Privacy & Cookie Policy
Last updated: 15 October 2026. This policy explains how Scrapeit Sp. z o.o. uses personal data of people who visit scrapeit.io or contact us, which cookies and similar technologies the site uses, and what rights you have. It does not cover data we process for clients as part of our scraping services; that is governed by our agreements with those clients.
Who we are
The controller of your personal data is Scrapeit Sp. z o.o., 10/208 Legionowa str., 15-099 Białystok, Poland, NIP 5423457175, REGON 523384582. For any question about your data, or to use your rights, write to info@scrapeit.io or call +48 537 99-79-56.
What we collect and why
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Answering enquiries sent through our forms, by email, phone or chat, and preparing a quote | Name, work email, company, phone if you give it, your message and the sites you ask about; the page the form was sent from and the IP address it was sent from; if you reached that page from another website or through a link with UTM tags, that website's domain and the tags. With analytics consent these come from the first page of your visit instead, and the form also sends the number of pages viewed. In chat, also your IP address, approximate location, browser and the pages you view while the chat is loaded | Our legitimate interest in answering your enquiry and in business communication with you and the company you represent (art. 6(1)(f) GDPR); if you contact us for yourself, also steps taken at your request before a contract (art. 6(1)(b)). The visit details sent with analytics consent: your consent (art. 6(1)(a)) | For as long as the conversation and any cooperation that follows last, then until claims expire under Polish law (generally three years for business claims, counted to the end of the calendar year) |
| Sample dataset orders and payments | Name, email, company, the sample ordered, order and payment status, and the details needed for an invoice (name or company name, address and, for businesses, VAT number). Card details are entered on Stripe's pages; we do not see them | Performance of the contract (art. 6(1)(b) GDPR) if you buy for yourself; if you order for your company, our legitimate interest in handling the order with the company you represent (art. 6(1)(f)); our legal obligations in tax and accounting, including e-invoicing in KSeF (art. 6(1)(c)) | Order records: until claims under the order expire (see above). Invoices and accounting records: five years from the end of the calendar year in which the related tax was due, as Polish tax law requires |
| Protecting forms from spam | Your IP address and signals that Google reCAPTCHA reads from your browser and device when you start filling in a form | Our legitimate interest in keeping forms usable and free of abuse (art. 6(1)(f)); the protection is part of the form service you are using. If you prefer not to use a form, you can email us at info@scrapeit.io instead | Set by Google, see the cookie table |
| Running and securing the website | IP address, browser and device type, page requested, time, referrer (server and Cloudflare logs) | Our legitimate interest in a secure and working site (art. 6(1)(f)) | Server logs: 14 days. Cloudflare logs: kept by Cloudflare as our processor under its data processing terms; we do not export or store them |
| Aggregated measurement without consent (Google Consent Mode) | When you have not allowed analytics or advertising: the time, the page and the referring page, browser and device type, whether an ad click brought you (with the click identifier removed) and your consent status. No cookies are set or read. Google receives your IP address with the request, as with any web request; Google Analytics does not store IP addresses of visitors from the EU | Our legitimate interest in measuring visits and the results of our advertising in aggregate (art. 6(1)(f) GDPR) | Under Google's rules; these signals carry no identifier that links them to you |
| Analytics | Pages viewed, time on pages, scrolling, clicks on links and file downloads, form events (that a form was started or sent), visit source, approximate location, device and browser data, pseudonymous identifiers | Your consent (art. 6(1)(a) GDPR and art. 399 of the Polish Electronic Communications Law) | Google Analytics keeps event data for at most 14 months (the period set in our account). Withdrawing consent stops new collection and deletes the cookies; to have data already collected deleted, write to info@scrapeit.io |
| Session recording | Clicks, scrolling and mouse movement on our pages; form fields are hidden from the recording | Your consent | Recordings are kept for 15 days and then deleted automatically |
| Advertising | Pseudonymous identifiers, the ad click that brought you, pages viewed and enquiries sent | Your consent | Cookie lifetimes in the table below; Google keeps data as an independent controller under its privacy policy |
| Company identification and live chat on every page | IP address, pages viewed, pseudonymous identifiers; the company matched to the IP address; Apollo.io and its partner LiveIntent may also match the visit to business contacts | Your consent | Leadfeeder, Apollo.io and tawk.to keep visit data in our accounts for as long as we use the service and delete it when we close the account; you can ask us to delete it earlier. Data that Apollo.io adds to its own business database is kept under its privacy policy |
| Keeping a record of your cookie choice | A random ID stored in your browser, your choice per category, the banner and policy version, time, page and country (from Cloudflare). No IP address | Our legal obligation to be able to show that consent was given (art. 6(1)(c) and art. 7(1) GDPR) | 36 months |
Giving us your data is voluntary, but without contact details we cannot answer an enquiry or send a sample. If you buy a sample, we need the details that Polish tax law requires on an invoice. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. With your consent, Google Ads uses visit data to show our ads to people who visited the site, and Apollo.io and Leadfeeder match visits to companies; this is profiling for marketing and has no such effects.
