Privacy policy
TL;DR: we keep what we need to run your account, bill your credits and stop abuse. For a single request we keep the target’s host name, never the full URL. A batch keeps the URLs you give it until it is cleaned up. We never write your API key, your request headers, your cookies or your IP address into a log or a table. We do not sell data and we show no ads.
OWNER name the legal entity that is the data controller, its country and its registered address. Today the text only says “Megalania”. A lawyer confirms which laws apply (for example GDPR, UK GDPR, Israeli Privacy Protection Law, CCPA) and whether we need an EU or UK representative.
Who we are
Megalania runs a scraping API, an MCP server and a dashboard. In this page, “we” means Megalania and “you” means the person or team with an account.
Contact for anything on this page: [email protected].
What we keep, and why
When you apply for the beta
You send us your email, what you want to use us for, the sites you plan to scrape (domain names only) and a rough volume. We use this to decide who gets an invite and when.
OWNER today these records keep your email even after you delete your account. Decide a retention period, or delete them with the account. See the security report.
When you sign in
You sign in with Google or GitHub. We never see or keep a password. From the sign-in provider we keep:
- your email address (only a verified one),
- your name (for GitHub, your login name if you have no display name),
- the provider’s id for your account.
We do not keep your profile picture.
Your session
When you sign in to the dashboard, we set one sign-in cookie. It keeps you signed in. It ends after 12 hours without use, or after 7 days at most.
With the session we keep a short label of your browser and system, such as “Firefox on macOS”, so you can see your active sessions. We do not keep your IP address.
A single request
For each API or MCP request we keep one record:
- the request id and time, the key that sent it, and the engine;
- the result (success, blocked, error), the status code and the credits;
- the target’s host name only, such as
example.com, never the path or the query; - the target server’s IP address and the proxy location we used;
- the name your client sends as its user agent, such as
python-requests.
We never keep the full target URL, your request headers, your cookies or your IP address.
You can see your own records in the dashboard and through the API. We delete them after 90 days. We keep hourly and daily totals longer. These totals hold counts and credits only, with no details of single requests.
OWNER the system can also keep less (no user agent or proxy city, or no host at all) per account. Decide if customers can choose this, and say how.
A batch
A batch needs its URLs to run, so we keep the URLs you give it. We delete the batch, its URLs and its records 7 days after it finishes.
The results are saved in our own storage, and a result link works for 15 minutes. Anyone who has a result link can open it, so treat it like a password. Each result is deleted 7 days after it is saved, so at the latest 7 days after the batch ends.
Page content
We fetch the pages you ask for and send them back to you. We do not read them for our own use, and we do not sell them.
Our QA team measures how well we work on public sites from our own test systems. Those tests use their own targets, not your requests.
When you ask for schema extraction, the page’s main content, your schema and your prompt go to an AI model provider: Anthropic in the US. We send no account details or anything else that says who you are. Anthropic may keep what we send for a time under its own terms. Without schema extraction, no page content goes to an AI provider. OWNER confirm the provider terms (retention, no training) before go-live.
Credits and billing
Every credit you receive or spend is a row in our ledger. The ledger is kept even after you delete your account, because we need it for accounting and to stop abuse.
OWNER/LAWYER set the ledger retention period. It may depend on tax law once payments start.
MCP connections
When you connect an AI client (for example Claude or ChatGPT) to our MCP server, we keep the connection. That is the client’s name, its return address, and an access key for it. We keep only hashes of the sign-in codes and tokens, never the tokens themselves. We drop a connection after 30 days without use, and its key after 90 days at most.
Our websites
Our home page and blog use Cloudflare Web Analytics. It is cookie-free and gives aggregate numbers only: page views, referrers and countries. The docs, the dashboard, the API and the MCP server have no analytics. Your keys, targets and requests never reach analytics.
We also count, from our own database, how many people apply for the beta, create a first key, make a first successful request and use us again 7 or more days later. These are weekly totals with no email, name, IP or other personal data. We use no advertising cookies and no other trackers.
When you pick light or dark mode on our websites, we save your choice in
one cookie, meg-theme, and in your browser’s storage. It holds only
“light” or “dark”, nothing about you. It is shared by our sites on the
same domain, so they all show the mode you picked. It lasts one year. We
set it only when you click the toggle, and we never use it to track you.
LAWYER confirm that this preference cookie and the sign-in cookie need no consent banner where we sell.
Who else handles data
We use a small number of service providers. Each one gets only what it needs:
| Provider | What for | What it sees |
|---|---|---|
| Cloudflare | Network edge, website hosting, aggregate analytics | Traffic to our sites and API |
| Google, GitHub | Sign-in | That you sign in to us |
| Proxy providers | Sending your requests to target sites | The target URL of each request, never who you are |
| Anthropic (US) | Schema extraction, only when you ask for it | The page’s main content, your schema and prompt, never who you are |
| OWNER hosting provider | Our servers and storage | Everything we store |
| Stripe (later, not in the beta) | Payments | Billing details you give Stripe |
OWNER confirm this list before go-live. Name each proxy provider, the hosting provider and its country. Say whether data leaves the EU and on what legal basis.
We do not sell personal data. We share it with authorities only when the law requires it.
How long we keep it
| Data | How long |
|---|---|
| Request records | 90 days |
| Batches, their URLs and records | 7 days after the batch ends |
| Batch results | 7 days after each is saved |
| Result links | 15 minutes |
| Screenshots | 7 days after each is taken |
| Screenshot links | 1 hour |
| Sessions | 12 hours idle, 7 days at most |
| Database backups | 14 days |
| Account (email, name) | Until you delete your account |
| Credit ledger | OWNER period |
| Beta applications | OWNER period |
Your rights
You can ask to see, fix, export or delete your personal data. Write to [email protected].
You can delete your account yourself in the dashboard. When you do:
- all your keys are deleted, and every session ends;
- queued work is cancelled, and its credits are refunded;
- your request records are deleted within a day;
- your sign-in links to Google or GitHub are deleted;
- your saved batch results and monitor snapshots are deleted at once, and a check within the hour deletes any result that work still running at that moment saved after it;
- your customer record at Stripe is deleted within the hour, which also ends any subscription (Stripe keeps the invoices the law makes it keep);
- a payment that reaches us after the delete is refunded, not credited;
- your email and name are erased.
We keep the credit ledger and a record that the account existed, without your email or name.
LAWYER add the right to complain to a supervisory authority, and the response time we promise.
Security
Your API keys are stored only as hashes. The key behind an MCP connection is stored encrypted. Traffic is encrypted. Inside our systems, access follows least privilege. If a breach affects your data, we will tell you.
LAWYER breach notice wording and time frame.
Children
The service is not for anyone under 18.
OWNER confirm the age.
Changes
We may change this page. For a big change, we tell you by email before it takes effect. The date at the top shows the latest version.
OWNER add the effective date when signed.