RunHarvester Privacy Policy

This Privacy Policy explains how Isentró Kft. ("RunHarvester", "we", "us", or "our") collects, uses, discloses, stores, and otherwise processes Personal Data in connection with RunHarvester.

RunHarvester is a web-data operations service. Depending on the context, we may act as a data controller, a data processor, or a sub-processor. Section 3 explains these roles because they determine who is responsible for deciding why and how Personal Data is processed and who must respond to a Data Subject request.

This Privacy Policy is intended to be read together with our Terms of Service, Cookie Policy, any applicable Data Processing Addendum ("DPA"), and any product-specific or contractual notice. A DPA-not this Privacy Policy-contains the mandatory processor terms required when RunHarvester processes Customer Personal Data on a Customer's behalf.

Privacy at a glance

• We act as a controller for data used to operate our websites, accounts, customer relationship, billing, security, support, recruitment, and our own service infrastructure.
• We generally act as a processor when a Customer instructs RunHarvester to retrieve, transmit, store, or extract Personal Data from a Customer-selected target or workflow.
• Customers decide what targets, fields, credentials, rules, workflows, and destinations they use. Customers are responsible for having a lawful basis, providing required notices, respecting rights and objections, and using collected data lawfully.
• Publicly accessible information is not automatically free of privacy obligations and does not automatically mean that the person concerned has consented to its collection or reuse.
• RunHarvester does not sell Customer Content to data brokers. We do not use Customer Content for cross-context behavioural advertising.
• Some optional AI-assisted features may transmit selected instructions, schemas, content samples, or error context to AI service providers. Their retention and training practices may differ, as explained in Section 11.
• Data API result content is ordinarily available for seven days after completion. Some metadata must be kept longer for billing, security, legal, and operational purposes.
• You can contact us at [email protected] for privacy questions or requests.

1. Who we are

RunHarvester is operated by:

Isentró Kft.
Hungarian company registration number: 01-09-444499
Registered office: 1082 Budapest, Corvin sétány 6, 8th floor, unit 4, Hungary
Privacy contact: [email protected]

For processing where RunHarvester is the controller, Isentró Kft. is responsible for the processing described in this Privacy Policy.

2. Scope of this Privacy Policy

This Privacy Policy applies when you:

• visit or interact with runharvester.com, docs.runharvester.com, the RunHarvester dashboard, or another RunHarvester-controlled page or subdomain;
• create, access, administer, or use a RunHarvester account, organization, project, environment, API key, workflow, integration, or other Service feature;
• submit or retrieve scrape requests, browser workflow runs, structured extraction jobs, proxy-routing requests, batches, evidence, events, or results;
• use RunHarvester APIs, documentation, support channels, forms, emails, product notifications, surveys, or community features;
• purchase or administer paid Services, credits, invoices, or tax information;
• communicate with our sales, support, privacy, security, partnership, or legal teams;
• apply for a role or otherwise communicate with us about recruitment; or
• interact with us in a business, supplier, contractor, or partner capacity.

This Privacy Policy does not govern:

• a Customer's own privacy practices or the Customer's later use of data obtained through RunHarvester;
• websites, applications, APIs, proxy networks, webhook destinations, identity providers, payment services, or other third parties that act as independent controllers;
• a third-party target's logging, access-control, security, or privacy practices; or
• Personal Data processed by RunHarvester solely on a Customer's behalf, to the extent the applicable DPA and Customer instructions govern that processing. Relevant parts of this Privacy Policy may still describe the Service's technical operation and our controller-side processing of related account, billing, usage, and security data.

3. Our roles: controller, processor, and sub-processor

3.1 When RunHarvester is a controller

RunHarvester normally acts as a controller when we determine the purposes and essential means of processing, including for:

• account registration, identity, authentication, access control, API-key administration, and organization management;
• our commercial relationship with Customers and prospective Customers;
• billing, accounting, taxes, fraud prevention, payment status, and contractual administration;
• operation, reliability, troubleshooting, security, abuse prevention, audit, and legal compliance;
• website analytics, cookie choices, product communications, and marketing, subject to applicable consent requirements;
• support, privacy requests, complaints, feedback, surveys, and communications;
• recruitment and candidate administration;
• our own discovery, verification, classification, suppression, security, and maintenance of proxy endpoint information and other service infrastructure data; and
• defending legal claims, enforcing agreements, and responding to valid legal process.

3.2 When RunHarvester is a processor

RunHarvester generally acts as a processor when a Customer determines the purpose of a collection or browser workflow and instructs us to process Customer Personal Data, for example by specifying:

• a target URL, domain, API, page, source, query, or batch manifest;
• fields, selectors, schemas, extraction recipes, workflow steps, or output instructions;
• request headers, cookies, session state, credentials, variables, or proxy routing parameters;
• the data to retrieve, evidence to capture, transformations to perform, or results to return; and
• a webhook, integration, storage location, or other destination selected by the Customer.

In that situation:

• the Customer is usually the controller, and RunHarvester is its processor; or
• if the Customer itself processes data for another controller, the Customer may be a processor and RunHarvester may be its sub-processor.

The Customer's account configuration, API calls, workflow definitions, written support instructions, order form, and DPA may constitute documented instructions. We process Customer Personal Data only to provide and secure the Service, comply with those instructions and the DPA, and meet legal obligations that apply directly to us.

3.3 The DPA is required for processor processing

A Customer that intends to use RunHarvester to process Personal Data on behalf of a controller should ensure that an appropriate DPA is in place before submitting that data. The DPA should address, among other matters, documented instructions, confidentiality, security, sub-processors, international transfers, assistance with rights and incidents, deletion or return, and audit information.

If the DPA conflicts with this Privacy Policy regarding Customer Personal Data processed by RunHarvester as a processor, the DPA controls. If a negotiated enterprise agreement contains stricter privacy or security terms, those terms control for that Customer.

