Privacy Policy

Effective 2 November 2026

1. Who we are

ExtractHub (the website extracthub.io, the dashboard dash.extracthub.io and the API api.extracthub.io) is operated by PT Pawang Komputasi Nusantara, Jl. Puntadewa No. 101A, Ngaglik, Sleman, Daerah Istimewa Yogyakarta, Indonesia ("we", "us"). We are the controller of the personal data described in this policy. Contact: support@extracthub.io.

We process personal data in line with Indonesian Law No. 27 of 2022 on Personal Data Protection and, where it applies to you, other data protection laws such as the EU / UK GDPR.

2. Data we collect

  • Account data: when you sign in with Google we receive your name, email address and profile picture. You may add a username, a display name and an avatar.
  • Billing data: your credit balance, top-ups, automatic top-up settings and credit transactions. Card and bank details are handled by Polar or PayPal; we do not receive or store them. For PayPal automatic top-ups we store the payment token PayPal gives us, not your card.
  • API keys: we store a hash of each key and a short prefix so you can recognise it; the full key is shown only once.
  • Usage data: API, MCP and Studio requests (time, endpoint, extractor, target URL, status, cost, request id, IP address and user agent), credit usage and rate-limit counters.
  • Content you create: extractor definitions, versions, changelogs, pipelines, webhook URLs and settings, and anything you choose to publish. Public and unlisted extractors are visible to others; their pages count anonymous views.
  • Content you fetch: target URLs and the pages, extracted data and results our service fetches for you. Cached pages (Studio) and batch / job results are stored temporarily so we can return them to you.
  • Communications: transactional emails we send you (for example top-up receipts, low-balance alerts, extractor deprecation notices) and your email preferences.
  • Technical data: cookies and similar storage described in section 6, and security logs.

3. How we use it and why

  • To provide the service (performance of our contract with you): sign-in, running extractions, batches, pipelines and webhooks, releasing and sharing extractors, showing your usage.
  • To bill you (contract and legal obligations): charging credits, processing top-ups, refunds and disputes, keeping accounting records.
  • To keep the service safe (legitimate interests): rate limits, fraud and abuse prevention, debugging and security monitoring.
  • To communicate with you (contract and legitimate interests): transactional emails and service notices. You can switch off non-essential email categories on your profile page.
  • Optional AI assist (your request): when you use AI assist in Extractor Studio, the page content and your prompt are sent to the AI provider to suggest an extractor.

We do not sell personal data and we do not use it for advertising.

4. Who we share it with

We use these service providers (processors) to run ExtractHub. They may only use the data to provide their service to us:

  • Cloudflare, Inc.: Hosting of the website, dashboard and API, databases, file storage, queues, security (bot protection with Turnstile) and sending transactional email.
  • Google LLC: Sign-in with Google (we receive your name, email address and profile picture) and the Gemini models used by the optional AI assist in Extractor Studio.
  • OpenRouter, Inc.: Routes optional AI assist requests in Extractor Studio to the selected language model provider.
  • Decodo (UAB "Decodo") and Zyte Group Limited: Scraping providers that fetch the target web pages you ask our API, batches, pipelines or Studio to fetch.
  • Polar Software, Inc. and PayPal: Payment processing for credit top-ups and automatic top-ups. Polar acts as merchant of record for purchases made through it.

We may also disclose data when the law requires it, to protect our rights or users, or as part of a merger or sale of the business (with notice to you).

5. International transfers

Our providers process data in several countries, including Indonesia, Singapore, the United States and the European Union. Where required, we rely on the safeguards those providers offer (such as standard contractual clauses).

6. Cookies and local storage

  • Session cookies on .extracthub.io keep you signed in to the dashboard (strictly necessary).
  • Cloudflare Turnstile may set cookies or run checks to protect the dashboard from bots (strictly necessary).
  • Local storage in your browser remembers preferences such as the colour theme.

We do not use advertising or third-party analytics cookies.

7. How long we keep data

  • Account data (profile, API keys, extractors, settings): Until you delete it or ask us to delete your account.
  • Credit transactions and payment records: As long as required for accounting and tax obligations, also after the account is closed.
  • API request logs and usage records: Kept to show you your usage and billing history, to prevent abuse and to resolve disputes; deleted with your account unless we must keep them for billing.
  • Batch and async job results: Deleted automatically 7 days after they are ready.
  • Webhook delivery logs: Deleted after 30 days.
  • Transactional email logs: Deleted after 180 days.

8. Your rights

You can access, correct, download or delete your personal data, withdraw consent, object to or restrict certain processing, and complain to a supervisory authority. Most account data can be changed in the dashboard; for anything else, or to delete your account, email support@extracthub.io. We answer within the period the law requires (at most 30 days in most cases).

9. Security

We use encryption in transit (HTTPS), hashed API keys, encrypted webhook signing secrets and access controls. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

10. Children

ExtractHub is a developer service and is not directed at children. You must be at least 18 years old to create an account.

11. Your responsibility for scraped data

If the pages you fetch or extract contain personal data of other people, you decide what is collected and why, and you are responsible for having a lawful basis for it. For that data we act as your processor. See the Terms of Service.

12. Changes

We may update this policy. We will change the effective date above and, for material changes, notify account holders by email or in the dashboard before the change takes effect.