TypeScript 97.5%
SQL 1.4%
Python 0.8%
1import type { Metadata } from "next";2import Link from "next/link";3import { LegalLayout, type LegalSection } from "@/components/marketing/legal-layout";45export const metadata: Metadata = {6 title: "Privacy Policy",7 description: "How Fetcha collects, uses, retains and protects personal information for account holders and for content transiting the web access API.",8 alternates: { canonical: "/legal/privacy" },9};1011const sections: LegalSection[] = [12 {13 id: "scope",14 title: "Scope and who we are",15 body: (16 <>17 <p>18 This Privacy Policy explains how Fetcha (<strong>“we”</strong>, <strong>“us”</strong>), operated from the Province of Québec, Canada, collects, uses, discloses and protects personal information when you visit <code>fetcha.co</code>, create an account, use the dashboard or call the API (together, the <strong>“Services”</strong>). It is written to meet Québec’s Act respecting the protection of personal information in the private sector (Law 25), Canada’s PIPEDA, and, for customers and end users in the European Economic Area, the United Kingdom and Switzerland, the GDPR and UK GDPR.19 </p>20 <p>21 Two kinds of data flow through Fetcha, and we treat them differently. <strong>Account data</strong> is information about you and your organisation; for it, Fetcha is the controller (in Québec terms, the enterprise responsible). <strong>Transiting content</strong> is the web content you instruct us to retrieve on your behalf; for it, you are the controller and Fetcha acts as a processor under the <Link href="/legal/dpa">Data Processing Addendum</Link>. This policy focuses on account data and on the metadata we keep about requests.22 </p>23 <p>24 Our person in charge of the protection of personal information can be reached at <a href="mailto:privacy@fetcha.co">privacy@fetcha.co</a>.25 </p>26 </>27 ),28 },29 {30 id: "data-we-collect",31 title: "Information we collect",32 body: (33 <>34 <h3>Account and organisation data</h3>35 <p>When you sign up we collect your name, email address, a hashed password, the organisation and project names you choose, plan and billing status, and your acceptance of our legal documents (document version, timestamp, IP address). If you contact support we keep the correspondence.</p>36 <h3>Usage and security metadata</h3>37 <p>We log sign-ins and security-relevant actions (key creation, rotation, revocation, settings changes) with timestamp, IP address and user agent. We record how you use the dashboard at the level of pages and actions, not keystrokes.</p>38 <h3>Request logs (metadata only)</h3>39 <p>40 For every API call we store a request record: request id, project, API key id, source (API, SDK or playground), the requested URL and final URL, the target domain, HTTP method, requested and resolved network class, target country/region/city, session id, format, outcome and HTTP status, error code, number of attempts, latency, byte counts, billed price, the client IP and user agent that made the call, and timing data. <strong>Sensitive headers such as <code>Authorization</code> and <code>Cookie</code> are redacted before storage.</strong> Custom headers and request bodies you send are not logged unless you enable debug mode on a request, in which case attempt-level diagnostics are kept for the same retention period.41 </p>42 <h3>Target content</h3>43 <p><strong>We do not retain the response bodies we retrieve for you by default.</strong> Content is streamed back to you and discarded from memory once the response completes. Transient copies may exist for seconds in processing buffers and, where you use the Playground, in your browser.</p>44 <h3>Information we do not collect</h3>45 <p>We do not collect payment card numbers (checkout is not yet live; when it launches, cards will be handled directly by a payment processor). We do not use advertising trackers or third-party analytics cookies on the marketing site or dashboard.</p>46 </>47 ),48 },49 {50 id: "how-we-use",51 title: "How we use information",52 body: (53 <>54 <ul>55 <li><strong>To provide the Services</strong>: authenticate you, route and execute requests, enforce plan limits, show you logs and usage, and support you.</li>56 <li><strong>To bill</strong>: meter requests and bandwidth, produce invoices and usage summaries.</li>57 <li><strong>To secure and protect</strong>: detect credential compromise, abuse, fraud and violations of the <Link href="/legal/acceptable-use">Acceptable Use Policy</Link>; apply rate limits and circuit breakers; investigate incidents.