3.4 Related controller processing

Even where we act as a processor for Customer Content, we may separately act as a controller for limited related data needed for our own legitimate purposes, such as:

• account and contract administration;
• billing and usage measurement;
• service security, abuse prevention, and incident response;
• proof of request submission, authorization, and system events;
• compliance with law and enforcement of our Terms; and
• aggregated or de-identified service statistics.

We do not use this distinction to repurpose Customer Content for unrelated advertising, data brokerage, or unrestricted model training.

3.5 Third parties may be independent controllers

Target websites, payment providers, identity providers, Customer-selected integrations, proxy providers, and webhook operators may process Personal Data for their own purposes and under their own privacy notices. A Customer's instruction to send a request to, retrieve data from, or deliver a result to a third party does not make RunHarvester responsible for that third party's independent processing.

The legal role of each party depends on the actual facts and applicable law, not only on labels used in a contract or this Privacy Policy.

4. Definitions

For this Privacy Policy:

• Applicable Data Protection Law means privacy, data-protection, electronic-communications, and similar laws applicable to the relevant processing, including the EU GDPR, the UK GDPR, and applicable national or U.S. state privacy laws.
• Authorized User means a person permitted to access a Customer account or organization.
• Customer means the person or entity that creates, purchases, administers, or uses a RunHarvester account or Service.
• Customer Content means data, instructions, configurations, files, secrets, materials, requests, pages, evidence, outputs, and results submitted to, transmitted through, generated for, or retrieved through the Service on a Customer's behalf.
• Customer Personal Data means Personal Data contained in Customer Content that RunHarvester processes as a processor or sub-processor.
• Data Subject means an identified or identifiable individual to whom Personal Data relates.
• Personal Data or Personal Information means information that identifies, relates to, describes, is reasonably capable of being associated with, or can reasonably be linked to an individual or household, as defined by applicable law.
• Sensitive Data includes special categories of Personal Data under the GDPR and information treated as sensitive under other laws, such as health, biometric, genetic, sexual-life, political, religious, precise-location, government-identifier, financial-account, authentication, private-communication, or criminal-offence data.
• Service means RunHarvester websites, dashboard, APIs, documentation, proxy routing, web retrieval, browser workflows, extraction, evidence, result delivery, support, billing, and related features.
• Service Data means Personal Data RunHarvester processes as a controller to operate and administer the Service and business.
• Target means a third-party website, page, API, server, endpoint, or other resource selected or reached by a Customer request or RunHarvester infrastructure process.

5. Personal Data we process

The exact data depends on the features used, account configuration, Customer instructions, and whether we act as controller or processor.

5.1 Account, profile, and organization data

We may process:

• name, display name, username, business email, telephone number, and profile information;
• company, organization, team, role, title, country, time zone, language, and account preferences;
• organization membership, permissions, invitations, account sharing, and administrative relationships;
• acceptance records for Terms, policies, DPAs, notices, and consent choices; and
• account status, verification status, deletion requests, export requests, and related lifecycle records.

5.2 Authentication and security data

We may process:

• password hashes, authentication tokens, session identifiers, recovery records, and multi-factor authentication status;
• identity-provider identifiers and limited profile information received when you choose Google, Telegram, or another supported sign-in method;
• API-key identifiers, prefixes, scopes, hashes, creation dates, last-used dates, revocation status, and usage attribution;
• login attempts, IP addresses, device and browser characteristics, approximate location inferred from IP, timestamps, and security events;
• role and permission checks, administrator actions, impersonation or support-access audit events where such access is used; and
• fraud, abuse, bot, credential-compromise, anomaly, and rate-limit signals.

The full value of an API key may be shown once when created. The Service is designed to store a non-reversible verification value rather than a retrievable plaintext copy. Customers must rotate a key immediately if it may have been exposed.

5.3 Commercial, billing, and tax data

We may process:

• Customer and billing contact details;
• subscription or account status, credits, usage, ledger entries, grants, refunds, and payment history;
• invoice data, billing address, country, tax status, VAT or other tax identifiers, purchase references, and currency;
• payment-provider customer, transaction, product, price, checkout, and webhook references; and
• fraud, chargeback, dispute, and collection information.

Payment-card details are generally collected directly by the payment provider. We do not intend to store full payment-card numbers, card security codes, or private wallet keys in RunHarvester systems.

5.4 Website, cookie, device, and usage data

We may process:

• IP address, browser type and version, operating system, device type, language, time zone, and approximate region;
• page views, navigation path, referring URL, campaign information, button or feature interactions, and session timestamps;
• cookie and similar-technology identifiers, consent status, and preference values;
• API endpoint, method, response status, request ID, latency, error code, quota, concurrency, cache, and usage information;
• product events, feature usage, performance metrics, crash reports, and diagnostic traces; and
• logs needed to operate, secure, debug, and improve the Service.

We seek to keep complete Customer results, target credentials, API-key secrets, full authentication headers, and payment credentials out of analytics events. Diagnostic systems may still receive redacted, sampled, or incident-specific information where necessary to investigate a problem.

5.5 Communications, support, and feedback data

We may process:

• emails, support tickets, contact-form messages, sales requests, privacy requests, security reports, and complaint correspondence;
• message content, attachments, screenshots, logs, request IDs, account identifiers, dates, and troubleshooting context you provide;
• survey responses, feedback, product research, testimonials, and participation records; and
• communication preferences, delivery status, and unsubscribe or suppression records.

Do not send passwords, full API keys, cookies, authorization headers, proxy credentials, payment-card data, private keys, or unredacted target credentials through ordinary support channels. We may redact, quarantine, or delete unnecessary secrets included in a support request.

5.6 Customer instructions and configuration data

Depending on the feature, Customer Content may include:

• target URLs, domains, search terms, source lists, request methods, query parameters, and request bodies;
• selectors, extraction fields, schemas, recipes, transformations, validation rules, and natural-language instructions;
• browser actions, workflow definitions, project and environment identifiers, variables, priority, batch manifests, and idempotency identifiers;
• geolocation, proxy type, routing, user-agent, locale, timeout, wait condition, redirect, and retry settings;
• headers, cookies, tokens, login state, session state, target credentials, proxy credentials, and other secrets supplied by the Customer;
• webhook addresses, signing configuration, integration identifiers, and delivery instructions; and
• job status, events, attempt history, errors, provider-cost metadata, usage, and billing attribution.

