, clause 9 uses option 2 with the notice period in section 9.5, the optional language in clause 11 does not apply, clauses 17 and 18 refer to Irish law and the Irish courts, and they are completed by the description in section 9.8. For FADP transfers the Swiss FDPIC is the competent authority, references to the GDPR are read as references to the FADP, and "member state" includes Switzerland.
9.7 Technical and organisational measures
- Infrastructure. Platform servers, databases, object storage and backups are hosted in data centres in Germany operated by Hetzner Online GmbH and UpCloud Ltd, which handle physical security.
- Encryption in transit. Websites, dashboard and API are reachable only over HTTPS (TLS).
- Access control. Production access is limited to staff who need it on least-privilege terms, with separate administrative credentials; customers use their own passwords or API keys.
- Separation. Content is logically separated by account, and Actors run in isolated environments.
- Secrets. Credentials and keys are removed from AI chat transcripts and administrative logs before storage, as far as they can be detected automatically.
- Availability. Daily database backups are kept for 7 days and cache backups for 3 days in object storage in Germany; systems are monitored.
- Retention and deletion. Storages, runs and logs are deleted when their retention period ends; account data is removed as in section 9.4.
- Network. Traffic passes through a network security and content-delivery provider that protects against attacks.
- Personnel and incidents. Staff with access are bound by confidentiality, and breaches are handled as in section 9.3.
9.8 Description of the processing
| Item | Description |
|---|---|
| Parties | Controller (or processor): you, the customer. Processor: TeraShift GmbH, Hauptstrasse 35a, 8272 Ermatingen, Switzerland, privacy@scrape.ly |
| Subject matter and nature | Running Actors, storing inputs and results, running automations and AI features and delivering results to integrations, as you instruct; collection, recording, storage, retrieval, transformation, use, transmission and deletion |
| Purpose | Providing the Services under the Terms |
| Duration | The term of your use and until deletion under section 9.4 |
| Data subjects and categories | Determined by you: persons whose data appears in the sources you access or the data you submit, and your own customers, prospects, employees and contacts; names, contact details, usernames and profile data, professional information, images, public posts and reviews, online identifiers, location data and other data in those sources |
| Special categories | Not intended; only as permitted by section 9.2 |
| Frequency and retention | Continuous while you use the Services; as in section 9.4 and the retention periods of your Plan |
9.9 Liability, duration and law
Each party's liability under these processor terms is subject to the exclusions and limitations in the Terms, to the extent permitted by law, without limiting liability to data subjects under the GDPR, the FADP or the clauses where the law does not allow it. These terms apply for as long as we process data for you and end automatically when we no longer do. We may update them to reflect changes in law, the Services or our subprocessors without reducing the protection of your data where the law requires your agreement, and they are governed by the law and courts in the Terms, except where the clauses or mandatory data protection law require otherwise.
10. Subprocessors
These may process personal data in your content on your behalf. The effective date shows when the list last changed.
| Subprocessor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of servers, databases, cache, object storage and backups | Germany | Not required (EU) |
| UpCloud Ltd | Compute servers for Actors and builds | Germany | Not required (EU) |
| Cloudflare, Inc. | Content delivery, DNS, network security, edge workers (including email) | Worldwide, including the USA | Data Privacy Framework where certified, otherwise SCCs |
| Amazon Web Services (Amazon SES) | Transactional email, including run and automation result emails | USA | Data Privacy Framework where certified, otherwise SCCs |
| OpenRouter, Inc. | Routing AI requests to model providers | USA | Data Privacy Framework where certified, otherwise SCCs |
| AI model providers selected through OpenRouter | Generating AI responses | USA and other countries, depending on the model | SCCs or other safeguards as available |
| Intercom | Live chat and support | USA | Data Privacy Framework where certified, otherwise SCCs |
| PostHog | Dashboard analytics and session recordings | EU (PostHog EU Cloud) | Not required for EU storage; Data Privacy Framework where certified, otherwise SCCs, for access from outside the EU |
The proxy network (residential and datacenter) and hosted browser are run by TeraShift GmbH under its Evomi brand and are not subprocessors. A further provider handles anti-bot challenges on target sites during runs. PayPro Global sells and invoices card and PayPal purchases as reseller and a separate controller for payment data. Didit provides identity verification for Creators. Coinbase provides the x402 facilitator. Google, Slack, GitHub, Discord and webhook endpoints receive data only when you connect them and instruct us to send it, and act for you. Creators of third-party Actors do not receive your data from runs by default; if an Actor sends data elsewhere its listing must say so, and the Creator is responsible for that processing.
