Privacy policy

Spider is run by BAGELMEN LLC, 1600 Polk Way, Sanford, FL 32773, United States. We fetch, render and extract public web pages for our customers through the spider.cloud API, the dashboard, and an MCP server that AI apps such as ChatGPT and Codex connect to. The crawler is open source .

This policy covers your account, the requests you send us, and your visits to our website. Enterprise customers with a signed data processing agreement get the terms of that agreement for the content of their requests.

We do not sell personal data, and we do not train models on your prompts.

Your account

Your email address and how you sign in: email, Google, GitHub or Discord. If your sign-in provider shares your name, we keep that too. We also keep your account settings, credit balance, API keys, team members you invite, and your customer ID at our payment processor, which holds your card details. If you pay per request in USDC, we receive the paying wallet address and the transaction.

If you accept cookies, we record how you found us when you sign up: the page you landed on, the referring site, campaign tags, ad click IDs, and your country.

Your requests

Each request carries what you put in it: URLs, search queries, prompts, extraction schemas, and options such as country, headers or cookies. We fetch the pages and return the content, screenshots, links or extracted fields in the response.

For every request we write a log entry with your account, the URL you asked for, the last four characters of the API key, the status, timing, size and credits charged, and how we routed it. For a search, the entry holds the query text and the result URLs. The entry never holds the page content.

We keep a shared cache of public pages. When we fetch a page, we may keep a copy and use it to answer a later request for the same URL, including a request from another customer. Set cache: false on a single-page request to skip the cache.

To improve Spider, we keep statistics about how websites respond and may use samples of public web pages. Neither is linked to you, and neither includes your prompts, cookies, headers or account details. With zero data retention on, we take no samples from your requests.

Our website

We measure how the site is used. If you decline cookies we still count page views and product actions without cookies or stored identifiers. Accepting adds a persistent identifier and session replay. Session replay masks everything you type into form fields.

If you email us, we keep the conversation so we can answer it.

AI apps reach Spider through our MCP server at mcp.spider.cloud. When you connect one, you sign in to spider.cloud and approve the app. We then create an API key in your account named after the app. The app receives encrypted tokens that contain that key and your account ID. An access token lasts 1 hour and a refresh token 30 days. We store no copy of the tokens.

When the app calls a Spider tool, the tool input goes to the Spider API with that key. Inputs are what you or the app supply: URLs to crawl or scrape, search queries, prompts, extraction schemas, and request options. The API handles them like any other request, as described above. The output goes back to the app: page content, links, search results, screenshots, or your credit balance. What the app does with it afterwards is covered by the app provider's privacy policy, such as OpenAI's for ChatGPT and Codex.

The MCP server does not log or store tool inputs or outputs. It keeps a connection in memory and closes it after 30 minutes without activity. Its logs record only that a connection opened or closed. To limit abuse, it counts app registrations per IP address in memory for up to one hour.

The browser tools open a session on our browser service. They do not record the session.

To disconnect an app, delete its API key on the API keys page. Its tokens stop working at once.

Delete your account in account settings. That cancels your subscriptions, deletes your API keys, logs, recordings and settings, and removes your sign-in. Copies of request logs expire on the schedule in section 06, and billing records stay as it describes.

Delete an API key at any time. Any app or script using it stops working.

Zero data retention

Turn on zero data retention in account settings. While it is on, we neither read nor write any cache for your requests, keep the URL and host in request logs only as a keyed hash, and drop request parameters, user agent, error text and IP addresses from them. We make no browser session recordings of those requests and use nothing from them for training. It costs 2.5x the normal credits per request.

Our website records no session replay for an account with it on, and the playground keeps no run history in your browser. The zero data retention page lists what is kept, for how long, and which features are off while it is on.

Decline or withdraw cookie consent with the banner on our website. Unsubscribe from product email with the link in the email, or by writing to us.

Wherever you live, you can ask us for a copy of your personal data, to correct it, to delete it, or to stop using it for a purpose you object to. Write to support@spider.cloud and we will answer within 30 days. If you are in the EU, the UK or another place with a data protection authority, you can also complain to it.

Spider is not meant for children under 16, and we do not knowingly collect their data.

Our main region is the United States. Connections to target sites may pass through network providers and compute devices in other countries, and the service providers in section 05 may process data where they operate.

We encrypt traffic to and from Spider with TLS. Our databases accept no connections from the public internet. Only authorized staff can reach production systems. Request logs and server logs never contain a full API key.

When this policy changes, we update the date at the top of this page.