5.7 Retrieved pages, evidence, and results

Depending on Customer instructions, we may process:

• HTML, text, JSON, XML, images, files, network responses, status codes, redirects, and headers returned by a Target;
• structured fields and extracted records;
• screenshots, masked evidence, execution traces, page state, and browser storage state;
• CAPTCHA or challenge context, challenge type, page URL, site key, image or token data, and solve status where a supported challenge feature is used;
• target-site errors, content samples, validation output, and extraction-repair context; and
• result metadata, delivery events, webhook attempts, and expiry state.

This data may contain Personal Data even when the Customer did not intend to collect it. Customers must design selectors, workflows, fields, and retention to minimize incidental collection.

5.8 Proxy endpoint and network data

We may process information about proxy endpoints and network routes, including:

• IP address or hostname, port, protocol, source, authentication data where lawfully supplied, and provider or inventory category;
• availability, validation result, status, latency, failure reason, health history, and last-check time;
• country or region, autonomous system number, network provider, and coarse geolocation;
• target category used for a validation check, response classification, and IP-leak or echo-check result;
• routing selection, egress location, assigned request, and operational security metadata; and
• suppression, removal, abuse, ownership, or authorization correspondence concerning an endpoint.

An IP address can be Personal Data in some contexts. Section 12 explains how we handle requests concerning proxy endpoints.

5.9 AI-assisted feature data

When an AI-assisted recipe-generation, repair, extraction, or similar feature is enabled and used, we may process:

• requested field names, field descriptions, schema, output format, recipe instructions, and transformation requirements;
• relevant page excerpts, HTML samples, extracted values, errors, or other context needed for the requested feature;
• prompt and response content, model and provider identifiers, token usage, cost, latency, retry, and error records; and
• Customer feedback or confirmation used to accept, reject, or repair generated logic.

Section 11 contains additional information about AI providers and Customer choices.

5.10 Recruitment and business-contact data

We may process:

• name, email, telephone number, location, professional profile, CV or résumé, portfolio, work history, education, skills, availability, compensation expectations, and interview notes;
• references and background information where lawful and appropriately disclosed; and
• business contact information about suppliers, advisers, contractors, investors, partners, and representatives of Customers or prospective Customers.

5.11 Compliance and legal data

We may process information needed to:

• verify authority, ownership, authorization, or identity;
• investigate suspected misuse, infringement, unlawful collection, security incidents, fraud, or policy violations;
• respond to Data Subject requests, endpoint-suppression requests, complaints, legal demands, and regulatory inquiries;
• maintain legal holds, evidence, and records of notices or decisions; and
• establish, exercise, or defend legal claims.

6. Where Personal Data comes from

We obtain Personal Data from the following sources:

• You and other Authorized Users, when you create an account, configure the Service, submit a request, purchase Services, or communicate with us.
• Your organization or Customer administrator, including invitations, role assignments, billing contacts, or account settings.
• Automated collection from devices and Service use, including logs, cookies, telemetry, IP address, security events, API calls, and usage records.
• Customer-selected Targets and sources, when the Service retrieves data according to Customer instructions.
• Publicly accessible sources, such as websites, APIs, search results, published proxy lists, business pages, public repositories, and public records, where we or a Customer lawfully instruct the Service to use them.
• Service providers and integrations, such as payment, identity, email, support, proxy, hosting, security, monitoring, geolocation, AI, or CAPTCHA providers.
• Business counterparties and referrals, including Customers, partners, advisers, event organizers, and recruitment sources.
• Authorities or complainants, where they submit a request, report, order, or other information to us.

Where we obtain Personal Data indirectly and act as the controller, we provide the information required by applicable law, subject to any lawful exception and appropriate safeguards. Section 23 provides an additional notice for people whose information appears in Customer Content or a publicly accessible source.

7. How and why we use Personal Data

The following table describes common controller purposes and legal bases. More than one basis may apply depending on the circumstances and jurisdiction.

7.1 Legitimate interests

Where we rely on legitimate interests, those interests may include:

• operating a secure, reliable, auditable, and commercially sustainable Service;
• authenticating users and protecting accounts, infrastructure, Targets, and third parties;
• preventing fraud, abuse, attacks, unauthorized collection, and non-payment;
• understanding and improving product performance using proportionate data;
• administering B2B relationships and responding to communications;
• maintaining a functional and appropriately classified proxy-routing inventory;
• protecting and enforcing contractual and legal rights; and
• creating aggregated or de-identified statistics.

We consider the necessity and proportionality of the processing, reasonable expectations, data sensitivity, likely effects, available safeguards, and rights of affected individuals. You may object to processing based on legitimate interests as described in Section 21.

7.2 Consent

Where processing relies on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully before withdrawal. Refusing or withdrawing optional consent does not prevent use of core Service functions, although a feature that depends on the consent may no longer be available.

7.3 Data required to provide the Service

Some information is necessary to enter into or perform a contract. For example, we need an account identifier and contact method to administer an account, request instructions to execute a job, and billing information for a paid purchase. If required data is not provided, we may be unable to create an account, process a request, complete a transaction, or provide support.

Optional profile, survey, marketing, and non-essential cookie data is not required for core Service access.

8. Customer-controlled collection and Customer responsibilities

RunHarvester provides technical tools. It does not give a Customer a legal right to access a Target or process Personal Data. The Customer remains responsible for the lawfulness of the Customer's purpose, sources, instructions, collection design, and use of results.

