Privacy policy

1. Who operates CrawlPact

CrawlPact operates the CrawlPact service. For privacy questions, personal-data requests, or objections, contact info@crawlpact.com.

2. Information collected

CrawlPact distinguishes two kinds of information. Neither is "secret customer content" in the same sense — the first is information about your account and use of the service; the second is public information CrawlPact fetched from a website you asked it to audit.

Account and service data

• Your account (a display name, and either passkey credentials or a connected Google identity — never a password). If you sign in with Google, CrawlPact stores Google's stable account identifier and, if provided, your Google email address as connected-account metadata only; email is never required, and no other Google data (Gmail, Drive, contacts, etc.) is ever requested or received
• Billing metadata, limited to identifiers needed to link your account to a Paddle customer and subscription (never full payment-card details)
• Saved domains, groups, monitoring preferences, and notification history
• Support communications you send to CrawlPact
• Security and operational logs, including a salted hash of your IP address (never the raw address) used for rate-limiting and abuse detection
• First-party product-usage events (see below)

Public website audit data

• The public domain or URL you submit for audit
• Bounded, publicly accessible policy resources CrawlPact fetched (e.g. robots.txt, llms.txt, relevant HTTP headers) and their evidence snippets and timestamps
• The crawler registry version a scan was evaluated against

A domain or URL may sometimes identify a person or organisation — CrawlPact does not treat public audit data as automatically non-personal. CrawlPact does not store copies of entire websites, only the specific, bounded resources relevant to AI crawler policy.

3. How information is collected

Information reaches CrawlPact from:

• You directly, when you create an account, save a domain, or contact support
• Automatically through your use of the service (usage events, security logs)
• Public websites, during an audit you requested
• Paddle, for billing and subscription status
• Google Analytics, on public marketing pages only (see below)
• Microsoft Clarity, on the same public marketing pages and under the same consent choice (see below)

4. Purposes

CrawlPact uses information to:

• Run audits and save baselines
• Operate accounts and monitor saved domains for change
• Process subscriptions and provide billing support
• Provide product and account support
• Maintain security and detect misuse
• Improve reliability and measure product usage
• Maintain crawler-registry evidence and meet legal obligations

5. Public website audit data

• CrawlPact fetches publicly accessible website resources you ask it to audit.
• Audits may include public policy signals and response metadata.
• Results describe publicly published information at the time of the scan.
• CrawlPact does not require access to private website content for a standard audit.
• CrawlPact does not prove actual crawler compliance — see limitations.

6. Cookies and local storage

CrawlPact sets two first-party cookies:

• An essential, HttpOnly, Secure, SameSite=Lax session cookie used for authentication. It is required for the service to function and cannot be disabled while signed in.
• A non-essential crawlpact_analytics_consent cookie recording your accept/decline choice for Google Analytics and Microsoft Clarity on public marketing pages, and the policy version that choice applies to. It contains only that preference and a version number — never an identifier, email, or IP address. It is set for around six months and is not required to use CrawlPact.

CrawlPact's own code does not use local storage or session storage. Only after you accept analytics, and only on the public pages listed in the next section, Google Analyticssets its own cookies (_ga, _ga_*) and Microsoft Clarity sets its own cookies (_clck, _clsk) and a session-storage entry (_cltk) on crawlpact.com. When Microsoft Clarity loads, Microsoft may also set or read its own cookies on Microsoft domains (for example clarity.ms and bing.com). Those cookies are governed by Microsoft, not CrawlPact. None of this happens before you accept, or on the authenticated app or admin areas.

7. Analytics and your choice

Google Analytics and Microsoft Clarity are optional and off by default. One choice controls both, and neither loads until you explicitly accept. They load only on public marketing and content pages: the homepage, the audit start page, pricing, guides, the crawler directory, tools, and similar pages. They never load on the authenticated app, admin, sign-in, billing, private shared reports, a specific audit result, or legal pages such as this one, and never in local or preview environments. You can accept, decline, or change your choice at any time using the "Analytics preferences" control on those pages. Declining has no effect on your ability to use CrawlPact.

• Google Analytics measures page visits. The page address sent to it excludes query strings and any token.
• Microsoft Clarity records how visitors use a page (clicks, scrolling, mouse movement, and navigation). CrawlPact uses it to produce behavioural metrics, heatmaps, and session replays that help it improve its public content, tools, and website experience. It is not used for advertising, and it does not affect search-engine ranking. CrawlPact tellsMicrosoft Clarity that you have consented to analytics storage and that advertising storage is denied. Text typed into form fields and dropdown selections are always masked before anything is sent, and CrawlPact does not unmask passwords, sign-in or payment details, account data, or API keys. Microsoft processes this data as described in the Microsoft Privacy Statement.