</li>58 <li><strong>To improve routing</strong>: compute per-domain and per-network success, latency and cost statistics. These statistics are aggregated and are not tied to individual end users of the websites you access.</li>59 <li><strong>To communicate</strong>: send transactional emails (verification, security alerts, invoices, incident notices, changes to legal documents). We send product news only with your consent and you can opt out at any time.</li>60 <li><strong>To comply with law</strong> and to establish or defend legal claims.</li>61 </ul>62 <p>Legal bases under the GDPR, where it applies: performance of a contract (providing the Services), legitimate interests (security, abuse prevention, improving the Services), consent (marketing), and legal obligation (tax and accounting). We do not sell personal information and we do not use it for automated decisions that produce legal or similarly significant effects on you.</p>63 </>64 ),65 },66 {67 id: "retention",68 title: "Retention",69 body: (70 <>71 <p>We keep request logs for the retention period of your plan, then delete them automatically:</p>72 <table>73 <thead>74 <tr>75 <th>Plan</th>76 <th>Request log retention</th>77 </tr>78 </thead>79 <tbody>80 <tr><td>Free</td><td>3 days</td></tr>81 <tr><td>Developer</td><td>7 days</td></tr>82 <tr><td>Growth</td><td>30 days</td></tr>83 <tr><td>Business</td><td>90 days</td></tr>84 <tr><td>Enterprise</td><td>Configurable by agreement</td></tr>85 </tbody>86 </table>87 <p>Aggregated usage counters (monthly requests and bandwidth per project) are kept for the life of the account plus the period needed for invoicing and tax records (up to 7 years, as required by Canadian law). Security and audit logs are kept for 12 months. Account data is kept while your account is active and deleted within 30 days after account deletion, subject to the 7-day grace period below and to legal holds. Backups are encrypted and rotate out within 35 days.</p>88 </>89 ),90 },91 {92 id: "sharing",93 title: "Disclosure and processors",94 body: (95 <>96 <p>We share personal information only with service providers that process it on our instructions under written contracts, and only as needed to run the Services:</p>97 <ul>98 <li><strong>Hosting and infrastructure</strong>: servers, databases and object storage that run the API and dashboard, located in Canada.</li>99 <li><strong>Email delivery</strong>: a transactional email provider that sends verification, security and billing messages to your address.</li>100 <li><strong>Upstream network partners</strong>: the proxy networks through which requests exit. They see the target URL, the exit geography and the request traffic itself, but they do not receive your account identity, API key or Fetcha request id. We do not name partners publicly; a current list is available to Enterprise customers under NDA and on request at <a href="mailto:privacy@fetcha.co">privacy@fetcha.co</a>.</li>101 <li><strong>Payments</strong> (when checkout launches): a payment processor that handles card data directly; we receive only tokens and billing status.</li>102 </ul>103 <p>We may also disclose information when required by law, court order or lawful request from a public authority, to protect the rights, safety or property of Fetcha, our customers or the public, to enforce our terms, or in connection with a merger, acquisition or sale of assets, in which case this policy continues to apply to the transferred data. We will tell you about legal requests concerning your account unless prohibited.</p>104 </>105 ),106 },107 {108 id: "transfers",109 title: "International transfers",110 body: (111 <>112 <p>Account data and request logs are stored in Canada. Canada is recognised by the European Commission as providing adequate protection for personal data transferred from the EEA under PIPEDA. Some processors (for example email delivery) may process data in the United States; those transfers are covered by contractual safeguards, including standard contractual clauses where required.</p>113 <p>By design, transiting content leaves and enters the geography you specify in each request: if you request an exit in Germany, the target website is contacted from Germany. Before communicating personal information outside Québec we carry out the privacy impact assessment required by Law 25.