Before using the Service to process Personal Data, the Customer must, as applicable:

1. Identify its role. Determine whether the Customer is a controller, joint controller, processor, or another regulated party.
2. Establish a lawful basis. Have a valid basis for each purpose and, for Sensitive Data, an additional lawful condition or exception.
3. Provide transparency. Give Data Subjects required notices, including information required when data is obtained indirectly, unless a lawful exception applies.
4. Assess legitimate interests. Where relying on legitimate interests, document the purpose, necessity, balancing assessment, safeguards, and handling of objections.
5. Perform a DPIA where required. This is especially important for large-scale monitoring, systematic profiling, Sensitive Data, vulnerable people, combining datasets, or other high-risk processing.
6. Minimize collection. Limit Targets, pages, fields, selectors, frequency, retention, and access to what is necessary for the stated purpose.
7. Respect rights and objections. Maintain procedures to locate, correct, delete, restrict, export, or suppress relevant records and to honor valid opt-outs.
8. Maintain accuracy and provenance. Consider source reliability, retrieval date, validation, context, and the risk that web data is outdated, duplicated, misleading, or associated with the wrong person.
9. Respect other applicable rules. Consider access authorization, confidentiality, website terms, robots directives where relevant, intellectual-property and database rights, anti-circumvention rules, communications and marketing law, sector regulation, and contractual restrictions.
10. Secure the data. Use least-privilege access, appropriate encryption, short retention, secure webhook destinations, key rotation, and incident procedures.
11. Control downstream use. Do not use unverified web data to make unfair, discriminatory, unlawful, or solely automated high-impact decisions about individuals.
12. Maintain a processor chain. Where the Customer acts for another controller, ensure that the controller has authorized RunHarvester as a sub-processor and that compatible instructions and transfer safeguards are in place.

Information being publicly accessible does not by itself establish consent, a lawful basis, accuracy, permission to bypass technical restrictions, or freedom from intellectual-property, confidentiality, or other legal obligations.

RunHarvester may use technical and manual controls to identify suspected misuse, and may reject, limit, suspend, or terminate processing that we reasonably believe is unlawful, unauthorized, dangerous, or inconsistent with our Terms. These controls are risk safeguards, not legal approval of any request that is accepted or completed.

9. Sensitive Data and restricted data

The Service is not designed as a default system for collecting or storing Sensitive Data. Unless RunHarvester has expressly agreed otherwise in writing and appropriate legal, contractual, and technical safeguards are in place, Customers must not intentionally submit or instruct the Service to collect:

• passwords, authentication secrets, private keys, payment-card security codes, or stolen credentials;
• health records, genetic data, biometric templates used for identification, or similarly regulated medical information;
• precise location histories, private communications, or non-public intimate information;
• government identifiers, financial-account credentials, or complete payment-card data;
• criminal-offence data, highly sensitive background data, or data used for unlawful surveillance;
• children's data for profiling, advertising, or other high-risk purposes;
• special-category data concerning racial or ethnic origin, political opinions, religion, trade-union membership, health, sex life, or sexual orientation, unless an Article 9 GDPR condition or equivalent legal authorization clearly applies; or
• data subject to a regulatory regime that the applicable agreement does not cover, such as protected health information under HIPAA or cardholder data under PCI DSS.

Incidental appearance of Sensitive Data in a page does not remove the Customer's obligations. Customers should configure selectors, filters, masking, evidence capture, and deletion to avoid or promptly remove unnecessary Sensitive Data. RunHarvester may delete, quarantine, or restrict access to data that presents an unacceptable privacy or security risk.

10. Network routing, Targets, proxies, webhooks, and evidence

10.1 Information disclosed to Targets

To execute a Customer request, the Service necessarily communicates with the selected Target. The Target may receive or observe:

• the egress IP address used for the request;
• request timing, URL, method, DNS and connection metadata;
• user-agent, locale, headers, cookies, body, and other values configured by the Customer or required by the protocol;
• browser and network characteristics; and
• interactions performed by a browser workflow.

The Target may log, combine, retain, or independently use this information under its own terms and privacy practices. RunHarvester cannot control or delete logs held by an independent Target.

10.2 Proxy and network providers

A request routed through a third-party proxy or network provider may disclose to that provider the Customer or RunHarvester connection IP, destination hostname or IP, timing, volume, and other traffic metadata. Depending on the protocol and encryption:

• HTTPS generally protects application content in transit between the client component and the Target, subject to the technical design and any authorized interception configured by the Customer; and
• plain HTTP traffic may be readable or modifiable by intermediary networks and should not carry credentials, private communications, or Sensitive Data.

Customers should use HTTPS Targets and avoid placing secrets or Personal Data in URL query strings, because URLs can appear in logs and intermediary systems.

10.3 Geographic routing and transfers

When a Customer selects a country, region, residential route, or other geographic routing option, the Customer instructs RunHarvester to transmit and process request data through infrastructure associated with that location. The selected route may cause data to be accessed or transmitted outside the Customer's country. Section 18 addresses international-transfer responsibilities.

10.4 Webhooks and Customer-selected destinations

When a Customer configures a webhook, integration, or external storage destination, RunHarvester sends the configured event or result to that destination on the Customer's instruction. The Customer is responsible for:

• selecting an authorized recipient;
• using HTTPS and validating webhook signatures or equivalent authentication;
• protecting any signing secret;
• ensuring an appropriate data-processing and transfer arrangement with the recipient; and
• deleting or securing copies after delivery.

RunHarvester is not responsible for the recipient's independent storage or use after successful delivery.

10.5 Browser session state and evidence

Browser workflow state may contain cookies, local storage, authentication state, or other secrets. One-run session state is designed to be encrypted at rest, not returned through ordinary result APIs, and deleted when the run reaches a terminal status. Customers should provide only the minimum state needed and should not reuse high-value personal sessions where a restricted service account will suffice.

Screenshots, page evidence, traces, and support views may capture Personal Data visible on a page. Evidence links are intended to be tenant-restricted and short-lived or subject to the retention shown in the product or agreement. Customers must configure masking and evidence capture appropriately.

Where a Customer requests assisted troubleshooting or a supported manual challenge-recovery process, authorized RunHarvester personnel may temporarily view relevant page state, evidence, or a controlled browser session. Access is limited to personnel with a business need and is subject to confidentiality and audit controls. Do not use assisted access for pages containing Sensitive Data unless expressly agreed and appropriately safeguarded.

