Draft, pending legal review

This document describes how the product actually behaves, but it has not been reviewed by counsel and is not yet a binding agreement. Do not rely on it for compliance purposes.

Privacy policy

This describes what datamint collects, what it deliberately does not keep, and how long records live. It covers both the data you give us as a customer and the data our crawling pipeline handles on your behalf.

What we store about you

  • Account details — your email address, and a display name and profile image if you sign in with Google.
  • Session records — an opaque session token, its expiry, and the IP address and user agent recorded at sign-in.
  • API key hashes — a SHA-256 hash and a short display prefix. The key itself is never stored and cannot be recovered.
  • Usage records — which endpoint was called, when, the credit cost, the status, and the target URL.
  • Credit ledger and payment records — an append-only history of grants and consumption, and payment references returned by our payment processor.

We do not store your card details. Payments are handled entirely by our payment processor, which returns only a reference and a status.

What we strip from crawled data

Redaction runs inside the pipeline, before anything is stored or returned. Regex and NLP passes remove:

  • Social security numbers
  • Payment card numbers
  • Personal phone numbers
  • Private email addresses

This aligns with GDPR and CCPA expectations for data minimisation. It is a pipeline behaviour, not a setting you have to remember to enable.

Public data only

Our crawling is restricted to publicly accessible pages. We do not retrieve content behind paywalls, log in to accounts, or circumvent access controls. A configurable flag controls robots.txt compliance, and we apply adaptive backoff to any target returning 429 or 503 so that no site experiences denial-of-service pressure from our fleet.

Retention

  • Extraction evidence — screenshots, capture timestamps, and MHTML snapshots are retained alongside an extraction so a record can be traced to the page state that produced it. Retention is configurable per account.
  • Usage and ledger records — retained for the life of the account so usage can be reconciled and billing audited.
  • Sessions — expire automatically; the session record is removed when it does.
  • Suppression list — addresses that hard-bounced or were marked as spam are retained so we stop emailing them.

Sharing

We share data only with the processors needed to run the service — hosting, database, transactional email, and payment processing — and only to the extent each needs it. We do not sell personal data.

Your rights

You can request access to, correction of, or deletion of your personal data, and export your usage history. Deleting your account removes your account, sessions, API keys, and ledger. Contact privacy@datamint.xyz.

If you need a signed data processing addendum for a compliance review, see our DPA page.