This Privacy Policy explains how Fetcha (“we”, “us”), operated from the Province of Québec, Canada, collects, uses, discloses and protects personal information when you visit fetcha.co, create an account, use the dashboard or call the API (together, the “Services”). It is written to meet Québec’s Act respecting the protection of personal information in the private sector (Law 25), Canada’s PIPEDA, and, for customers and end users in the European Economic Area, the United Kingdom and Switzerland, the GDPR and UK GDPR.
Two kinds of data flow through Fetcha, and we treat them differently. Account data is information about you and your organisation; for it, Fetcha is the controller (in Québec terms, the enterprise responsible). Transiting content is the web content you instruct us to retrieve on your behalf; for it, you are the controller and Fetcha acts as a processor under the Data Processing Addendum. This policy focuses on account data and on the metadata we keep about requests.
Our person in charge of the protection of personal information can be reached at privacy@fetcha.co.
), }, { id: "data-we-collect", title: "Information we collect", body: ( <>When you sign up we collect your name, email address, a hashed password, the organisation and project names you choose, plan and billing status, and your acceptance of our legal documents (document version, timestamp, IP address). If you contact support we keep the correspondence.
We log sign-ins and security-relevant actions (key creation, rotation, revocation, settings changes) with timestamp, IP address and user agent. We record how you use the dashboard at the level of pages and actions, not keystrokes.
For every API call we store a request record: request id, project, API key id, source (API, SDK or playground), the requested URL and final URL, the target domain, HTTP method, requested and resolved network class, target country/region/city, session id, format, outcome and HTTP status, error code, number of attempts, latency, byte counts, billed price, the client IP and user agent that made the call, and timing data. Sensitive headers such as Authorization and Cookie are redacted before storage. Custom headers and request bodies you send are not logged unless you enable debug mode on a request, in which case attempt-level diagnostics are kept for the same retention period.
We do not retain the response bodies we retrieve for you by default. Content is streamed back to you and discarded from memory once the response completes. Transient copies may exist for seconds in processing buffers and, where you use the Playground, in your browser.
We do not collect payment card numbers (checkout is not yet live; when it launches, cards will be handled directly by a payment processor). We do not use advertising trackers or third-party analytics cookies on the marketing site or dashboard.
), }, { id: "how-we-use", title: "How we use information", body: ( <>Legal bases under the GDPR, where it applies: performance of a contract (providing the Services), legitimate interests (security, abuse prevention, improving the Services), consent (marketing), and legal obligation (tax and accounting). We do not sell personal information and we do not use it for automated decisions that produce legal or similarly significant effects on you.
), }, { id: "retention", title: "Retention", body: ( <>We keep request logs for the retention period of your plan, then delete them automatically:
| Plan | Request log retention |
|---|---|
| Free | 3 days |
| Developer | 7 days |
| Growth | 30 days |
| Business | 90 days |
| Enterprise | Configurable by agreement |
Aggregated usage counters (monthly requests and bandwidth per project) are kept for the life of the account plus the period needed for invoicing and tax records (up to 7 years, as required by Canadian law). Security and audit logs are kept for 12 months. Account data is kept while your account is active and deleted within 30 days after account deletion, subject to the 7-day grace period below and to legal holds. Backups are encrypted and rotate out within 35 days.
), }, { id: "sharing", title: "Disclosure and processors", body: ( <>We share personal information only with service providers that process it on our instructions under written contracts, and only as needed to run the Services:
We may also disclose information when required by law, court order or lawful request from a public authority, to protect the rights, safety or property of Fetcha, our customers or the public, to enforce our terms, or in connection with a merger, acquisition or sale of assets, in which case this policy continues to apply to the transferred data. We will tell you about legal requests concerning your account unless prohibited.
), }, { id: "transfers", title: "International transfers", body: ( <>Account data and request logs are stored in Canada. Canada is recognised by the European Commission as providing adequate protection for personal data transferred from the EEA under PIPEDA. Some processors (for example email delivery) may process data in the United States; those transfers are covered by contractual safeguards, including standard contractual clauses where required.
By design, transiting content leaves and enters the geography you specify in each request: if you request an exit in Germany, the target website is contacted from Germany. Before communicating personal information outside Québec we carry out the privacy impact assessment required by Law 25.
), }, { id: "your-rights", title: "Your rights and choices", body: ( <>Depending on where you live, you have rights to access the personal information we hold about you, to correct it, to export it in a structured, commonly used format, to delete it, to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority (in Québec, the Commission d’accès à l’information; in Canada, the Office of the Privacy Commissioner; in the EU, your national data-protection authority).
Most of these actions are self-serve in the dashboard: edit your profile and organisation, export request logs, revoke sessions and keys, and delete your account. When you delete your account, API access stops immediately and we hold your data for a grace period of 7 days, during which you can contact us to cancel the deletion; after that, data is deleted as described in Retention. For other requests, email privacy@fetcha.co from the address on your account. We respond within 30 days, and we may ask for information needed to verify your identity.
If you are an end user of a website that a Fetcha customer accessed, we typically hold no information that identifies you; please direct requests to the customer, who is the controller. We will assist customers with such requests under the DPA.
), }, { id: "cookies", title: "Cookies", body: ( <>We use only cookies that are strictly necessary to operate the Services:
fetcha* session cookies, set when you sign in, to keep you authenticated and protect against cross-site request forgery. They are HttpOnly, Secure, and expire when your session ends or after a period of inactivity.We do not set advertising, analytics or cross-site tracking cookies. Because these cookies are essential, no consent banner is shown; you can block them in your browser, but the dashboard will not work without the session cookie. See the Cookie Policy for details.
), }, { id: "security", title: "Security", body: ( <>We protect personal information with measures appropriate to its sensitivity: TLS for all connections, encryption of data at rest, hashed passwords and API keys (we store only a hash and the last characters of a key), role-based access limited to personnel who need it, audit logging of administrative actions, network segmentation between the API, routing engine and databases, and secure development practices including dependency monitoring. Request logs redact sensitive headers before they are written.
No system is perfectly secure. If we learn of a breach of security safeguards that presents a risk of serious harm, we will notify affected customers and the relevant authorities without undue delay, and in any event within the timeframes required by law (72 hours for customers under the DPA).
), }, { id: "children", title: "Children", body:The Services are intended for businesses and adult developers. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact privacy@fetcha.co and we will delete it.
, }, { id: "changes", title: "Changes to this policy", body: ( <>We may update this policy as the Services evolve or the law changes. The version and effective date appear at the top of this page. For material changes we will notify account owners by email at least 30 days before they take effect. Continued use of the Services after that date means you accept the updated policy.
Questions or concerns: privacy@fetcha.co. Postal correspondence can be requested at that address.
), }, ]; export default function PrivacyPage() { return