11. AI-assisted features

11.1 When data is sent to an AI provider

RunHarvester may use OpenRouter and one or more downstream model providers to generate or repair extraction recipes or provide another AI-assisted feature. Depending on the feature and configuration, we may transmit:

• field definitions, schema, extraction instructions, and desired output format;
• relevant page excerpts, HTML samples, retrieved values, or error context;
• prompts, previous generated output, and repair feedback; and
• technical metadata needed to route, meter, and troubleshoot the request.

We do not send data to an AI provider merely because a Customer uses a non-AI HTTP, proxy, or browser retrieval feature. AI-provider transmission occurs when an AI-assisted feature is enabled or invoked, or when an enterprise configuration expressly includes it.

11.2 Controller and processor roles for AI features

Where the AI input contains Customer Personal Data, RunHarvester generally processes it as a processor and uses the AI provider as a sub-processor, subject to the DPA and applicable sub-processor terms. The Customer must ensure that its instructions, lawful basis, notices, DPA chain, and international-transfer mechanism cover the AI processing.

11.3 Retention and model training

RunHarvester does not use Customer Content to train a RunHarvester general-purpose AI model for our own benefit unless the Customer has expressly opted in or separately agreed in writing.

Downstream AI providers can have different logging, retention, review, and model-training practices. Provider routing may offer controls that exclude providers which collect data non-transiently or that require zero-data-retention endpoints, but those controls are not necessarily enabled for every model, feature, or account. Unless a product setting, DPA, Subprocessor List, or written enterprise commitment expressly states otherwise, Customers must not assume that every downstream provider offers zero retention or no training.

Customers should not send Personal Data, confidential information, credentials, or Sensitive Data to an AI-assisted feature unless they are authorized to disclose it to the relevant providers and have confirmed the applicable provider policy and contractual setting.

11.4 Output limitations

AI-generated selectors, schemas, recipes, classifications, and extracted values may be inaccurate, incomplete, or unstable. Customers must test and validate generated logic and results before relying on them, especially where data relates to individuals. AI-assisted extraction is not intended to make legal or similarly significant decisions about people.

12. RunHarvester's own proxy endpoint processing

RunHarvester may obtain proxy endpoint information from providers, Customers, public sources, public repositories, search results, or direct reports. We may validate and classify that information to operate routing, measure reliability, prevent abuse, and maintain service security.

Where RunHarvester determines these purposes, we act as controller. The data may include an IP address or hostname, port, protocol, coarse country or network classification, source, status, latency, validation history, and suppression or complaint records. Our typical legal basis is our legitimate interest in operating a reliable and secure proxy-routing service, subject to necessity, proportionality, source quality, expected use, technical opposition, and the rights of affected individuals.

We do not treat publication of an endpoint as proof that every use is authorized. We may remove, block, or suppress an endpoint where we cannot establish an appropriate basis to retain or use it, where the endpoint appears private or compromised, or where a valid objection, security report, or legal request requires action.

A person or organization that controls an endpoint may request review, correction, removal, or suppression by emailing [email protected] with:

• the IP address or hostname and port;
• the requested action and reason;
• a safe method of demonstrating control, such as a temporary DNS record, a response from an administrative address, or another proportionate method we specify; and
• any relevant evidence of unauthorized use.

Do not send a password, private key, full proxy credential, or other secret to prove control. We may retain a minimal suppression record, such as an endpoint hash, address, date, and reason, where necessary to prevent re-ingestion, document compliance, or handle abuse. Removal from RunHarvester does not remove copies held by independent public sources, providers, Customers, or Targets.

13. Cookies and similar technologies

We and our providers may use cookies, local storage, session storage, pixels, tags, SDKs, and similar technologies for:

• secure sessions, authentication, load balancing, fraud prevention, and form protection;
• remembering language, appearance, interface, and consent preferences;
• billing and payment flows;
• error monitoring, performance measurement, and service analytics; and
• marketing measurement or communications, where enabled and legally permitted.

Strictly necessary technologies are used to provide requested functionality and protect the Service. Optional analytics or marketing technologies are used only in accordance with applicable consent requirements and the choices available through our consent interface.

We do not intentionally place complete Customer results, proxy credentials, full API-key values, payment credentials, or unredacted target secrets into analytics events.

You can manage optional categories through the cookie preference control and can also use browser settings to remove or block storage. Blocking essential technologies may prevent sign-in, account security, billing, or dashboard features from working.

Where applicable law requires us to recognize an opt-out preference signal, such as Global Privacy Control, we treat a recognized signal as an opt-out request for the relevant browser or device. Because browser storage and signals can be device- and browser-specific, you may need to repeat choices on another device or after clearing storage.

Our separate Cookie Policy provides additional detail about the cookies and third-party scripts deployed on RunHarvester domains, including their purposes, durations, and available controls.

14. How we disclose Personal Data

We disclose Personal Data only as described below, as instructed by a Customer, with consent, or as otherwise permitted or required by law.

14.1 Service providers and sub-processors

We may engage providers for:

• hosting, compute, databases, object storage, backup, content delivery, and networking;
• proxy routing, residential or datacenter connectivity, IP intelligence, geolocation, and network classification;
• payment processing, tax, invoicing, fraud prevention, and accounting;
• authentication, email delivery, notifications, support, and communications;
• monitoring, logging, error reporting, security, abuse prevention, and incident response;
• AI model routing and model inference;
• CAPTCHA or challenge handling where enabled;
• analytics, consent management, and website performance; and
• professional services, audits, legal advice, and corporate administration.

Providers receive the data reasonably necessary for their role. Where they process Personal Data on our behalf, we require contractual confidentiality, security, data-protection, deletion, and transfer commitments appropriate to the processing.

When RunHarvester acts as a processor, the applicable DPA governs sub-processor authorization, notice of changes, objection rights, and flow-down obligations. We make a current Subprocessor List available through our legal pages, product documentation, applicable contract, or on request. It identifies the providers, purposes, locations, and transfer mechanisms applicable to the production Service or an enterprise account.

