Privacy Policy

xdata-fly (xdatafly.com) is a web scraping API service operated by an individual developer. We currently provide a structured JSON API for Amazon product reviews. A Google Search API is planned and not yet available. For privacy-related questions, contact us at [email protected].

We collect the following categories of information:

a) Information you provide directly

• Email address (required for account registration)
• Password (stored as a one-way hash; we never see your plaintext password)
• Payment information (processed by our third-party payment provider; we do not store full card numbers)

b) Information collected automatically

• API request logs: endpoint called, parameters (excluding secret keys), response code, credit amount charged, and timestamp
• IP address and User-Agent of API callers
• Browser cookies for session management and locale preference
• Server-side access logs (standard web server logs)

c) Information from third-party services

• Customer support conversations via Chatwoot (hosted at cs.xdatafly.com)

We use the collected information to:

• Provide, operate, and maintain the Service
• Process payments and manage your credit balance
• Authenticate your identity and protect account security
• Send transactional emails (e.g. account registration, password reset)
• Respond to support requests
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Improve the Service through aggregate, anonymised usage analysis

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

If you are located in the European Economic Area (EEA), our processing of your personal data is based on the following legal grounds:

• Contract performance: processing necessary to provide the Service you signed up for
• Legitimate interests: fraud prevention, security, and Service improvement
• Legal obligation: compliance with applicable laws
• Consent: where we explicitly request it (e.g. optional marketing communications)

We use the following cookies:

• NEXT_LOCALE: stores your language preference (English or Chinese); expires in 1 year
• Session cookie: keeps you logged in during a browser session; expires when you close the browser or sign out

We do not use advertising cookies or cross-site tracking cookies. You can disable cookies in your browser settings, but this may affect Service functionality.

We share data only with the following categories of third parties, and only as necessary:

• Payment processors: to handle credit purchases. They receive only the information necessary to complete the transaction.
• Cloud infrastructure providers: our servers are hosted on Tencent Cloud (Tencent Cloud Computing (Beijing) Co., Ltd.). Data is stored in the People's Republic of China.
• Chatwoot (self-hosted): our customer support platform, running on our own servers.
• Law enforcement or regulators: when required by applicable law or to protect our legal rights.

We retain your account data for as long as your account is active. API request logs are retained for up to 90 days for billing verification and fraud prevention. Server access logs are retained for up to 30 days.

After account deletion, we may retain anonymised, aggregated data indefinitely for analytics, but it will not be linked to your identity.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Correction: request correction of inaccurate data
• Deletion: request deletion of your personal data ("right to be forgotten")
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interests
• Restriction: request that processing be restricted in certain circumstances

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

The Service is not directed at children under 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

We implement industry-standard security measures including HTTPS/TLS encryption in transit, hashed password storage, and restricted access controls. However, no method of transmission or storage is 100% secure and we cannot guarantee absolute security.

Our servers are located in the People's Republic of China. If you access the Service from outside China, your data will be transferred to and processed in China. By using the Service, you consent to this transfer.

For EEA users, we will take appropriate measures to ensure adequate protection of your personal data in accordance with applicable data protection laws.

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised effective date. For material changes we will notify you via email or a notice on the Service. Continued use after the changes take effect constitutes acceptance.

For any privacy-related questions or requests, contact us at: [email protected]