No account, email, domain, or report identifier is ever sent to either provider, and CrawlPact does not use Microsoft Clarity's user-identification features. If you decline after accepting, CrawlPact tells both providers that consent is withdrawn, deletes their cookies on crawlpact.com, and reloads the page so that neither keeps running. Withdrawing consent does not delete data already sent before you withdrew it. Using these providers is a disclosed, deliberate deviation from a general no-external-analytics preference, made by CrawlPact's product owner. CrawlPact's own first-party product analytics (see the next section) remains the authoritative measure of how the product itself is used, independent of this choice.

Separately, CrawlPact records a small number of first-party product-usage events (e.g. that an audit started, or that monitoring was enabled) to understand and improve the product. These never include your full domain, full URL, email, IP address, or any authentication or report token — see CrawlPact's security page for more detail. This first-party analytics is not affected by your analytics preference above.

8. Billing and Paddle

Payments are processed by Paddle, which acts as the merchant of record for applicable transactions. Paddle processes your payment information directly — CrawlPact never receives or stores full payment-card details. CrawlPact does receive and retain billing-related metadata (a Paddle customer and subscription identifier, transaction status, and amounts) necessary for account entitlements, support, refunds, and accounting. Paddle operates under its own privacy and contractual terms.

9. Sharing and processors

CrawlPact shares information only with:

• Cloudflare — hosting, storage, and scheduled execution
• Paddle — billing and payment processing
• Google Analytics — public-page visit analytics
• Microsoft Clarity (Microsoft) — public-page behavioural analytics (session replays, heatmaps), only after you accept
• Legal authorities, where required by law

CrawlPact does not use any third-party email, SMS, push-notification, or AI API service. If you choose "Sign in with Google," Google acts as an identity provider for that one action: CrawlPact receives only the identity information needed to authenticate you (a stable account identifier, and optionally your name and email), never your Google password, and never requests or receives access to your Gmail, Drive, or any other Google data. Signing in with a passkey involves no external identity provider at all.

10. International processing

CrawlPact may be used from any country. Infrastructure and service providers listed above may process information outside your own country. CrawlPact does not currently maintain a published list of specific data-centre locations.

11. Data retention

Beyond this table, information is retained only as long as reasonably necessary for the purposes described above, subject to operational, security, billing, legal, and accounting requirements. Billing records required for accounting or legal purposes may be retained separately from the rest of an account's data after deletion — see "Account deletion" below.

12. Security

CrawlPact uses reasonable technical and organisational safeguards, including passkey and Google sign-in authentication, signature-verified billing webhooks, and an isolated scanner with SSRF protections — see security. No method of storage or transmission is completely secure, and CrawlPact does not claim absolute security.

13. Your choices and rights

Depending on your location, you may have rights relating to your personal information, such as access, correction, deletion, or objection. To exercise any of these, contact info@crawlpact.com. CrawlPact may need reasonable verification before fulfilling a sensitive request; this is a manual process, not an automated self-service workflow, and CrawlPact does not guarantee that a specific legal right applies to every user.

Account deletion

You can request account deletion at any time from account settings. This begins a cancellable 30-day grace period, during which the request can be reversed; your account remains otherwise usable during that window. After the grace period, private account data is purged. Billing records required for accounting or legal purposes (e.g. transaction and subscription history) are retained separately and are not deleted with the rest of the account, consistent with the retention table above.

Subscription cancellation

Paid subscriptions are cancelled through Paddle's customer portal, linked from your billing settings. CrawlPact does not independently process refunds; refund and chargeback decisions are Paddle's, and CrawlPact only records the outcome Paddle reports.

14. Children

CrawlPact is not directed at, or intended for use by, children. CrawlPact does not knowingly collect personal information from children and does not operate any age-verification functionality.

15. Third-party websites

Websites you audit with CrawlPact, and any external link from CrawlPact's own site, are governed by their own separate privacy practices, not this policy.

16. Policy changes

Material updates to this policy are reflected here with a new effective and last-updated date. CrawlPact does not currently send email notice of changes, since account registration does not collect an email address.

17. Contact

For privacy questions or requests, contact info@crawlpact.com. See also the contact page for other categories.