14.2 Customer organizations and Authorized Users

Account owners, organization administrators, and Authorized Users may access data according to their permissions. An organization may control the account, content, billing, and access rights associated with a business email or managed workspace. Customers are responsible for granting least-privilege access and removing users who no longer need it.

14.3 Customer-selected Targets, proxies, webhooks, and integrations

We disclose request and result data to Targets, proxy providers, webhook endpoints, and integrations as technically necessary to carry out Customer instructions. Sections 10 and 18 explain related privacy and transfer consequences.

14.4 Independent controllers

Some providers, such as payment services, identity providers, Target operators, and certain professional advisers, may act as independent controllers for their own legal, security, fraud, or service purposes. Their own privacy notices govern that independent processing.

14.5 Legal requirements, safety, and enforcement

We may preserve, access, or disclose information where we reasonably believe it is necessary to:

• comply with applicable law, a binding court order, or valid legal process;
• respond to a regulator, supervisory authority, or law-enforcement request within its lawful authority;
• protect the rights, safety, and security of RunHarvester, Customers, Data Subjects, or others;
• investigate fraud, abuse, attacks, unauthorized access, unlawful collection, or violations of our agreements; or
• establish, exercise, or defend legal claims.

Where legally permitted and appropriate, we may notify the affected Customer before disclosing Customer Content and may direct a requesting authority to the Customer where the Customer is the controller.

14.6 Corporate transactions

If we are involved in a financing, merger, acquisition, restructuring, insolvency, sale of assets, or transfer of all or part of our business, Personal Data may be disclosed under confidentiality and transferred as part of the transaction. The recipient must use Personal Data consistently with this Privacy Policy unless it provides a new notice and obtains any required consent.

14.7 Aggregated and de-identified information

We may create and use aggregated or de-identified information for analytics, capacity planning, security, benchmarking, and product improvement. Where we treat information as de-identified under applicable law, we maintain it in de-identified form and do not attempt to reidentify it except to test de-identification controls or as otherwise permitted by law.

14.8 Sale, sharing, and advertising

We do not sell Customer Content to data brokers. We do not use Customer Content for cross-context behavioural advertising or to build advertising profiles of people appearing in collected pages.

Website analytics or marketing disclosures, if any, are governed by the Cookie Policy and consent interface. Where a disclosure is legally treated as a "sale", "sharing", or targeted-advertising disclosure, we provide and honor the applicable opt-out mechanism, including recognized browser signals where required.

15. Subprocessor transparency

Because the providers used by a technical service can change, we maintain a Subprocessor List identifying the providers currently authorized to process Customer Personal Data. The list states at least:

• provider name;
• processing purpose;
• categories of data involved;
• processing location or relevant transfer destination;
• whether the provider is a processor or independent controller; and
• applicable transfer mechanism or safeguards.

For processor processing, we will provide notice of intended new sub-processors and an opportunity to object where required by the applicable DPA. An objection must be based on reasonable data-protection grounds. The DPA describes the available resolution process.

16. Data retention

We retain Personal Data only for as long as reasonably necessary for the applicable purpose, Customer instruction, contract, security requirement, legal obligation, or legal claim. Different records have different retention periods.

Expiration from RunHarvester does not delete copies already exported, downloaded, sent to a webhook, stored by a Customer, logged by a Target, or held by an independent third party.

We may suspend ordinary deletion when information is subject to a legal hold, binding request, unresolved payment dispute, security investigation, or other lawful preservation duty. Access during a hold is limited to the relevant purpose.

17. Security

We use technical and organizational measures designed to protect Personal Data against unauthorized access, loss, alteration, disclosure, or destruction. Depending on the relevant Service component and deployment, these measures include:

• transport encryption for supported connections;
• authenticated encryption at rest for designated target secrets, headers, cookies, proxy credentials, and ephemeral session material, including AES-256-GCM in relevant components;
• non-reversible HMAC-based API-key verification and constant-time comparison;
• scoped API keys, role and permission checks, verified-account controls, and tenant isolation;
• multi-factor authentication where offered and enabled;
• request validation, payload and concurrency limits, rate limiting, idempotency controls, and audit events;
• URL, DNS, redirect, and browser-routing safeguards intended to reduce server-side request forgery and access to private network resources;
• secret redaction in supported logs, errors, administrative views, and support processes;
• network, proxy, and IP-leak validation controls;
• monitoring, error reporting, security logging, software-security checks, and incident handling;
• role-restricted operational access, confidentiality obligations, and controlled administrative access; and
• lifecycle cleanup, account-deletion processes, and protected backup or recovery arrangements where configured.

Security depends partly on Customer configuration. Customers must:

• keep account credentials, API keys, recovery codes, proxy credentials, webhook signing secrets, and target credentials confidential;
• use separate, least-privilege keys and service accounts;
• rotate credentials after suspected exposure and remove former users promptly;
• validate TLS, webhook signatures, and integration destinations;
• avoid sending secrets through support, URLs, logs, or analytics;
• restrict evidence, exports, and results to authorized recipients; and
• notify us promptly of a suspected compromise.

No internet service, proxy route, browser automation system, or storage method can guarantee absolute security. We therefore cannot promise that unauthorized access or loss will never occur.

Where RunHarvester is a controller, we notify authorities and affected individuals of a Personal Data breach when required by law. Where RunHarvester is a processor, we notify the relevant Customer without undue delay after becoming aware of a breach affecting Customer Personal Data, as further described in the DPA.

18. International transfers

RunHarvester is established in Hungary, in the European Economic Area. Our providers, proxy routes, Targets, integrations, personnel, or Customers may nevertheless process or access Personal Data in other countries.

18.1 Transfers for which RunHarvester is controller

Where we transfer Personal Data from the EEA, United Kingdom, or Switzerland to a country not recognized as providing adequate protection, we use an available lawful mechanism as required, such as:

• the European Commission's Standard Contractual Clauses;
• the UK International Data Transfer Addendum or International Data Transfer Agreement;
• an adequacy decision;
• binding contractual and supplementary technical or organizational safeguards; or
• a statutory derogation in a limited situation where law permits it.

