legal

Privacy Policy

Scrapomatic privacy policy. GDPR-compliant. Italy-based. Third parties: payment providers and AI providers (user keys).

effective May 1, 2026·jurisdiction: Italy / EU GDPR

This policy explains what data Scrapomatic collects, why, how long it is kept and what you can do about it. It is written to satisfy the EU General Data Protection Regulation (GDPR). Scrapomatic is operated from Italy.

01What we collect

Scrapomatic collects only what it needs to run the service:

  • Your Telegram user ID and username — to identify you as the account holder when you talk to the bot.
  • Channel IDs and titles for channels you connect to Scrapomatic.
  • Source configurations you create (subreddit names, X handles, RSS URLs, filters, schedules, templates).
  • Encrypted AI provider API keys if you opt into BYOK AI rewriting. Keys are encrypted at rest with AES-256 and only decrypted in memory at the moment of an outgoing API call to the provider.
  • Post content — the aggregated items queued for publishing, kept while in the queue and for a short window after publishing for dedupe and analytics.
  • Operational logs (bot commands, errors, rate-limit hits) — retained for up to 30 days for debugging.

We do not collect your name, email address (other than what you voluntarily send to support), payment details (handled by our payment providers), physical address, IP address beyond what Telegram routes to the bot for rate-limiting, or any biometric or special-category personal data.

02Why we collect it (legal basis)

  • Performance of a contract (GDPR Art. 6(1)(b)): to run the service you signed up for — Telegram user ID, channel IDs, source configurations, post content.
  • Legitimate interests (GDPR Art. 6(1)(f)): operational logs for security and debugging.
  • Consent (GDPR Art. 6(1)(a)): storage of your AI provider keys — opt-in via the bot, revocable at any time.

03How long we keep it

  • Account & configurations: for the lifetime of your account.
  • Post content in the publishing queue: until publishing or removal; published items are kept 30 days for dedupe.
  • Operational logs: 30 days, then deleted.
  • After cancellation: all of the above is deleted 30 days post-cancellation (a backup-recovery window). Encrypted AI keys are zeroed immediately on cancellation.

04Who we share data with

Scrapomatic uses a small number of processors and third parties, each one for a specific purpose:

  • Telegram — the bot runs on Telegram; messages, channel posts and bot commands necessarily pass through Telegram’s infrastructure. See Telegram’s Privacy Policy.
  • Payment providers — crypto payments are non-custodial and do not involve a third-party processor.
  • Your chosen AI provider (Gemini, OpenAI, Anthropic) — when you enable AI rewriting, Scrapomatic sends your post content to the provider used (either ours for Pro users, or your own in BYOK mode). The provider’s privacy policy governs how they handle that content.
  • Hosting provider — the server runs in an EU-based data centre.

We do not sell personal data. We do not share data with advertising networks. We do not use third-party analytics on the marketing site beyond aggregate, cookieless server logs.

05Your rights

Under GDPR you have the right to:

  • Access your data — type /export to the bot for a JSON export, or email us.
  • Rectify inaccurate data — most of it you can edit directly inside the bot.
  • Delete your data — type /delete in the bot, or email us. Takes effect immediately; backups purged within 30 days.
  • Portability — the /export export is a machine-readable JSON file you can take with you.
  • Object to processing based on legitimate interests.
  • Lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).

06Security

Data is stored in encrypted databases. AI provider keys are encrypted with AES-256 at rest. Transport is TLS only. Access to production systems is restricted via SSH keys with hardware-backed second factor.

07Children

Scrapomatic is not directed at people under 16. We do not knowingly collect data from anyone under 16. If you believe a child has registered, email support@scrapomatic.app and the account will be deleted.

08Changes to this policy

Material changes will be announced inside the bot at least 14 days before they take effect. The effective date at the top of this page is updated accordingly.

09Contact

Email: support@scrapomatic.app
Telegram: @ScrapomaticBot