Legal

Privacy Policy

Effective May 1, 2026 Jurisdiction: Italy / EU GDPR

This policy explains what data Scrapomatic collects, why, how long it’s kept and what you can do about it. It is written to satisfy the EU General Data Protection Regulation (GDPR). Scrapomatic is operated from Italy.

1. What we collect

Scrapomatic collects only what it needs to run the service:

  • Your Telegram user ID and username — to identify you as the account holder when you talk to the bot.
  • Channel IDs and titles for channels you connect to Scrapomatic.
  • Source configurations you create (subreddit names, X handles, RSS URLs, filters, schedules, templates).
  • Encrypted AI provider API keys if you opt into BYOK AI rewriting. Keys are encrypted at rest with AES-256 and only decrypted in memory at the moment of an outgoing API call to the provider.
  • Post content — the scraped items queued for publishing, kept while in the queue and for a short window after publishing for dedupe and analytics.
  • Operational logs (bot commands, errors, rate-limit hits) — retained for up to 30 days for debugging.

We do not collect your name, email address (other than what you voluntarily send to support), payment details (handled by our payment providers), physical address, IP address beyond what Telegram routes to the bot for rate-limiting, or any biometric or special-category personal data.

2. Why we collect it (legal basis)

  • Performance of a contract (GDPR Art. 6(1)(b)): to run the service you signed up for — Telegram user ID, channel IDs, source configurations, post content.
  • Legitimate interests (GDPR Art. 6(1)(f)): operational logs for security and debugging.
  • Consent (GDPR Art. 6(1)(a)): storage of your AI provider keys — opt-in via the bot, revocable at any time.

3. How long we keep it

  • Account & configurations: for the lifetime of your account.
  • Post content in the publishing queue: until publishing or removal; published items are kept 30 days for dedupe.
  • Operational logs: 30 days, then deleted.
  • After cancellation: all of the above is deleted 30 days post-cancellation (a backup-recovery window). Encrypted AI keys are zeroed immediately on cancellation.

4. Who we share data with

Scrapomatic uses a small number of processors and third parties, each one for a specific purpose:

  • Telegram — the bot runs on Telegram; messages, channel posts and bot commands necessarily pass through Telegram’s infrastructure. See Telegram’s Privacy Policy.
  • Payment providers — when you pay for a subscription, payment data is handled by our payment provider(s). Card payments are processed by an EU-based payment processor; crypto payments are non-custodial and do not involve a third-party processor.
  • Your chosen AI provider (Gemini, OpenAI, Anthropic) — when you enable AI rewriting, Scrapomatic sends your post content to the provider used (either ours for Pro users, or your own in BYOK mode). The provider’s privacy policy governs how they handle that content.
  • Hosting provider — the server runs in an EU-based data centre.

We do not sell personal data. We do not share data with advertising networks. We do not use third-party analytics on the marketing site beyond aggregate, cookieless server logs.

5. Your rights

Under GDPR you have the right to:

  • Access your data — type /export to the bot for a JSON export, or email us.
  • Rectify inaccurate data — most of it you can edit directly inside the bot.
  • Delete your data — type /delete in the bot, or email us. Takes effect immediately; backups purged within 30 days.
  • Portability — the /export export is a machine-readable JSON file you can take with you.
  • Object to processing based on legitimate interests.
  • Lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).

6. Security

Data is stored in encrypted databases. AI provider keys are encrypted with AES-256 at rest. Transport is TLS only. Access to production systems is restricted via SSH keys with hardware-backed second factor.

7. Children

Scrapomatic is not directed at people under 16. We do not knowingly collect data from anyone under 16. If you believe a child has registered, email support@scrapomatic.app and the account will be deleted.

8. Changes to this policy

Material changes will be announced inside the bot at least 14 days before they take effect. The effective date at the top of this page is updated accordingly.

9. Contact

Email: support@scrapomatic.app
Telegram: @ScrapomaticBot