Privacy Policy

2.1 Personal Information

We collect personal information that you voluntarily provide to us when you register for an account, subscribe to our services, or contact us. This information may include:

• Full name
• Email address
• Company name and business information
• Billing address and payment information (processed securely through Stripe)
• Phone number (optional)
• Profile information and preferences

2.2 Usage Data and API Logs

When you use our API service, we automatically collect certain information about your usage:

• API requests, including URLs scraped, request parameters, and response data
• API key usage and authentication attempts
• Request timestamps, duration, and success/failure rates
• IP addresses and geographic location data
• User agent strings and device information
• Balance and billing metrics
• Error logs and debugging information

2.3 Technical and Device Information

We collect technical information about how you access our Service:

• Browser type, version, and language preferences
• Operating system and device type
• Screen resolution and display settings
• Referring website addresses
• Pages visited and time spent on each page
• Click patterns and navigation paths

2.4 Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to enhance your experience and collect usage data. For detailed information about our use of cookies, please review our Cookie Policy.

2.5 Communication Data

We collect information from your communications with us, including support tickets, email correspondence, feedback forms, and any other information you choose to provide.

2.6 User-Provided Session Data (BYOS)

When you use our Bring Your Own Session (BYOS) authenticated scraping feature, you may provide us with third-party session data to enable scraping of authenticated content. This data may include:

• Session cookies from third-party websites (e.g., authentication tokens, login session identifiers)
• Authentication headers or bearer tokens you provide via the API
• Cookies captured through the AlterLab Chrome Extension cookie capture feature
• Domain associations for stored session data (which websites the cookies belong to)

Important: We treat all user-provided session data as highly sensitive authentication material. You are responsible for ensuring you have the right to use and share the session data you provide. We do not access, read, or use your session cookies for any purpose other than injecting them into your authorized scraping requests.

5.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf:

• Stripe: Payment processing and subscription management
• Cloud Infrastructure Providers: Hosting and data storage services
• Analytics Services: Microsoft Clarity for behavioral analytics, heatmaps, and session recordings
• Email Service Providers: Transactional and marketing email delivery
• Customer Support Tools: Help desk and ticketing systems

These service providers have access to your personal information only to perform specific tasks on our behalf and are obligated not to disclose or use it for any other purpose.

5.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, or government agencies).

5.3 Business Transfers

If we are involved in a merger, acquisition, asset sale, or bankruptcy, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

5.4 Protection of Rights

We may disclose information when we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, violations of our Terms of Service, or to protect our rights, property, or safety, or that of others.

6.1 Right to Access

You have the right to request access to the personal information we hold about you. We will provide you with a copy of your data in a structured, commonly used, and machine-readable format.

6.2 Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal information we hold about you. You can update most information directly through your account settings.

6.3 Right to Deletion

You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, fraud prevention, or legitimate business purposes). You can delete your account at any time through your account settings.

6.4 Right to Data Portability

You have the right to request a copy of your personal information in a portable format that can be transferred to another service provider.

6.5 Right to Opt-Out

You can opt-out of receiving marketing communications from us at any time by clicking the "unsubscribe" link in our emails or by contacting us. You may also opt-out of certain data collection practices, such as analytics cookies, through your browser settings.

6.6 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal information under certain circumstances, such as when you contest the accuracy of the data or object to our processing.

6.7 Right to Object

You have the right to object to our processing of your personal information for direct marketing purposes or when processing is based on legitimate interests.

6.8 Right to Lodge a Complaint

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the right to lodge a complaint with your local data protection supervisory authority if you believe that our processing of your personal data violates applicable data protection laws. You can find a list of EEA supervisory authorities at the European Data Protection Board website. While we encourage you to contact us first to resolve any concerns, this right can be exercised at any time.

8.1 What We Collect and Store

• Stored sessions: When you create a named session via the API or Chrome Extension, we store the encrypted cookie data, the associated domain, a user-defined session name, and metadata (creation date, last used date)
• Inline sessions: When you pass cookies directly in an API request, we process them in memory only — no cookie data is written to disk or persisted after the request completes
• Chrome Extension capture: The AlterLab Chrome Extension reads cookies from your browser for domains you explicitly select and transmits them to our API over an encrypted connection. The extension does not capture cookies without your explicit action

8.2 How We Use BYOS Data

We use your session data solely to inject it into scraping requests you initiate. We do not analyze, profile, or extract information from your session cookies. We do not use your session data to access third-party accounts except as directed by your API requests.

8.3 Retention and Deletion

• Stored sessions: Retained until you explicitly delete them through the API or dashboard, or until your account is deleted. There is no automatic expiration — you maintain full control over the lifecycle of your stored sessions
• Inline sessions: Discarded immediately after the API request completes. No data is retained
• Account deletion: When you delete your account, all stored session data is permanently and irreversibly deleted within 30 days

8.4 Your Rights Over BYOS Data

In addition to the general rights described in Section 6, you have the following specific rights over your BYOS session data:

• View: You can list all stored sessions and their metadata (domain, name, creation date) via the API or dashboard at any time
• Delete: You can delete any individual session or all sessions at any time through the API or dashboard. Deletion is immediate and irreversible
• Export: You may request an export of your stored session metadata (excluding the encrypted cookie values) as part of a data portability request

8.5 Third-Party Responsibility

AlterLab acts as a data processor for BYOS session data that you provide. You are the data controller and are responsible for ensuring that your use of third-party session cookies complies with the terms of service of those third-party websites and all applicable laws. We do not verify the validity, ownership, or authorization of session data you provide.