We assess the transfer context and may apply encryption, access controls, data minimization, provider restrictions, or other supplementary measures.

18.2 Customer-instructed transfers

A Customer may instruct RunHarvester to:

• access a Target in another country;
• route through a proxy or region selected by the Customer;
• send data to a Customer-selected webhook, AI model, integration, or storage provider; or
• permit an Authorized User in another country to access Customer Content.

Where the Customer is the controller, the Customer is responsible for determining whether that instruction is a restricted transfer and for establishing the necessary legal mechanism, notices, assessments, and safeguards. RunHarvester implements the instruction subject to the DPA and may refuse a route or recipient that creates an unacceptable legal or security risk.

Unless a written agreement expressly promises a specific data-residency configuration, use of the Service does not guarantee that all processing remains in one country or region.

19. Automated processing and decisions

The Service uses automated systems to:

• authenticate requests and apply permissions, quotas, rate limits, and idempotency;
• select routes or proxies, validate endpoints, retry failed jobs, and classify technical outcomes;
• detect fraud, abuse, compromised credentials, unusual activity, and security threats;
• execute browser workflows, extraction logic, and AI-assisted recipe generation or repair;
• calculate usage, credits, and billing events; and
• prioritize, suspend, or reject requests based on technical or policy signals.

These systems are generally intended to make technical or service-access decisions, not decisions that produce legal or similarly significant effects on an individual. A security or abuse system may temporarily restrict an account or request. A Customer may contact support to request human review of an account-level restriction.

Customers must not rely on RunHarvester output as the sole basis for decisions with legal or similarly significant effects concerning a person-such as employment, housing, credit, insurance, healthcare, education, essential services, law enforcement, or eligibility-without independently satisfying applicable requirements for lawful data, accuracy, notice, human review, fairness, and contestability.

20. Marketing communications

We may send:

• required operational, security, billing, and legal messages that are part of the Service relationship; and
• optional product announcements, educational content, surveys, event invitations, or commercial messages.

You can opt out of optional marketing through the unsubscribe link, account preference, or by contacting us. An objection to direct marketing is honored without requiring you to give a reason. Opting out of marketing does not stop transactional or security messages needed for your account.

We may retain a minimal suppression record to ensure that we respect the opt-out. Customers may not use RunHarvester to send unlawful spam or to build direct-marketing lists without satisfying applicable collection, notice, consent, and objection requirements.

21. Your privacy rights

Depending on your location and the processing, you may have the right to:

• access Personal Data and obtain information about its processing;
• correct inaccurate or incomplete Personal Data;
• delete Personal Data in circumstances provided by law;
• restrict processing;
• receive or port certain Personal Data in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interests, including profiling related to those interests;
• object at any time to direct marketing;
• withdraw consent at any time where consent is the basis;
• request human review where a covered solely automated decision produces legal or similarly significant effects;
• appeal a refusal where applicable U.S. state law provides an appeal right; and
• complain to a competent supervisory or privacy authority.

Rights are not absolute. For example, we may need to retain information to comply with law, protect security, exercise legal claims, respect another person's rights, or complete a transaction requested by you.

21.1 How to submit a request

Email [email protected] with the subject Privacy Request and describe:

• the right you wish to exercise;
• the account, email address, endpoint, request ID, or other information needed to locate the data;
• the jurisdiction relevant to the request, where helpful; and
• whether you are acting for yourself or as an authorized agent.

You may also use available account export, deletion, notification, cookie, or billing controls.

21.2 Verification and response

We may verify identity and authority using information proportionate to the sensitivity of the request. We will not ask for a password, full API key, or unnecessary identity document. An authorized agent may need to provide signed authorization, and we may confirm the request directly with the Data Subject where law permits.

Where the GDPR applies, we normally respond within one month, subject to a lawful extension for complex or numerous requests. Other laws may specify different periods. We do not charge a fee unless a request is manifestly unfounded, excessive, repetitive, or law otherwise permits a fee.

21.3 Requests involving Customer Personal Data

If RunHarvester processes the relevant Personal Data solely as a processor for a Customer, the Customer controls the response. We may:

• direct you to the Customer;
• securely forward the request to the Customer; and
• assist the Customer as required by the DPA and law.

We cannot independently delete or disclose processor data where doing so would conflict with the controller's lawful instructions, another person's rights, or a legal preservation duty.

22. Supervisory authority complaints

You may complain to the supervisory authority in the country where you live, work, or believe an infringement occurred.

RunHarvester's lead Hungarian authority is:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary
Postal address: 1363 Budapest, Pf. 9, Hungary
Email: [email protected]
Telephone: +36 1 391 1400

We encourage you to contact us first so that we can investigate, but you are not required to do so before contacting an authority.

23. Notice for people whose data appears in a public source or Customer Content

You may not have interacted directly with RunHarvester, but information about you may appear in a page, API, document, screenshot, result, or proxy endpoint processed through the Service.

23.1 When a Customer controls the collection

Where a Customer selected the source and purpose, the Customer is normally the controller. RunHarvester processes the information on the Customer's behalf. The Customer is responsible for identifying itself, providing required notice, stating its lawful basis and purpose, and responding to rights requests.

If you do not know which Customer is responsible, contact us with enough non-sensitive information to locate the relevant request. We may not be able to disclose the Customer or data immediately where verification, confidentiality, security, or law prevents it, but we will assess the request and assist as legally required.

23.2 When RunHarvester is controller

RunHarvester may act as controller for limited public-source processing needed for our own proxy inventory, security research, abuse prevention, business contact administration, or legal compliance. The categories, sources, purposes, recipients, legal bases, retention, and rights for that processing are described in Sections 5, 6, 7, 12, 14, 16, and 21.

Where individual notice is required, we provide it within the legally required period. Where direct notice is impossible or would involve disproportionate effort, we assess whether a lawful exception applies and implement appropriate safeguards, which may include this public notice, minimization, source and timestamp records, access restrictions, suppression controls, and a rights channel. We do not assume that a transparency exception applies merely because data was publicly accessible.