Cookies and similar technologies
Cookies and similar technologies (local storage, session storage, scripts that read information from your device) store or read information on your device. Without asking for consent, we use only those that are strictly necessary to run the site or to provide a service you ask for, such as a form or the chat. Google Analytics and Google Ads are loaded on every page, but until you allow analytics or advertising they set and read no cookies and send Google only signals without identifiers (see aggregated measurement above). Everything else - the rest of analytics and advertising, session recording, company identification and the chat on every page - runs only after you allow it in the cookie banner. You can change or withdraw your choice at any time in Cookie settings at the bottom of every page; withdrawing consent does not affect processing that took place before. When you withdraw, we delete the cookies and storage these tools set on scrapeit.io; cookies set on other providers' own domains can only be deleted in your browser. You can also block or delete cookies in your browser settings, although some parts of the site may then not work.
Your choice is stored in your browser and applies only to that browser. It is kept for six months, after which we ask again. We also ask again when we add a provider or a purpose that needs your consent.
In the tables below, "first party" means the cookie or storage entry is set on scrapeit.io. Where the provider is not Scrapeit, that provider's script reads the entry and the provider receives the information in it. Entries with Scrapeit as the provider are used only by us. "Third party" means the provider sets the cookie on its own domain, and only that provider can read it.
Necessary (always on)
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| sc_consent | Scrapeit (first party) | Stores your cookie choices | 6 months |
| sc_chat | Scrapeit (first party) | Remembers that you started the chat in this browser session | Until the browser is closed |
| PHPSESSID | Scrapeit (first party) | Session cookie set on every page; used by the enquiry forms and the sample order | 7 days |
| __cf_bm, cf_clearance, _cfuvid, cf_chl_* | Cloudflare (set on our domain) | Protection against bots and attacks; only set when the related Cloudflare protection is used | __cf_bm and cf_clearance up to 30 minutes; _cfuvid and cf_chl_* lifetime not published by Cloudflare (cf_chl_* only during a security check) |
| _GRECAPTCHA | Google reCAPTCHA (www.recaptcha.net, third party) | Spam protection; loaded only when you start filling in a form | About 6 months (Google does not publish an exact period) |
| twk_uuid_*, TawkConnectionTime, twk_idm_key; local storage twk_*; session storage previousNav | tawk.to (first party) | Keep your chat conversation going between pages. Set only after you start the chat, or on every page with consent to company identification and live chat | Without that consent: until the browser is closed, and deleted at the start of your next browser session. With it: twk_uuid_* 6 months, other cookies until the browser is closed, local storage until you clear site data |
The chat button and the map on the contact page load the tawk.to chat and the OpenStreetMap map only when you ask for them. The fonts used on the site are served from our own server.
Analytics (with consent)
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| _ga, _ga_3V2608BHE5 | Google Analytics (first party) | Distinguish visitors and sessions | Up to 2 years (browsers may shorten this to 400 days) |
| si_src (session storage) | Scrapeit (first party) | Remembers the first page of your visit, the referring domain, UTM tags and the number of pages viewed, sent with an enquiry | Until the tab is closed |
Advertising (with consent)
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| _gcl_au, _gcl_aw, _gcl_gs; local storage _gcl_ls | Google Ads (first party) | Link visits and enquiries to the ad click that brought you | 90 days; local storage until you withdraw consent or clear site data |
| IDE, Conversion | Google (doubleclick.net, googleadservices.com, third party) | Ad measurement and remarketing | IDE up to 13 months; Conversion 90 days |
Company identification and live chat (with consent)
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| _lfa, _lfa_test_cookie_stored; local storage _lfa, _lfa_expiry | Leadfeeder (first party) | Recognise returning visitors; the company is matched from the IP address | _lfa 1 year; _lfa_test_cookie_stored expires immediately; local storage until you withdraw consent or clear site data |
| Local storage apolloAnonId, 685c5f3595aaa40011bc0aba_canTrack, 685c5f3595aaa40011bc0aba_eventQueue | Apollo.io (first party) | A random (pseudonymous) visitor ID and a queue of page visits, used to recognise the company behind a visit | Until you withdraw consent or clear site data; canTrack about 1 day |
| Cookies on LiveIntent's domains | LiveIntent, used by Apollo.io (third party) | Match a visit to business contacts, where Apollo.io uses it | Set by LiveIntent |
| tawk.to on every page | tawk.to | The chat loads on every page and shows us your visit so we can greet you (see Necessary for its cookies) | As in the Necessary table, with consent |
Who receives your data
We share data with the recipients below, for the purposes described above. Courts and public authorities receive data only when the law requires it.
