Privacy Policy

How krawlup collects, uses, shares, and protects information for accounts, products, plans and payments, site insights, digest emails, and platform security.

Who we are

krawlup is an agent-native growth and revenue-first analytics platform for founders. Contact us at nowshad@krawlup.com for privacy requests or questions.

Information we collect

• Account data such as your name, email address, avatar, OAuth provider profile data, and session records.
• Product data such as product name, tagline, description, URL, categories, pricing, media, social links, and analytics settings.
• Payment metadata including checkout identifiers, payment status, amount, and timestamps. We do not store full card numbers.
• Subscription data for plan subscribers: the billing provider's subscription and customer identifiers, your plan's name, price and limits (stored as a snapshot on your subscription record), subscription status, and current billing period dates.
• Site insights data: automated scan results for websites — performance metrics, security check results (including the Google Safe Browsing verdict), AI-readiness audit findings — plus scan timestamps and counters for manual re-check usage.
• Email preferences data such as subscription type, notification choices, unsubscribe status, and delivery metadata.
• Technical data such as IP-derived request context, browser/device information, upload metadata, rate-limit counters, and security diagnostics.

How we use information

• To create accounts, authenticate users, and keep sessions secure.
• To accept, enrich, schedule, publish, and moderate products. Public directory listings remain subject to platform moderation.
• To review and approve ad slot bookings before they go live.
• To process subscription plan payments, confirm orders, handle refunds, and keep payment records.
• To send transactional emails, product digests, and admin alerts.
• To run scheduled and on-demand site scans, generate AI fix suggestions, and keep insights current.
• To operate uploads, AI prefill, duplicate detection, badge checks, search, analytics, spam prevention, and platform security.

Public content

Submitted products, product pages, logos, screenshots, websites, categories, and similar content may become public once a founder publishes them to the directory. Do not submit confidential information or content you are not authorized to share.

Payments and subscriptions

Payments are processed by Polar (merchant of record). They handle card and payment method details under their own privacy and security practices. We store only the transaction and subscription metadata needed to confirm payment, apply your plan, provide support, prevent duplicate charges, handle refunds, and maintain business records.

Cookies and local storage

We use a small number of browser storage mechanisms to run the service: a pseudonymous visitor cookie (dob_cid) that counts aggregate visits and clicks for launch analytics without identifying you or tracking you across other websites, and a session token kept in your browser's local storage to keep you signed in (it is sent only to krawlup's own API). We do not run third-party advertising or cross-site tracking cookies.

Analytics on founder websites. Founders who install the krawlup analytics tag on their own websites (directly or through their AI agent) run a fully cookieless tracker: it sets NO cookies on their site and shows no consent bar, because none is needed — there is no persistent identifier. It keeps only a per-tab sessionStorage session id (_klp_sid, a random value with a 30-minute sliding timestamp) that dies when the tab closes, and it honors browser Do-Not-Track by not sending anything at all. We never store raw IP addresses: visitor identities are HMAC hashes salted per site and rotated monthly, so they cannot be tracked across sites or over time. Raw events age out of our database after 90 days and precomputed daily aggregates after 730 days, and the data belongs to the site's owner — we do not sell it or use it for ads.

Free report tool emails

If you leave your email address at the free site-report tool (for example when you hit the monthly scan limit), we store it with your consent to send you your report link and the account signup that keeps it — one email, plus an unsubscribe link in every message that deletes the address when used. We never add these addresses to account or marketing lists without an account, and we do not share them with third parties.

Service providers

We use service providers to run the platform — hosting on a virtual private server, Cloudflare for DNS, MongoDB Atlas for the database, Polar for payment processing, Google's PageSpeed and Chrome UX Report APIs for performance data, a headless-browser provider (Browserless) for page rendering, Open PageRank for domain authority data, an AI provider (Z.ai) for automated product analysis and fix suggestions, and an email delivery provider for transactional and digest email. These providers process information only as needed to provide their services to us. We do not sell personal information.

Email choices

Your account starts with product emails switched on — launch notifications for your products and a weekly performance digest. You can turn any of these off in your dashboard settings, and every digest or marketing email includes an unsubscribe link. Transactional emails about your account, submission, payment, or security may still be sent when needed to operate the service.

Retention

We keep information for as long as needed to provide the service, maintain public product pages, process payments, resolve disputes, enforce terms, prevent abuse, and comply with legal obligations.

Agent connections. When a founder connects an AI agent (MCP or OAuth), the connection record keeps the connecting IP address and user agent for your own security visibility on the dashboard's Connections tab. Those two fields are removed automatically 30 days after the connection was created (or after you revoke it) — the connection's timestamps survive, the addresses never do. No recall of your site's analytics is affected (that data has no IP addresses at all — see above).

Your rights

You can request access, correction, deletion, or export of personal information by contacting nowshad@krawlup.com. We may need to verify your identity and may retain records where required for legal, security, payment, or abuse-prevention reasons.

Children

krawlup is not directed at children under 16. We do not knowingly collect personal information from children under 16.

Changes

We may update this policy as the platform changes. The updated version will be posted on this page with a new effective date.