Privacy Policy

This Privacy Policy explains how ScrapeHammer (“ScrapeHammer,” “we,” “us,” or “our”) collects, uses, and shares information when you use our website, API, and related services (the “Services”). The Services let you retrieve publicly available data from social media platforms such as Facebook, Instagram, TikTok, and YouTube.

By using the Services, you agree to the practices described in this Policy. If you do not agree, you must not use the Services.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018, the data controller responsible for your account and personal data is:

• Company: Hammer Data Services OÜ
• Registered address: Harju maakond, Tallinn, Kesklinna linnaosa, Tartu mnt 67/1-13b, 10115
• Company registration number: 17582785
• Contact email: info@scrapehammer.com

If you have questions about your personal data, contact us at the email above.

a) Data we collect as a controller.

As a data controller, we collect and process the following categories of information that you provide to us or that we generate to operate your account:

• Account data: the name, email, username, and billing details you provide when you register and use your account.
• Usage data: API requests, run logs, job identifiers, and technical metadata such as timestamps, and request volumes, used to operate and secure the Services.

b) Data we do not collect.

• Payment data: payments are processed by our payment provider. We never receive or store full card numbers or other raw payment credentials on our servers; we keep only the transaction status and provider reference needed for billing.

c) Data we retrieve as a processor.

The publicly available social media data you request through the Services is retrieved on your instructions and forwarded to you as a data processor (see Section 5). It is not collected for our own purposes and is retained only as long as needed to deliver the run results to you.

ScrapeHammer exclusively retrieves data that is publicly available on the source platform.

The Services retrieve only data that is openly visible without authentication or special permissions. If a piece of data is not publicly available, ScrapeHammer will not retrieve it.

ScrapeHammer acts in two different roles depending on the type of data involved. This distinction is important and applies throughout this Policy.

a) Data controller — for data you provide to us.

We collect Personal Data that you provide directly to us, such as your name, email, username, and billing details when you register and use your account, together with usage data (API requests, run logs, job identifiers, and timestamps). For this data ScrapeHammer acts as a data controller: we determine the purposes and means of processing, namely to operate, secure, and improve the Services, to bill you, and to communicate with you. The categories of data we collect in this capacity are listed in Section 3 above.

b) Data processor — for data the Services retrieve.

When the Services retrieve publicly available social media data on your behalf, ScrapeHammer acts as a data processor on your instructions. You are the data controller for that retrieved data and are responsible for determining the purposes and means of its further use. We forward the retrieved data to you via the API or console and do not use it for our own purposes beyond operating, securing, and improving the Services. We retain run outputs only for the period necessary to deliver them to you, unless a longer retention is required by law.

The end use of the data you receive is your sole responsibility. You must ensure that your use of the data complies with:

• all applicable laws and regulations, including data protection laws such as the GDPR;
• the terms of service of the source platform;
• any rights of the individuals the data

You agree that you will not use the data to discriminate, harass, or otherwise harm individuals, and that you will not combine it with other data to re-identify individuals who have not consented. ScrapeHammer is not liable for how you use the data after you receive it.

We process your personal data under the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus), on the following legal bases:

• Contract: to provide and operate the Services you signed up for.
• Legitimate interests: to secure, monitor, and improve the Services.
• Legal obligation: to comply with applicable laws and lawful requests.
• Consent: for optional communications, which you can withdraw at any time.

We do not sell your personal data. We share it only:

• with service providers (e.g. hosting, payment processing) that help us operate the Services, under appropriate data protection terms;
• when required by law or to protect our rights, users, or the public;
• in connection with a merger, acquisition, or sale of assets, subject to confidentiality.

Retrieved social media data is shared only with you, the requesting user, through your account.

Your data, including retrieved results, may be processed in countries outside your residence. Where this involves a transfer outside the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses, or on a recognized adequacy decision.

We keep your account data for as long as your account is active. Run logs and metadata are retained for a limited period needed for billing, security, and support, then deleted or anonymized. Retrieved result data is kept only long enough to deliver it to you, unless a longer period is required by law.

We use industry-standard measures to protect your data, including encryption in transit, access controls, and regular monitoring. However, no system is perfectly secure, and we cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, delete, or restrict the processing of your personal data, to object to processing, to portability, and to withdraw consent. You also have the right to lodge a complaint with the competent supervisory authority. As the controller is established in Estonia, the competent authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Vabriku 12, 10146 Tallinn, Estonia). To exercise these rights, contact us at info@scrapehammer.com.

The Services are not intended for children under 16, and we do not knowingly collect personal data from them. If you believe we have collected data from a child, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date. Material changes will be communicated through the Services or by email where appropriate.

Questions about this Privacy Policy or your personal data? Contact us:

• Email: info@scrapehammer.com