| Recipient | What for | Role | Where |
|---|---|---|---|
| netcup GmbH, Karlsruhe, Germany (privacy policy) | Server hosting | Processor | Germany |
| Cloudflare, Inc., San Francisco, USA (privacy policy) | Content delivery and security for all site traffic | Processor | USA and global network |
| Google Ireland Limited, Dublin, and Google LLC, USA (privacy policy) | Google Analytics, Google Tag Manager | Processor | EU and USA |
| Google Cloud EMEA Limited, Dublin, or Google Cloud Poland Sp. z o.o., Warsaw (our Google Cloud contracting entity), and Google LLC, USA | Email (Google Workspace), reCAPTCHA spam protection on forms | Processor | EU and USA |
| Google Ireland Limited (for visitors from the EEA and Switzerland) or Google LLC (for visitors from the UK) | Google Ads conversion measurement and remarketing | Independent controller (Google Ads controller terms) | EU and USA |
| Freshworks Inc., San Mateo, USA (Freshsales CRM) | Our sales CRM: enquiries sent through the contact form are copied into it | Processor | EU |
| Slack Technologies Limited, Dublin, and Slack Technologies, LLC, USA | Internal team messaging, where we discuss enquiries | Processor | USA |
| Dealfront Group GmbH (Leadfeeder), Karlsruhe, Germany, and its affiliates (privacy policy) | Recognising companies that visit | Processor | EU; some sub-processors process data in the USA under the EU Standard Contractual Clauses |
| ZenLeads, Inc. d/b/a Apollo.io, USA (privacy policy) | Recognising companies that visit and matching visits to business contacts, also through its partner LiveIntent, Inc. (USA) | Joint controller with us for collecting visit data on our site and passing it to Apollo (see below); processor when it matches visits to companies for us; independent controller of its own business database | USA |
| tawk.to Inc., USA (privacy policy) | Live chat | Processor | USA |
| Stripe Technology Company, Limited and Stripe Payments Europe, Limited, Ireland (Stripe group) (privacy policy) | Payment for sample datasets on Stripe's pages | Processor for the payment; controller for its own purposes such as fraud prevention | EU and USA |
| OpenStreetMap Foundation, United Kingdom (privacy policy) | The map on the contact page, only after you click it | Independent controller | United Kingdom |
| Polish tax authorities (national e-invoicing system KSeF) | Invoices | Public authority | Poland |
For collecting visit data with the Apollo.io tracker on our site and passing it to Apollo, Scrapeit Sp. z o.o. and ZenLeads, Inc. d/b/a Apollo.io are joint controllers. We decide whether the tracker runs, ask for your consent and inform you; Apollo provides the tracker and is alone responsible for what it later does with the data in its own business database. You can use your rights with either of us: write to info@scrapeit.io or to Apollo's data protection officer at dpo@apollo.io.
How Google uses data from sites and apps that use its services, including ours: business.safety.google/privacy.
Transfers outside the European Economic Area
- USA. Google, Cloudflare, Apollo.io, tawk.to and Stripe are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as giving adequate protection; their contracts also include the EU Standard Contractual Clauses as a fallback. Slack and LiveIntent process data under their own data processing terms. Some of Leadfeeder's sub-processors process data in the USA; Leadfeeder covers those transfers with the EU Standard Contractual Clauses.
- United Kingdom. Covered by an EU adequacy decision.
You can ask us for a copy of the safeguards at info@scrapeit.io.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive data you gave us in a portable format where the law provides for it, and to withdraw consent at any time (for cookies, in Cookie settings). To use any of these rights, write to info@scrapeit.io. We reply within one month; for complex requests the law allows up to two more months, and we will tell you within the first month if we need them.
Right to object. Where we process your data on the basis of our legitimate interest, you can object at any time on grounds relating to your particular situation, and you can object to direct marketing at any time without giving a reason. Write to info@scrapeit.io.
You can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.
Security
The site is served over HTTPS only. Access to enquiries, logs and accounts is limited to the people who need it. No method of transmission or storage is completely secure, but we work to protect your data from loss and unauthorised access.
Changes to this policy
We update this policy when our practices or the law change. The date at the top shows the latest version. If we add a provider or a purpose that needs your consent, the cookie banner asks for your choice again.
