Privacy Policy

1. Who we are

Scrappy (scrappy.gg) is operated by AW3 Technology, Inc., a company based in San Francisco, California, USA ("we", "us"). For any privacy question or request, write to will.schulz@aw3.tech.

2. The two roles we play

We handle personal data in two different roles, and your rights are exercised differently in each.

• For account data, we are the controller. This is the information about the people who sign up for and use Scrappy: your account, your billing and how you use the product. We decide how it is used, as described in this policy.
• For data our customers collect with Scrappy, we are a processor (a "service provider"). Customers use Scrappy to collect business contact details from websites, to enrich and score them, and to run cloud browser sessions. This includes logins that a customer's own end users save so that a browser session can stay signed in to a site. The customer decides what to collect and why, and is the controller of that data. We store and process it on the customer's instructions.

If your information was collected by one of our customers, see section 10.

3. Data we handle

Account data (controller)

• Account details: name, email address, password (stored hashed), profile picture if you sign in with a provider that supplies one
• Sign-in and security records: sign-in times, failed sign-in attempts, IP address and browser user agent
• Consent records: your acceptance of the terms and this policy, and your marketing preference, with timestamps
• Billing: credit balance, usage and purchases. Card details are entered on the hosted checkout of our billing provider and are not seen or stored by us
• Content you create: projects, sources, settings, chat conversations with the AI agent, API keys (stored hashed)
• Diagnostics: application logs, error reports and page-performance measurements from the signed-in dashboard
• Messages you send us by email or through the chat on our website

Customer data (processor)

• Leads and profiles a customer collects: typically names, job titles, employers, business email addresses, phone numbers and public social profile links, plus any other fields the customer configures
• Results of email validation, enrichment, scoring and matching
• Outreach content and delivery records, and suppression lists
• Cloud browser data: the pages visited in a session, files downloaded or uploaded, recordings a customer makes, and saved logins (cookies and site storage) for browser profiles
• Credentials a customer stores for sites that need a login

Stored credentials and saved logins are encrypted at rest.

4. Why we use it, and the legal basis

For customer data, we process it only to provide the service to that customer. The customer is responsible for having a legal basis for collecting and using it.

5. Automated processing

Customers use Scrappy to score and rank business contacts, including with AI matching. Those rankings are a tool for the customer; what the customer does with them is the customer's decision. We do not make decisions about individuals that have legal or similarly significant effects based solely on automated processing.

6. Who we share data with

We do not sell personal data. We share it with the service providers that help us run Scrappy, and only as needed for the purpose listed. The full list, with what each provider receives, is on the subprocessors page. In summary:

• Hosting: Fly.io hosts the application, database and cloud browsers in the United States
• Billing: cred.diy and the payment processor behind its hosted checkout
• Email: Resend
• AI features: Anthropic and Perplexity (and OpenAI where configured). When you ask an AI feature to work on leads, profiles or page content, that content is sent to the provider to produce the result
• Proxies and search: Webshare, SerpAPI and Serper
• Optional services, where configured or connected: CAPTCHA-solving services, Hunter, third-party email verifiers, AngelSend, GitHub, 1Profile and Google

We may also disclose data if the law requires it, or as part of a merger or sale of the business, in which case this policy continues to apply to the data transferred.

7. International transfers

Scrappy is hosted in the United States, and our service providers may process data in the United States and other countries. If you are in the EEA, the UK or Switzerland, your data is therefore transferred outside your country.

We want to be plain about where this stands: we do not yet have Standard Contractual Clauses or a Data Privacy Framework certification in place. A data processing agreement including transfer terms is being prepared and will be available on request. If you need these before using Scrappy, write to will.schulz@aw3.tech.

8. How long we keep data

These are the retention periods the service is built around. Automatic enforcement of them is being rolled out, so until it is complete some data may be kept longer than the period shown. You can delete leads, exports, browser profiles and your account yourself at any time.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal data, to object to its use, and to withdraw consent.

• Export: request a copy of your account data from Settings > Privacy
• Deletion: delete your account from Settings > Privacy. There is a 30-day grace period during which you can cancel
• Marketing: change your preference in Settings > Privacy
• Anything else: write to will.schulz@aw3.tech. We will respond within one month

You also have the right to complain to your local data protection authority.

10. If your information was collected by a Scrappy customer

Our customers use Scrappy to collect business contact details from public web pages. If you believe a customer holds information about you in Scrappy, or you have received an email sent with it, you can ask to see that information, have it deleted, or opt out of further contact.

Write to will.schulz@aw3.tech and tell us the email address or other details the request is about. Requests are handled by email. Because the customer is the controller of that data, we will pass your request to the customer concerned and help them act on it. You can also contact the sender of any message directly.

11. Cookies and browser storage

• Sign-in cookie: when you sign in, we set a session cookie so you stay signed in. It is necessary for the service
• Local storage: the dashboard stores interface preferences in your browser, such as the current project and table layout
• Performance measurements: the signed-in dashboard reports page-load timings to our own servers. They are not sent to a third-party analytics service
• Chat on our website: the chat on our public pages is provided by AngelSend. It loads only when you click the chat button. Once opened, it may store data in your browser and receives what you type

We do not use advertising cookies or third-party analytics trackers.

12. US state privacy rights (including California)

We do not sell personal information, and we do not share it for cross-context behavioral advertising. Depending on your state, you may have the right to know what personal information we hold, to have it deleted or corrected, and not to be discriminated against for exercising these rights. To make a request, write to will.schulz@aw3.tech. We may need to verify your identity before acting on it.

13. Children

Scrappy is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

14. Security

Access to the service is protected by authentication, rate limiting and account lockout. Stored credentials and saved logins are encrypted at rest, and connections to Scrappy use HTTPS. No system is perfectly secure. Scrappy has not been through a SOC 2 or similar independent audit.

15. Changes to this policy

We will update this page when our practices change and revise the effective date at the top. If a change is significant, we will tell account holders by email or in the product.

16. Contact

AW3 Technology, Inc. — will.schulz@aw3.tech

See also: privacy features in the product, subprocessors and the terms of service.