privacy policy
version 2026-10-11
TODO legal: who is responsible for your data
TODO legal: the controller's legal name, address and contact for privacy requests.
what we collect
- Your account: e-mail address, the username and company name you chose, your password (stored only as a one-way hash) and, if you set one up, your authenticator app's secret.
- Your sign-ins: the IP address and browser each sign-in came from, and the IP address you signed up from.
- Your team: each colleague's e-mail address and what they may do.
- Billing: the billing e-mail, the card's brand, last four digits and expiry (the card itself goes to Stripe), invoices and the money ledger. For a bill paid by hand — a bank transfer or a crypto payment — the payment's reference (the transfer's reference or the transaction hash) and the date the money arrived.
- What you send the products: job inputs, URLs, uploaded files, delivery settings, webhook addresses — and what the products produce from them.
- Usage: requests and bytes per proxy login and per website, and the address your browser or client connects from.
TODO legal: the lawful basis for each (contract, legal obligation, legitimate interest).
who else receives it
| processor | what it does and receives | where | its notice |
|---|---|---|---|
| Cloudflare Turnstile | Bot check on the sign-up, sign-in and password-reset forms. Runs in your browser, so it receives your browser's IP address and the page you are on. | TODO legal | TODO legal |
| Stripe | Card payments: saving a card, top-ups, plan renewals and refunds. Your card details go straight from your browser to Stripe; Syphoon keeps the card's brand, last four digits and expiry, and Stripe keeps the billing e-mail it was given. | TODO legal | TODO legal |
| The e-mail relay | Transactional mail — address verification, password resets, bills, notices you subscribed to. It receives the address each message is sent to and the message. | TODO legal | TODO legal |
| Web data providers | Web data providers we contract with to fetch pages and product data for your jobs, scheduled batches and API requests. They receive the URLs and inputs you submit, never who you are. | TODO legal | TODO legal |
| Proxy network providers | Proxy networks we contract with carry the connections you make through your proxy logins to the websites you reach. They see that traffic and our own credentials, never your login or who you are. | TODO legal | TODO legal |
| Hosting provider(s) | The companies whose servers and networks Syphoon runs on. They hold everything the platform stores, on their disks and their network, because they run the machines — not the software. Traffic between our servers is encrypted. Which provider, in which region, and the basis for any transfer outside the EEA: TODO legal. | TODO legal | TODO legal |
| Offsite backup storage | An online storage bucket that keeps the nightly backups. Every backup is encrypted before it leaves our servers, so the provider holds only data it cannot read. Which provider, in which region, and the transfer basis: TODO legal. | TODO legal | TODO legal |
| Second backup host | A second machine that keeps a copy of the same encrypted backups, reached over an encrypted connection. Who runs it, where, and the transfer basis: TODO legal. | TODO legal | TODO legal |
| x402 payment facilitator (only when that payment method is switched on) | Checks and settles a stablecoin payment made with the x402 method: it receives the paying wallet's address and the signed payment, never your name or e-mail address. The method is not switched on today, so it receives nothing. Region and transfer basis: TODO legal. | TODO legal | TODO legal |
how long it is kept
| Your account, your team and their settings | Until you ask for the account to be deleted; then erased when the 30-day grace period after your request ends — later only while something must be settled first (an unpaid bill, a refund we owe you, a card dispute, a payment our support team is still sorting out), and the deletion screen says what it is waiting for. An account Syphoon closed is kept until you ask for its erasure (sign in to ask, or write to support); an account is never erased just for being unused. A colleague you erase is erased at once. Your sign-ins (with the IP address and browser each came from) and the IP address you signed up from are kept with the account and erased with it; the account's audit trail is kept, with your IP address and other personal details removed from it at erasure. |
| Billing e-mail and card record | Until 120 days after your last card payment, for chargeback defence — even when the account is deleted sooner. A bill paid by hand (a bank transfer or a crypto payment) starts no such hold. The card's fingerprint — the payment processor's code for a card, not its number — is kept with no end date where the card released the free signup balance, even after an erasure, so the same card cannot release it again on a new account. |
| Invoices and the money ledger | For the tax-retention period (TODO legal: 10 years, jurisdiction to be confirmed), keyed by an account id that no longer names you once the account is erased. For a bill paid by hand we keep the payment's reference and the date the money arrived; at erasure the reference is replaced by a one-way code, so it no longer names who paid. |
| Job inputs — the URLs, product ids and search terms you submit | While the account exists; erased with it when the 30-day grace period after a deletion request ends. |
| Results, request logs and uploaded files | Between 30 and 90 days depending on the product. The proxy's request log empties the address your connections came from after 7 days, and keeps only a short list of harmless response headers from the sites you reach — never their cookies or a redirect's full address. Request and response previews are masked for personal details before they are stored. |
