Privacy at Clawifi.

Who we are

ReARC Labs Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States, is the controller of the personal data described here. Send privacy, account and deletion requests to clawifisupport@rearclabs.com with the subject "Privacy request". We may need to confirm that you control the account.

What we collect

• Account data: email address, optional display name, password hash, verification state, plan, credit balance and timestamps. Session tokens and API keys are stored only as hashes.
• Requests you send: the operation, target URLs or search queries, options, timing, status and credits used, plus the results (fetched content, job and crawl output, monitor checks, saved files) so you can reopen them from your history.
• Visitors and the playground: when you visit the site or use the anonymous playground, our servers and Cloudflare process your IP address, browser details and the URLs or queries you enter. The playground keys its rate limit (12 runs a minute) to your IP address in memory; like any request, the address may also appear briefly in server logs. Playground runs are stored in a shared demo history that is not linked to an account.
• Billing data: Stripe processes checkout, payment and subscription details. We receive the customer and subscription identifiers, plan, amount and status; we never receive full card numbers.
• Integrations you set up: webhook endpoints and their signing secrets, and browser profiles or session state you choose to save for authenticated browsing.
• Messages: what you send us by email, including support requests and abuse reports.

Why we use it, and on what basis

• To perform our contract with you: accounts, API delivery, history, credit metering, billing and support.
• For our legitimate interests: security, abuse prevention, rate limiting, troubleshooting and improving the service.
• To meet legal obligations: tax, accounting and responding to lawful requests.
• Consent: only where we ask for it. Today we ask for none.

Websites and sources you reach

To complete a request, Clawifi contacts the websites and public sources you ask it to reach, such as web pages, search engines, code hosts and research indexes. Those sites receive the address or query and see the request coming from Clawifi. Their own terms and privacy policies govern what they record. If you collect personal data about other people through Clawifi, you are the controller of that data.

Browser storage

After you sign up, log in, verify your email or reset your password, the site keeps your session in an essential HttpOnly, Secure cookie that page scripts cannot read. Cloudflare may set a short-lived security cookie (__cf_bm) to filter bots. Both are strictly necessary. Public pages use no advertising cookies and no analytics, so we show no cookie banner.

Service providers

• Microsoft Azure (United States): hosting and database.
• Cloudflare (global network): delivery, security, account email and encrypted off-site backups.
• Amazon Web Services (United States): encrypted off-site backups.
• Stripe (United States): payments and subscriptions.

Each provider processes data only to provide its service to us, under its data protection terms. We will update this list before adding a provider that processes customer personal data.

International transfers

We are a US company and our team may access data from outside the United States, including from Turkey. When personal data moves from the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum) and, where a provider is certified, the EU-US Data Privacy Framework. Ask us at clawifisupport@rearclabs.com for a copy of the safeguards.

Retention

• Account data, request records, results and saved files: while your account is open, or until you delete them where the product lets you.
• Billing and credit records: as long as tax and accounting law requires.
• Security and server logs: only as long as we need them to run and protect the service.
• Deleted accounts: removed within 30 days of the request, except records we must keep for billing, tax, fraud prevention or legal claims. Encrypted backups expire after about 100 days, so deleted data leaves them within that time.
• Sessions expire after 30 days; verification and password reset links after 24 hours.

Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, and to object to or restrict certain processing. Email clawifisupport@rearclabs.com. We reply within one month; if we decline, we explain why and how to complain. You may complain to your local data protection authority. We will not discriminate against you for using your rights.

Automated decisions

Rate limits and some abuse blocks are applied automatically. We do not make decisions with legal or similarly significant effects about you solely by automated means. Ask us and a person will review a block.

Sharing

We share data only with the service providers above, at your direction, or with authorities when the law requires it. We do not sell personal information or share it for cross-context behavioral advertising.

Security

We use encryption in transit and at rest, hashed credentials and access controls; Security lists the controls and how to report a vulnerability. No service can promise absolute security. If a breach affects your personal data, we will notify the relevant authority and affected customers without undue delay, as the law requires. Report a vulnerability to clawifisupport@rearclabs.com with the subject "Security".

Children

Clawifi is a service for developers and businesses. It is not directed to anyone under 18, and we do not knowingly collect personal data from children.

Changes

We update this notice when the product or the law changes, and show the new date at the top. For material changes we also tell account holders by email or in the dashboard before they take effect.