Privacy Policy

1. Overview

Boildown, Inc. is a Delaware C-Corporation located at 2810 North Church Street #88977, Wilmington, DE 19802, USA. For the personal data described in this policy, Boildown, Inc. is the data controller - with one important exception, Scraped Content, which is covered in Section 4.

Four promises up front:

• We do not sell your personal data. Not to advertisers, not to data brokers, not to anyone.
• We do not share your personal data for advertising - no cross-context behavioral advertising, no ad targeting, and nothing beyond operating the Service as described in this policy. (The one ad-adjacent thing we do - measuring whether our own ads work, using only an ad-click identifier - is described in Section 8.)
• Your scrape results are never sold or shared. They belong to you, and we process them only to run the Service for you.
• We do not currently use your personal data or your scrape results to train machine-learning models. If that ever changes, we will update this policy and notify you before doing so.

Everything below is the detail behind those promises.

2. Information We Collect

Account information. When you create an account with email and password, we store your email address and a cryptographic hash of your password (using Argon2). We never store your password in readable form. If you sign in with Google or GitHub, we receive your name, email address, profile picture, and the provider's account identifier instead of a password.

Email verification codes. New email accounts confirm their address with a 6-digit code. The code itself is never stored - we keep only a short-lived keyed hash used to check your entry, and it is deleted once used or expired.

Billing information. Payments are processed by Stripe. Boildown never receives or stores full card numbers or security codes. We keep what we need to run your subscription: your plan, billing status and period, and a card reference limited to the brand, last four digits, and expiry date.

Scrape data. This is the heart of the Service: the URLs you submit, the natural-language instructions (prompts) you write, your scrape configurations and schedules, the extraction results, page captures and screenshots made during scraping, job logs, and per-job metadata such as page counts, processing time, and AI token usage.

Product usage analytics. We record events about how the Service is used - for example, that a scrape started or finished, its duration, how many pages it covered, or that a usage limit was reached. These events are tied to your internal account ID, not your email address, and the events themselves never contain your prompts, your scraped content, or your results. Separately, session replay can record what is shown on your screen while you use the app - Section 7 explains exactly what it captures and what it always excludes.

Technical data. Like virtually every online service, our servers and infrastructure providers keep standard request logs, which can include your IP address, browser type, and timestamps. We use these for security, debugging, and keeping the Service running.

Communications. If you email us or contact support, we keep the correspondence so we can help you and improve the Service.

Signup attribution. If you arrive at boildown.ai from an ad or campaign link, we capture the campaign parameters in the URL (such as a Google click ID or UTM tags) at signup. Section 8 explains the narrow way this is used.

3. How We Use Your Information

We use your information to:

• Provide the Service - run your scrapes, store and display your results, manage your account, and authenticate you.
• Process payments and manage subscriptions - through Stripe, including handling failed payments and renewals.
• Send service emails - verification codes, billing notices, and (if you keep them enabled) job-completion notifications and usage alerts. You can turn notification emails off in your settings.
• Understand and improve the product - using the metadata-only analytics described above to see which features work and where people get stuck.
• Keep the Service secure - detecting abuse, preventing fraud, enforcing usage limits, and investigating incidents.
• Measure advertising effectiveness - in the limited way described in Section 8.
• Comply with the law - tax, accounting, and responding to valid legal requests.

For users in the EEA, the United Kingdom, and Switzerland, our legal bases under the GDPR (and equivalent laws) are:

Where we rely on legitimate interests, we have weighed them against your rights, and you can object as described in Section 12.

4. Scraped Content

Boildown is a tool. You decide which publicly accessible web pages to scrape, what instructions to give, and what data to collect. We call the pages, captures, and extracted data from your scrapes "Scraped Content".

Scraped Content may include personal data about third parties - for example, names appearing on a public directory page you chose to scrape. For that data:

• You are the data controller (or the equivalent role under your local law). You determine the purposes and means of collecting it.
• Boildown is your processor. We process Scraped Content on your behalf, solely to provide the Service to you - loading the pages you specify, extracting the data you asked for, and storing the results in your account.
• Lawfulness is your responsibility. You are responsible for ensuring that your collection and use of Scraped Content complies with applicable laws, third-party rights, and any obligations you owe to the websites you scrape. Boildown does not monitor or pre-approve your scrape targets.

Your responsibilities when using the Service are set out in our Terms of Service.

5. AI Processing

Boildown uses third-party AI models to turn raw web pages into clean structured data. During a scrape, page content, page screenshots, and your instructions are sent to our AI providers - Anthropic, OpenAI, and Google (Gemini) - which act as our service providers (processors) strictly to perform the extraction.

Under our agreements with these providers, data submitted through their APIs is not used to train their models.

AI extraction is probabilistic: results can contain errors or omissions, and you should verify them before relying on them.

6. How We Share Information

We disclose personal data only to the service providers we need to run Boildown, each bound by contracts limiting what they can do with it:

Beyond these providers, we disclose personal data only:

• At your direction - for example, when you export your results.
• For legal reasons - if required by law, subpoena, or other valid legal process, or to protect the rights, safety, or property of Boildown, our users, or the public.
• In a business transfer - if Boildown is involved in a merger, acquisition, or sale of assets, your data may transfer with the business; we will notify you of any change in who is responsible for it and this policy will continue to apply until updated.