| Proxy usage records (data used and charges, per request) | For the tax-retention period, like invoices (TODO legal: 10 years, jurisdiction to be confirmed). The website each request went to is removed after 90 days, or sooner when the account is erased; the analytics copy drops it after 90 days too. |
| Server logs | 30 days. They name accounts and people by an internal id, never by e-mail address. The web front end's log also holds the IP address and browser of each request, kept for those days to investigate abuse (our legitimate interest; you may object — write to support). |
| Backups | At most 35 days, so erased data can survive in a backup for up to 35 days and is erased again if a backup is ever restored. |
| E-mails we send you (verification, bills, notices) | 90 days after they are sent, then deleted; one still being delivered is kept until delivery is settled. |
| A signup whose e-mail address is never confirmed | Deleted outright 7 days after the signup: the account and everything in it. Signing in needs a confirmed address, so such an account cannot have been used. |
| The count of free signup balances given to one IP address | 8 days. It stops one IP address from collecting many free balances in a day, and holds a one-way code made from the address and the accounts counted against it — not the address itself. |
| The abuse record, when an account Syphoon closed for abuse is erased | 3 years after the erasure, then deleted. It holds a one-way code made from the e-mail address (not the address itself), the reason the account was closed, and the closing and erasure dates — nothing else. A new signup whose address gives the same code is held for review by a person before it can be used. To contest a hold, write to support. |
your rights: a copy, erasure and corrections
The account owner can download a copy of the account's data, and delete the account, from the account page. Deleting closes the account at once and erases its personal data when a 30-day grace period ends, during which signing in again lets you keep it. The erasure can wait past those 30 days while something is still to be settled — a bill not yet paid, a refund we owe you, a card dispute, or a payment our support team is still sorting out; signing in then shows what it is waiting for. An unpaid bill must be paid, or cancelled or written off by support, before the data can be erased. The owner can also erase one colleague from the team page, at once.
An account Syphoon closed is not erased on a timer: it is kept until you ask. Its owner can sign in to ask for the erasure (the same 30-day grace period then runs) or to download a copy of the data first, or write to support at TODO legal: the support e-mail address. An account is never erased just for being unused.
To correct the account's e-mail address, company name or username, write to support; a Syphoon operator makes the correction. A change of e-mail address is confirmed to both the old and the new address.
TODO legal: the right to restriction and objection, how to reach the supervisory authority, and the contact for requests that the account page does not cover.
the abuse record
When Syphoon has closed an account for abuse — such as abusive scraping, payment fraud, an unpaid debt, a chargeback or a breach of the terms — and that account is later erased, one record survives: a one-way code made from the owner's e-mail address (the address itself cannot be read back from it), the reason for the closure, and the dates it was closed and erased. It is deleted 3 years after the erasure. A new signup whose address gives the same code is accepted but held for review by a person before it can be used. If your signup is held and you think that is wrong, write to support at TODO legal: the support e-mail address.
TODO legal: the lawful basis (the platform's legitimate interest in not serving the same abuser again) and its balancing test.
rules applied automatically
These rules are applied by the platform itself, without a person deciding each case:
- Sign-ups from throwaway (disposable) e-mail domains are refused.
- Only a limited number of free signup balances are given to accounts signed up from one IP address in one day; an account past the limit works normally but gets no free balance.
- On an account that pays by card, a plan whose renewal or bill is not paid stops automatically when its grace period ends; paying restores it. An account that pays by hand is never stopped automatically: support follows up an overdue bill.
- When fetching a website through one route becomes too expensive, an automatic cost watch moves that website to another route. It concerns how a website is fetched, never your account.
- A new signup whose e-mail address matches the abuse record of an account Syphoon closed is held for review by a person before it can be used.
To contest any of them, write to support at TODO legal: the support e-mail address; a person looks at your case.
cookies
- This portal sets one cookie, syphoon_session: it keeps you signed in, holds nothing but a sign-in token, cannot be read by any script on the page, and is strictly necessary — the portal cannot work without it. It is deleted when you sign out and expires after fourteen days without use.
- The colour theme you pick and the retry key of a payment in progress are kept in your browser's own storage, not in a cookie.
- There are no analytics, advertising or tracking cookies.
- TODO legal: the card screens load Stripe.js and the sign-up, sign-in and password-reset forms load Cloudflare Turnstile; each may set cookies of its own for fraud and bot prevention, described in that processor's own notice.