Privacy policy

WORDPRESS CODE SRL, a societate cu răspundere limitată, VAT RO41034515, registered under J40/5716/2019 (ROONRC.J40/5716/2019), with its registered office at Str. Grigore Cobălcescu nr. 3, corp C2, Sector 1, București 010191, România, operates CrawlPanel and is the controller for account, website, billing, security and support data.

CrawlPanel has not appointed a data protection officer because it is not currently required to do so. Privacy requests can be sent directly to hello@crawlpanel.com.

Account and workspace data includes your name, email address, password hash or social-login identifier, profile image, security settings, sessions, IP address, user agent, workspace membership and invitations. We never receive your social-login password.

Service data includes projects, monitor configuration, URLs, schedules, secrets in encrypted form, run and response metadata, incidents, screenshots, traces, console and network evidence, reports, notification settings and audit records. Evidence may contain personal data visible in a customer-configured journey.

Commercial and support data includes plan and subscription status, Stripe customer and transaction references, invoice information, contact-form messages, program applications, support correspondence and delivery logs. A program application may include agency name, website, approximate client-site range, managed platforms, service stage, critical-flow interests and optional notes. Stripe—not CrawlPanel—collects complete payment-card details.

We process account, workspace, monitoring, alerting, support, program-application and billing data to perform the contract or pre-contract steps you request. We review optional pilot or founding-program applications for fit and communicate the outcome for our legitimate interests in operating and improving a focused professional service. We process security, abuse-prevention, service reliability and limited product-improvement data for our legitimate interests in operating a safe and effective service.

We process invoices, transaction evidence and information required by Romanian accounting or tax law to comply with legal obligations. We use optional GA4 analytics only with your consent. You may withdraw that consent without affecting earlier lawful processing.

If you choose Google or GitHub sign-in when enabled, that provider supplies the name, email address, profile image and provider-specific account identifier you authorize. We use them only to create, link, secure and display your CrawlPanel account.

CrawlPanel requests only the basic identity information needed for sign-in. It does not request access to Google Drive, Gmail, private GitHub repositories or unrelated account content. You can revoke access with the provider and may delete your CrawlPanel account independently.

For personal data that a customer places in monitor configuration, browser journeys or evidence, the customer normally determines the purpose and means and acts as controller; CrawlPanel acts as processor under the Data Processing Addendum.

Customers must monitor only authorized targets, use synthetic accounts and data where practical, minimize captured personal data and configure available secret and evidence protections.

We disclose data only as needed to operate the service, meet legal obligations or protect rights. Current core providers include DigitalOcean (FRA1, Frankfurt, Germany) for infrastructure, Simplenet for transactional email, Stripe for billing, Google for consent-based public-site analytics and optional sign-in, and GitHub for optional sign-in.

When a workspace owner connects Slack, Microsoft Teams, Discord, Telegram, PagerDuty, an additional email recipient or a generic webhook, CrawlPanel transmits the alert fields selected by the configured route to that customer-directed destination. The destination provider and workspace are chosen and controlled by the customer. Alert messages may include project, monitor, severity and failure context plus a protected CrawlPanel link; browser screenshots and traces are not attached automatically.

Providers receive only the categories needed for their function and act under their own terms and applicable data-protection commitments. We may disclose information to public authorities where legally required and to professional advisers bound by confidentiality.

Some providers may process data outside Romania or the European Economic Area. Where an adequacy decision does not apply, we rely on an appropriate safeguard such as the European Commission Standard Contractual Clauses and assess supplementary measures where required.

More detail about customer-data subprocessors and safeguards appears in the Data Processing Addendum.

Monitor history and evidence follow the active plan: Free 30 days, Solo 90 days, Team 365 days and Business 730 days for history; evidence has the shorter plan-specific periods shown in the product. Enterprise retention is agreed in the order. Deleting a project or closing an account starts deletion from active systems, subject to legal holds and backup expiry.

Account and workspace data is kept while the account is active. Expired verification records and sessions are kept only for their operational lifetime. Contact, program-application and support correspondence is normally kept for up to 24 months after the last interaction; security and email-delivery logs are normally kept for up to 12 months unless an incident requires longer preservation.

Billing and accounting records are retained for the period required by Romanian law, which may be up to 10 years. A keyed anti-abuse hash that cannot be used to recover the email address may be retained after account deletion to prevent repeated trial abuse. Where production backups are maintained, deleted data remains isolated from ordinary use and expires through the documented backup cycle.

GA4 is used only on public marketing pages to understand visits and improve content. The Google tag is not requested and no analytics event is sent until you select “Accept all” in the cookie banner. Advertising storage, Google Signals and ad personalization remain disabled.

If allowed, GA4 may set first-party identifiers such as _ga and a property-specific _ga_* cookie and receive page URL, device/browser information, approximate location derived from IP and interaction metadata. Select “Cookie settings” in the footer to withdraw consent; CrawlPanel then stops future collection and removes accessible GA cookies on its domain.

We use access controls, encryption for stored secrets, transport encryption, tenant isolation, redaction, request-target protections, logging and controlled retention. No internet service is risk-free, so customers should avoid placing unnecessary sensitive data in monitored flows.

CrawlPanel does not make decisions producing legal or similarly significant effects about individuals using solely automated processing.

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time. We may need to verify identity and may retain information where a legal obligation or overriding lawful ground applies.

Send requests to hello@crawlpanel.com. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, at dataprotection.ro.

CrawlPanel is a professional monitoring service and is not directed to children. You must be at least 18 years old or have legal capacity and valid authorization to enter the agreement.

We may update this policy when the service or law changes. We will publish the new effective date and provide reasonable notice of material changes where required.

WORDPRESS CODE SRL, Str. Grigore Cobălcescu nr. 3, corp C2, Sector 1, București 010191, România. Privacy and legal email: hello@crawlpanel.com.