23.3 Accuracy and context

Web data may be outdated, copied, incomplete, or detached from its original context. If RunHarvester is controller and you believe information is inaccurate or unlawfully retained, contact us with the source and correction requested. If a Customer is controller, we will route the request as described above.

24. Supplemental U.S. State Privacy Notice

This section applies only to the extent a U.S. state privacy law applies to RunHarvester's controller processing and grants you the relevant right. Terms such as "consumer", "sale", "sharing", "targeted advertising", and "sensitive personal information" have the meanings given by the applicable law.

24.1 Categories processed in the preceding twelve months

Depending on your relationship with us, we may have collected:

1. Identifiers, such as name, business email, account ID, IP address, device identifiers, and online identifiers.
2. Customer-record information, such as contact, billing address, account, and support information.
3. Commercial information, such as purchases, subscriptions, credits, invoices, usage, and payment references.
4. Internet or network activity, such as page interactions, API activity, logs, device data, browser data, and security events.
5. Geolocation information, generally approximate location derived from IP or Customer-selected routing location.
6. Professional or employment information, such as company, title, business relationship, CV, and work history.
7. Audio, visual, or similar information, such as support recordings if separately disclosed, screenshots, or browser evidence.
8. Inferences, such as security-risk, fraud, product-interest, or service-usage classifications.
9. Sensitive Personal Information, such as account login information and Customer Content containing sensitive fields, only as necessary for permitted service, security, or Customer-instructed purposes. We do not use Sensitive Personal Information to infer characteristics for advertising.

Sources, purposes, retention criteria, and recipient categories are described in Sections 6, 7, 14, and 16.

24.2 Sale, sharing, and targeted advertising

We do not sell Customer Content to data brokers and do not use Customer Content for cross-context behavioural advertising. If optional website advertising or analytics activity is treated as sale, sharing, or targeted advertising under applicable law, you may use the cookie preference control, a recognized browser opt-out signal, or a privacy request to opt out.

We do not knowingly sell or share Personal Information of people under 16 for cross-context behavioural advertising.

24.3 U.S. privacy rights

Subject to applicable law and exceptions, you may request:

• confirmation of processing;
• access to categories or specific pieces of Personal Information;
• correction;
• deletion;
• a portable copy;
• opt-out of sale, sharing, targeted advertising, or certain profiling;
• limitation of certain uses or disclosures of Sensitive Personal Information;
• a list of relevant third-party recipient categories, and where required, specific third parties;
• non-discrimination for exercising a privacy right; and
• appeal of a denied request.

Submit requests using Section 21. We may verify the request and may refuse or limit it where an exception applies. We do not discriminate against a person for exercising a privacy right.

24.4 Authorized agents and preference signals

An authorized agent may submit a request where permitted by law, subject to proof of authorization and identity verification. We honor legally required opt-out preference signals for the browser or device that sends them.

24.5 Financial incentives

We do not offer a financial incentive or price difference in exchange for Personal Information unless the terms, value calculation, and opt-in or withdrawal method are separately disclosed as required by law.

25. Children

RunHarvester is a business-oriented technical service and is not directed to children. A person under 18 must not create an account or use the Service without a legally authorized organizational arrangement and any required parental or guardian involvement.

We do not knowingly collect Personal Data directly from children for our own marketing. If you believe a child has provided account data directly to us without proper authorization, contact us so that we can investigate and delete it where required.

Customers must not knowingly use RunHarvester to collect or profile children's Personal Data in violation of law. Collection involving children, education records, behavioural advertising, or other high-risk uses requires a clear lawful basis, age-appropriate transparency, required consent or authorization, strict minimization, and any additional safeguards imposed by law and contract.

26. Recruitment

When you apply for a role or contractor opportunity, we process candidate data to:

• assess qualifications and suitability;
• communicate, schedule interviews, and administer the selection process;
• verify references or background information where lawful and disclosed;
• make and administer an offer; and
• comply with employment, equality, immigration, recordkeeping, and legal obligations.

We may retain candidate data for another opportunity only where permitted by law and, where required, with consent. Do not include unnecessary Sensitive Data, government identifiers, financial details, or confidential information belonging to another employer in an application.

27. Third-party links, documentation, and public features

Our websites and documentation may link to third-party websites, repositories, communities, examples, or services. We do not control their privacy practices. Review their notices before submitting Personal Data.

Information posted in a public community, issue tracker, testimonial, or other public feature may be visible and copied by others. Do not post Customer secrets, Personal Data you are not authorized to disclose, or confidential support information in a public channel.

28. Changes to this Privacy Policy

We may update this Privacy Policy when the Service, providers, legal requirements, or data practices change. We will post the updated version with a new "Last updated" date.

For a material change, we may provide additional notice through the website, dashboard, email, or another appropriate channel before or when the change takes effect. Where consent is legally required for a new purpose, we will request it rather than treating continued use as consent.

Earlier versions may be retained for audit and transparency. The policy in effect when a processing activity occurred remains relevant to that activity, subject to applicable law and contractual terms.

29. Contact us

For privacy, access, correction, deletion, export, objection, suppression, AI-processing, subprocessor, international-transfer, or security questions, contact:

Isentró Kft. - RunHarvester Privacy Contact
1082 Budapest, Corvin sétány 6, 8th floor, unit 4, Hungary
[email protected]

Use the subject Privacy Request or Security Report, as appropriate. Do not include passwords, full API keys, cookies, authorization headers, private keys, payment-card data, or unnecessary Sensitive Data in your initial message.

30. Order of precedence

This Privacy Policy describes RunHarvester's general privacy practices. For Customer Personal Data processed by RunHarvester as a processor:

1. mandatory Applicable Data Protection Law controls;
2. the applicable DPA and its transfer terms control;
3. a negotiated enterprise agreement controls to the extent it provides stricter or more specific protection; and
4. this Privacy Policy applies to the remaining controller processing and general transparency matters.

Nothing in this Privacy Policy limits a non-waivable right or remedy provided by applicable law.