To repeat the headline: we do not sell your personal data, we do not share it for advertising purposes, and your scrape results are never sold or shared with anyone - the providers above act only on our instructions, solely to run the Service for you.

7. Cookies and Analytics

We use only essential cookies - the ones needed to sign you in and keep your account secure:

When you open the checkout, Stripe may set its own cookies strictly for payment security and fraud prevention, and our security provider Cloudflare may set a strictly necessary cookie (such as __cf_bm) to distinguish people from bots.

That is the full list of cookies we and our infrastructure use. There are no advertising cookies, no tracking cookies, and no cross-site tracking - which is why you don't see a cookie banner on boildown.ai. Our analytics tool, PostHog, runs in cookieless mode: it keeps its state in memory for the duration of your visit and sets no persistent identifiers in your browser. Where session replay is used to understand how the interface is used and to diagnose failures, it records the content shown on the page - which can include your prompts and scrape results - and what you type, so we can see what went wrong (for example, the prompt behind a failed scrape). Two exclusions always apply: passwords are masked and never recorded, and payment card details are never captured. Replays are retained only for a limited period and are accessible only to staff who need them to operate the Service.

The app also stores a few preferences (like panel width and scrape settings) in your browser's local storage. These stay on your device and are not used for tracking.

Email tracking: none. Our emails contain no tracking pixels and no open or click tracking. We currently send only transactional and service emails - verification codes, billing notices, job notifications, and usage alerts. If we ever introduce marketing email, every message will include a working unsubscribe link, and we will honor every opt-out.

8. Advertising Measurement

We advertise Boildown, and we want to know whether those ads work - without sharing your behavior with ad platforms.

If you sign up after clicking a Google ad, we capture the ad-click identifier (such as a Google click ID) from the link you arrived on. When you create a verified account - and again if you later purchase a subscription - we report that conversion to Google using only that click identifier, an internal reference, and (for purchases) the amount paid, so Google can tell us which campaigns work.

We do not send Google your name, email address, scraped content, or browsing behavior, and we do not participate in behavioral advertising networks. If you didn't arrive from an ad, nothing is sent at all.

9. Data Retention

We keep your data for as long as your account is active and as long as reasonably necessary for the purposes described in this policy, including providing the Service, complying with legal obligations, resolving disputes, and maintaining security.

Some examples of how this works in practice: email verification codes are deleted as soon as they are used or expire; session tokens expire on their own short schedules; billing records are kept as long as tax and accounting law requires.

You can request deletion of your account and data at any time by emailing [email protected]. We will act on verified requests within the timeframes required by applicable law.

10. International Data Transfers

Boildown is a US company, and your data is processed in the United States, where privacy laws may differ from those in your country.

If you are in the EEA, the United Kingdom, or Switzerland, we protect transfers of your personal data through appropriate safeguards - such as Standard Contractual Clauses in our agreements with service providers where applicable - and/or because the transfer is necessary to perform our contract with you. You can contact [email protected] for more information about the safeguards we use.

11. Security

We protect your data with industry-standard measures, including:

• Encryption in transit. All connections to the Service use TLS.
• Hashed credentials. Passwords are hashed with Argon2 and never stored in readable form; verification codes are stored only as short-lived keyed hashes.
• Hardened sessions. Authentication cookies are httpOnly and protected against cross-site request forgery.
• Access controls. Access to production systems and data is restricted and limited to what is needed to operate the Service.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If you believe your account has been compromised or you have found a vulnerability, contact us at [email protected] and we will investigate promptly.

12. Your Rights and Choices

Everyone. Regardless of where you live, you can access your data in the app, export your results at any time, and email [email protected] to request a copy of your data, corrections, or deletion of your account. We may need to verify your identity before acting on a request.

EEA, UK, and Switzerland. You have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your data erased;
• receive your data in a portable format;
• restrict or object to certain processing, including processing based on our legitimate interests;
• withdraw consent at any time, where processing is based on consent (this does not affect processing that already happened); and
• lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first, but you are not required to come to us before going to a regulator.

Note that for personal data inside your Scraped Content, where you are the controller (Section 4), individuals should direct their requests to you; we will assist you in fulfilling them as your processor.

California. If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) gives you the right to know what personal information we collect, to delete it, to correct it, and to not be discriminated against for exercising those rights. The categories we collect are described in Section 2: identifiers (such as email address and account IDs), commercial information (subscription and billing records), internet activity (product usage and technical logs), and the content you provide (scrape configurations and results). We do not sell personal information, and we do not share it for cross-context behavioral advertising - and we have not done either in the preceding 12 months. To exercise your rights, email [email protected]. You may use an authorized agent; we will verify the request as the law allows.

Email choices. Job-completion and usage-alert emails can be turned off in your notification settings. Verification and billing emails are part of operating your account and are sent only when needed.

13. Children

The Service is intended for adults. It is not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us personal data, contact [email protected] and we will delete it.

14. Changes to This Policy

We may update this policy as the Service evolves or the law changes. The "Last updated" date at the top always reflects the current version. If we make material changes, we will notify you by email and/or a notice in the app before the changes take effect. Your continued use of the Service after the effective date means the updated policy applies.

15. Contact

Boildown, Inc.
2810 North Church Street #88977
Wilmington, DE 19802, USA

• Privacy and legal questions: [email protected]
• Data access, export, and deletion requests: [email protected]