Privacy Policy
Last updated: 30 October 2026
This policy explains how Webcrawl Ltd (“Webcrawl”, “we”, “us”) handles personal data when you use https://webcrawl.site and the Webcrawl apps for iOS and Android.
1. Data controller
Private limited company registered in England and Wales
Registered office : 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
E-mail : [email protected]
2. Data we process
| Data | Why | Legal basis |
|---|---|---|
| Account: email address, optional name, language, sign-in codes (stored only as a hash) | Create and secure your account, sign you in without a password | Contract |
| App identifiers: an anonymous account ID created by the app, sign-in tokens per device (stored as a hash) | Use the app before signing in, link purchases to your account | Contract |
| Sites and crawls: addresses of the sites you crawl or save, scores, issues found, scheduled crawl settings | Provide results, history and monitoring | Contract |
| Payments on the website: email, country, billing name and address, VAT number, invoice and subscription details. Card details are handled by Stripe, never by us. | Take payment, issue invoices, manage your subscription | Contract; legal obligation (accounting) |
| App store purchases: transaction and subscription identifiers, status and dates sent by Apple or Google. We receive no card details. | Activate Pro and keep it in sync with the store | Contract |
| Notifications: device push token (Firebase Cloud Messaging) | Send monitoring alerts to your phone | Consent (you can turn them off at any time) |
| Emails we send: sign-in codes, receipts, trial reminders, monitoring alerts | Run the service; alerts can be turned off in “My account” | Contract |
| Usage and security: a hashed (non-reversible) IP address, a visitor cookie, numbers of crawls and pages | Apply free-plan limits, prevent abuse | Legitimate interests (security, fair use) |
| Messages: name, email and content of messages you send us | Answer you | Legitimate interests |
| News (optional): email | Occasional product news | Consent |
Sites you crawl receive requests from our bot (WebcrawlBot) from our server, never from your IP address. We do not sell personal data and do not use advertising or tracking cookies.
3. How long we keep data
- Account, sites and settings: until you delete your account.
- Crawl history: 30 days on the free plan, 12 months on Pro. Crawls by visitors without an account: 90 days.
- Payment and invoice records: 6 years after the end of the financial year (UK accounting rules), detached from your deleted account.
- Sign-in codes: 30 minutes (records deleted after 24 hours). Abuse-prevention counters: up to 2 days; monthly usage counters: 13 months.
- Messages: as long as needed to deal with your request.
4. Who we share data with
- Our hosting and email providers, to run the website, the database and send emails.
- Stripe (payments on the website), acting as an independent controller for payment data. Stripe privacy policy.
- Apple and Google for purchases made in their stores, under their own privacy policies.
- Google Firebase (Cloud Messaging) to deliver app notifications, if you allow them.
- Google Fonts (typefaces on the website) and Cloudflare Turnstile (anti-robot check on the contact form).
Some of these providers process data outside the UK (for example in the United States). Such transfers rely on UK adequacy regulations (including the UK–US data bridge where the provider is certified) or on the International Data Transfer Agreement / Addendum.
5. Your rights
Under UK data protection law (UK GDPR and the Data Protection Act 2018) — and the EU GDPR if you live in the EU — you can ask to access, correct, delete or export your data, restrict or object to its use, and withdraw consent at any time. You can delete your account yourself in “My account” or in the app. For any request, write to [email protected]. You can complain to the UK Information Commissioner’s Office (ico.org.uk) or to your local data protection authority.
6. Children
The service is not directed at children under 13, and we do not knowingly collect their data.
7. Security
Connections are encrypted (HTTPS), sign-in codes and tokens are stored only as hashes, IP addresses are hashed, and access to the administration area is restricted.
8. Changes and contact
We may update this policy; the date at the top shows the latest version, and we will email account holders about significant changes. Questions: [email protected] · contact page.