Privacy Policy

1. Product and local data

Web Data Extractor lets you select page fields, extract lists or tables, and export CSV, Excel or JSON. Basic local extraction does not require an account.

Extraction results, task history and snapshots are stored locally in browser IndexedDB by default. Preferences and local rules are kept in browser storage. Enabling cloud rule sync uploads rule configuration, rather than extraction results. Do not include passwords or other sensitive information in rule names, selectors or feedback.

2. Google sign-in data and purposes

Google sign-in requests only the openid, email and profile scopes to verify identity, create or link an account, and display profile information. The server processes your Google account identifier, email, display name, avatar URL and language information returned by Google. We do not receive your Google password or request permission to read, send or delete Gmail messages, access contacts, Google Drive files or calendars.

The authorization code is sent to Google to obtain the tokens needed for sign-in and retrieve basic profile information. The current implementation does not persist Google access or refresh tokens as account profile data. Google data is not used for advertising, sale, training general-purpose AI models or purposes unrelated to account features. Use and transfer of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.

3. Email accounts, security and payments

Email registration processes your email, display name, password hash, verification code digest and verification status. Account passwords and verification codes are not stored in plain text. Sign-in also records the last login time, source IP, session and security status.

Payments are handled by the selected Waffo or Stripe hosted checkout. We send that provider a stable product account identifier, an email prefill value, the selected product and order identifiers. We retain subscription periods, currency, base amounts, taxes, actual payments, refunds and provider identifiers, without directly storing full payment card details. Test payments are for administrator verification and do not grant production entitlements.

4. Information you submit and service providers

Cloud rule sync, account management, feedback and diagnostics that you choose to use send the relevant configuration or content to the server. Review diagnostics and feedback before submission. Do not submit private page information, passwords, tokens or data you do not want service operators to see.

Google handles sign-in authorization; the selected email provider handles verification and password reset emails; and the selected Waffo or Stripe provider handles payments. Operations and hosting services are used to provide the relevant service. We do not sell personal information or provide Google sign-in data to advertisers. Information is processed with your authorization, as necessary to provide services, for security or as required by law.

5. Cookies and registration abuse prevention

The website uses HttpOnly session cookies. Registration protection also uses a signed HttpOnly device cookie valid for 30 days, sent over HTTPS in production. This identifier limits automated bulk registration; it is not a hardware fingerprint and is not used for advertising tracking.

The registration rate-limit database stores HMAC digests of IP addresses or IPv6 network prefixes and device identifiers, counters and expiration times. Expired counters are cleaned when an image CAPTCHA is requested. Server request logs do not include extracted page bodies.

6. Retention, export and deletion

You control retention and deletion of local extraction data. You can delete history in extension settings or remove the extension; first export anything you want to retain. Account information and cloud configuration necessary to provide the service are retained while your account exists.

The website dashboard lets you export account data, delete cloud rules, revoke sessions or delete your account. Account deletion removes related rules, sessions and usage data and anonymizes the account. Billing, security and backup records are retained according to the applicable processing workflow. Deletion does not promise immediate physical removal from every backup.

You can revoke this application in the third-party connections settings of your Google account. Revoking Google authorization does not delete your Web Data Extractor account. Previously issued product sessions must be revoked in the dashboard, and local extraction data is not automatically deleted.

7. Security, policy updates and contact

We use transport encryption, access controls, password hashing and server-side rate limits. No system can guarantee absolute security. Protect your account and promptly remove sensitive extraction results.

This page shows its last update date. Material changes to processing purposes or permission scopes will be reflected in this policy, with explanations or consent where applicable. For questions about personal information, Google sign-in data or deletion requests, use the privacy contact channel below.

Contact

A contact email has not been published. Visit website support for current contact options.