1.Scope
This policy applies to mcpscraper.dev, MCP Scraper APIs and MCP servers, the MCP Scraper dashboard, connected-provider features, memory features, and scheduled actions (together, the “Service”). “MCP Scraper,” “we,” and “us” mean the operator of the Service.
When you use the Service for an employer or customer, that organization may control the data and your use. In that case, its privacy notice may also apply. Provider services such as Google, YouTube, Meta, LinkedIn, and X have their own privacy practices.
The Service is not directed to children under 13, and connected-provider and scheduled-action features are intended for adults and authorized business users.
2.Data we collect
- Account and support dataEmail address, password hash, account and subscription status, preferences, support messages, and records needed to administer your account.
- OAuth connection dataThe provider, connection ID, the provider account identifier or display information returned by the provider, granted scopes, connection status, organization or workspace identifiers, and OAuth access and refresh tokens. We do not ask for or store your provider password.
- Authorized provider dataOnly data covered by the scopes you grant and the feature you use, such as analytics reports, channels, posts, comments, pages, ad accounts, campaigns, lists, likes, bookmarks, and related metadata.
- Instructions, schedules, and resultsThe action you request, selected account, permitted tools, timing and time zone, run status, provider response, and output returned to you or your selected AI client.
- Service, device, and billing dataAPI requests, timestamps, IP address, browser and device information, error and security logs, connected-account quantities, Nango function/Proxy/compute measurements, usage and Credit receipts, referral or attribution data where enabled, and billing identifiers. Stripe handles full payment-card details directly.
- Content you submitURLs, prompts, files, memory notes, browser-session inputs, and other material you ask the Service to process.
3.How we use data
We use data to authenticate you; provide the feature you requested; create, refresh, and validate a connection; execute a user-authorized action or schedule; return results to you or the AI/MCP client you chose; maintain billing; prevent abuse; diagnose failures; provide support; and comply with law.
We do not sell connected-provider data, use it for cross-context behavioral advertising, or use it to train a generalized AI model. We do not let another customer access your connection. We may use aggregated or de-identified operational metrics when they cannot reasonably identify you and provider rules permit it.
Human access to connected-provider data is limited to what is necessary for support you request, security and abuse investigation, legal compliance, or operating the feature. We do not permit routine human reading of restricted Google data.
Our legal bases, where required, are performance of our contract with you, your consent for provider access and directed actions, legitimate interests in securing and operating the Service, and compliance with legal obligations.
4.Connected-provider disclosures
Google APIs and Google Analytics
Depending on the scopes you approve, we may access Google account identifiers and Google Analytics accounts, properties, streams, configuration, conversion-event data, metadata, and reports. We use this information only to show, analyze, create, update, or archive the items you specifically request.
MCP Scraper’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We request scopes in connection with available features, and provider approval may limit which features can be enabled.
YouTube API Services
MCP Scraper uses YouTube API Services. Depending on the scopes and action, we may access channel, video, playlist, playlist-item, caption, comment, and related metadata, and may create, update, or delete content only from the YouTube account you authorize.
YouTube actions must be clearly identified and expressly directed by you. We do not download or store YouTube audiovisual content through these connected features. Review the YouTube API Services Terms, YouTube Terms of Service, and Google Privacy Policy.
Meta and Facebook
Depending on approved permissions, we may access the Facebook identity, Pages, posts, comments, reactions, ad accounts, campaigns, ads, creatives, audiences, and insights that you authorize. We use them only to provide the requested Page, content, or marketing workflow and in accordance with the Meta Platform Terms. We do not use Meta data for unrelated profiles or targeting.
Depending on approved products and scopes, we may access your basic member identity and permitted organization, Page, post, comment, reaction, and engagement data. We do not sell LinkedIn content, use it for ads or surveillance, or expose it to other customers. LinkedIn functionality and storage are limited by the LinkedIn API Terms of Use; some actions may be unavailable even after OAuth.
X
Depending on approved scopes, we may access your X identity, Posts, mentions, lists, likes, bookmarks, follows, Spaces, and related metadata, and may perform actions you separately direct. OAuth authorization alone is not consent to post, like, follow, or take another action. We require an express instruction or an express schedule before a write action and follow the X Developer Agreement and X Developer Policy.
Provider rules control. A requested action may be unavailable, delayed, or refused because of scopes, app review, rate limits, account status, or provider policies. Scheduling does not override a provider’s requirement for specific consent.
6.Retention
We keep account, usage, billing, and support records only as long as reasonably needed for the Service, security, dispute resolution, tax and accounting, and legal obligations. Schedules and their run records remain until deleted, the account is closed, or they are no longer operationally needed.
OAuth tokens are retained through Nango while the connection is active. After you revoke access, request connection deletion, or close your account, we stop using the connection and delete or de-identify provider data according to the applicable provider rule and our backup lifecycle, unless law requires limited retention.
- YouTube authorized data is deleted as soon as possible and no later than 30 calendar days after revocation, unless YouTube permits or law requires retention.
- LinkedIn API content and tokens are deleted promptly upon your deletion request or account closure, subject only to a legal preservation duty.
- For Meta, X, Google Analytics, and other providers, we delete connection credentials and provider data when the connection is deleted, subject to provider rules, legal duties, and short-lived backups.
We may retain non-identifying aggregate statistics and records needed to document a deletion or legal compliance.
7.Security
We use administrative and technical safeguards designed for the sensitivity of the data, including HTTPS, server-side secrets, scoped connection identifiers, access controls, logging and monitoring, and vendor security controls. OAuth tokens are not intentionally sent to your browser, AI agent, or MCP client. Nango stores and refreshes those tokens for the server-side connection.
No online service is perfectly secure. Protect your MCP Scraper account and provider accounts, review granted scopes, and contact support@mcpscraper.dev if you suspect unauthorized access.
8.Revocation, deletion, and your rights
Stop a connection
You can revoke MCP Scraper directly in the provider’s connected-app settings: Google and YouTube, Meta/Facebook, LinkedIn, or X. Revocation prevents future authorized calls once the provider processes it, but does not undo actions already completed.
Also cancel or remove any MCP Scraper schedules that use that connection. Use Dashboard → Integrations → Disconnect to delete the Nango connection record, tokens, bindings, and stored provider data and synchronize its recurring Stripe quantity. If dashboard deletion fails, email support@mcpscraper.dev with your MCP Scraper account email and provider name. Never send us your password or token.
Delete your MCP Scraper account
Use Account → Delete account to cancel active subscriptions, deactivate access, and start the account-deletion workflow. Email support if you also want confirmation that every connected-provider record has been deleted.
Meta data-deletion instructions
If you arrived here from a Meta data-deletion request, revoke the app in Facebook’s Apps and Websites settings and email support@mcpscraper.dev from your MCP Scraper account address. Include “Meta data deletion” and, if known, the connected Page or ad-account name. We will verify the request, delete the applicable connection and stored Meta-derived data, and confirm completion. Do not include Meta credentials.
Privacy rights
Depending on where you live, you may request access, correction, deletion, portability, restriction, or an objection to certain processing. You may withdraw consent without affecting earlier lawful processing. We do not sell personal information or share it for cross-context behavioral advertising. Email us to exercise a right or appeal a decision; we may reasonably verify your identity.
Data may be processed in the United States and other countries where our service providers operate. Where required, we rely on contractual or other lawful transfer safeguards.
9.Changes and contact
We may update this policy as the Service, providers, or law changes. We will change the effective date and provide additional notice when a material change requires it. If we materially expand how we use connected-provider data, we will request any new consent required before that use.
MCP Scraper privacy contact