</p>114 </>115 ),116 },117 {118 id: "your-rights",119 title: "Your rights and choices",120 body: (121 <>122 <p>Depending on where you live, you have rights to <strong>access</strong> the personal information we hold about you, to <strong>correct</strong> it, to <strong>export</strong> it in a structured, commonly used format, to <strong>delete</strong> it, to <strong>object</strong> to or <strong>restrict</strong> certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority (in Québec, the Commission d’accès à l’information; in Canada, the Office of the Privacy Commissioner; in the EU, your national data-protection authority).</p>123 <p>Most of these actions are self-serve in the dashboard: edit your profile and organisation, export request logs, revoke sessions and keys, and delete your account. <strong>When you delete your account, API access stops immediately and we hold your data for a grace period of 7 days</strong>, during which you can contact us to cancel the deletion; after that, data is deleted as described in Retention. For other requests, email <a href="mailto:privacy@fetcha.co">privacy@fetcha.co</a> from the address on your account. We respond within 30 days, and we may ask for information needed to verify your identity.</p>124 <p>If you are an end user of a website that a Fetcha customer accessed, we typically hold no information that identifies you; please direct requests to the customer, who is the controller. We will assist customers with such requests under the DPA.</p>125 </>126 ),127 },128 {129 id: "cookies",130 title: "Cookies",131 body: (132 <>133 <p>We use only cookies that are strictly necessary to operate the Services:</p>134 <ul>135 <li><code>fetcha*</code> session cookies, set when you sign in, to keep you authenticated and protect against cross-site request forgery. They are <code>HttpOnly</code>, <code>Secure</code>, and expire when your session ends or after a period of inactivity.</li>136 <li>A <strong>theme</strong> cookie or local-storage key that remembers your light/dark preference.</li>137 <li>A <strong>project</strong> cookie that remembers which project you last selected in the dashboard.</li>138 </ul>139 <p>We do not set advertising, analytics or cross-site tracking cookies. Because these cookies are essential, no consent banner is shown; you can block them in your browser, but the dashboard will not work without the session cookie. See the <Link href="/legal/cookies">Cookie Policy</Link> for details.</p>140 </>141 ),142 },143 {144 id: "security",145 title: "Security",146 body: (147 <>148 <p>We protect personal information with measures appropriate to its sensitivity: TLS for all connections, encryption of data at rest, hashed passwords and API keys (we store only a hash and the last characters of a key), role-based access limited to personnel who need it, audit logging of administrative actions, network segmentation between the API, routing engine and databases, and secure development practices including dependency monitoring. Request logs redact sensitive headers before they are written.</p>149 <p>No system is perfectly secure. If we learn of a breach of security safeguards that presents a risk of serious harm, we will notify affected customers and the relevant authorities without undue delay, and in any event within the timeframes required by law (72 hours for customers under the DPA).</p>150 </>151 ),152 },153 {154 id: "children",155 title: "Children",156 body: <p>The Services are intended for businesses and adult developers. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact <a href="mailto:privacy@fetcha.co">privacy@fetcha.co</a> and we will delete it.</p>,157 },158 {159 id: "changes",160 title: "Changes to this policy",161 body: (162 <>163 <p>We may update this policy as the Services evolve or the law changes. The version and effective date appear at the top of this page. For material changes we will notify account owners by email at least 30 days before they take effect. Continued use of the Services after that date means you accept the updated policy.</p>164 <p>Questions or concerns: <a href="mailto:privacy@fetcha.co">privacy@fetcha.co</a>. Postal correspondence can be requested at that address.</p>165 </>166 ),167 },168];169170export default function PrivacyPage() {171 return <LegalLayout title="Privacy Policy" current="/legal/privacy" summary="What we collect about you and about the requests you send, how long we keep it, who processes it, and how you exercise your rights. Target content is not retained by default; request metadata is kept 3 to 90 days depending on your plan, with sensitive headers redacted." sections={sections} />;172}173