Privacy Policy

1. Controller

The controller is the operator named on our Imprint page. Data protection enquiries: support@webtoapi.net.

2. What we collect

• Your email address — to identify your account and send you API keys and expiry notices. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• The URLs and CSS selectors you save — this is the API definition itself. Legal basis: performance of a contract.
• Usage logs — call counts, timestamps, render mode and error messages per API, kept to operate rate limits and diagnose failures. Legal basis: legitimate interest (Art. 6(1)(f)).
• Payment status — PayPal subscription id and plan state. We never see or store your card or bank details; PayPal is the payment processor. Legal basis: performance of a contract.
• The interface language you choose. Legal basis: legitimate interest.

3. What we do not collect

The extension does not read pages you have not explicitly granted it access to, does not track your browsing history, and does not send page content anywhere except the values matching the selectors you chose. We use no advertising trackers at all. We use Google Analytics on webtoapi.net, but only after you have agreed to it — see section 8.

4. Content read from third-party pages

When your API runs, our servers fetch the source page and extract only the elements your selectors match. The extracted values are cached for up to 60 seconds so repeated calls do not hammer the source site. We do not retain full page copies.

If you point an API at a page containing other people's personal data, you are the controller for that data and must have your own legal basis.

5. Where data is stored

On Google Cloud Platform (Firebase Authentication, Firestore, Cloud Functions, Cloud Run) in the us-central1 region, United States. Transfers outside the EEA rely on the EU Standard Contractual Clauses in Google's data processing terms. Transactional email is delivered through our email provider, which receives your address and the message content.

6. How long we keep it

• API definitions: until you delete them, or 30 days after expiry.
• Usage counters: 90 days.
• Account record: until you ask us to delete it.
• Email delivery records: as required by our provider, typically 30 days.

7. Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interest. Write to support@webtoapi.net; we answer within one month. You may also lodge a complaint with a supervisory authority in your country.

To delete your account and all APIs, send us a request from the address the account uses.

8. Cookies and local storage

We set no advertising cookies. Firebase Authentication stores a session token in your browser so you stay signed in, and we keep your theme and language choice in local storage. All of these are strictly necessary for the service to work and therefore need no consent.

Separately, we use Google Analytics (measurement ID G-G3C8396R8N) to understand which pages are useful. It is not strictly necessary, so we ask first: nothing from Google is loaded until you press “Allow analytics” on the banner. If you decline, no Google script runs and nothing is stored. Your choice is kept in local storage under “wta-analytics-consent” and you can change it at any time through the “Analytics settings” link in the footer. Google Analytics processes your truncated IP address, device and browser information and the pages you visit; Google Ireland Limited acts as our processor and data may be transferred to the United States under the EU Standard Contractual Clauses. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG), which you may withdraw at any time with effect for the future.

9. Changes

We will publish any change here and, for material changes, notify you by email.