Who is responsible
Extraktor (extraktor.app) is a service of DENNIS KORTSCH, a sole proprietorship (enkeltpersonforetak) in Norway, organization number 937066333. We are the controller of the personal data in this policy. For each question about your data, write to support@extraktor.app.
The data that we use, and why
- Account. When you sign in, we get your email address, your name and your profile image from the sign-in provider that you select. We use them for your account. Legal basis: the contract with you (GDPR Art. 6(1)(b)).
- Plan and credits. We keep your plan, your credits, the free credits that you used (25 each month) and your Stripe customer ID. Stripe processes your payment details; we do not see your card number. Legal basis: the contract, and the accounting law (Art. 6(1)(c)).
- Your requests. We process the URLs, search queries and options that you send, and send you the result. We do not keep the page text after the request. We keep screenshots for 30 days, so that you and your agent can open them. Legal basis: the contract.
- API keys. We keep a hash of each key, its name, its last four characters and its date. We never keep the full key.
- Logs and security. For each request, our logs keep the time, your user ID, the type of request, the result, the duration and the name of the coding agent that sent it, if any. The logs do not contain page text or search queries. We use your IP address for a short time to limit the request rate. Legal basis: our legitimate interest in a secure and reliable service (Art. 6(1)(f)).
- Service use. We keep extraction attempt and success counts for your account, and the dates of first use and successful use. We send counts, result types and durations to AskWyse, without your account ID. We use these to improve the service. Legal basis: our legitimate interest (Art. 6(1)(f)).
Pages that you ask Extraktor to read can contain personal data of other people. You decide which pages Extraktor reads, and you are responsible for a lawful use of the result. See the terms of service.
Service providers
These providers process data for us, only for the purposes below:
- Cloudflare: Hosting, the database for accounts and credits, screenshot storage, the browser that loads pages, the AI Gateway and request logs.
- Clerk: Sign-in and accounts.
- Stripe: Payments, invoices and taxes (Stripe Managed Payments).
- SerpApi: Web search. It receives your search query.
- OpenAI, through the Cloudflare AI Gateway: AI outputs that you ask for, for example a summary, fields or design. It receives page text and, when needed, images of the page.
- AskWyse: Website and service use counts, without analytics cookies. Extraction events contain no account IDs, page URLs, page content or search queries.
- TypeSafe: Fast AI decisions about page content. It receives parts of the page.
- Google (Chrome UX Report API): Core Web Vitals in the SEO report. It receives the URL of the page.
Some of these providers process data outside the EEA, for example in the United States. These transfers use the safeguards that the GDPR permits, for example the EU-U.S. Data Privacy Framework or standard contractual clauses.
How long we keep data
- Account, plan, credits and service use counts: while you have an account.
- Payment and accounting records: as long as the law requires (in Norway, usually five years).
- Screenshots: 30 days.
- Logs: at most 30 days.
- API keys: until you delete them.
Cookies
We use only the cookies that sign-in needs. We do not use cookies for analytics or advertising.
Your rights
You can ask for a copy of your data, and ask us to correct it, delete it, limit its use, or send it to you in a portable format. You can object to a use that is based on our legitimate interest. To delete your account and its data, write to support@extraktor.app. You can also complain to the Norwegian Data Protection Authority, Datatilsynet.
Changes
When this policy changes, we update this page and its date. For an important change, we also tell you by email.