01Overview
HypeLabs, LLC operates Hypedata, a web data extraction service. We take privacy seriously: we collect the minimum data necessary to provide the Service, we do not sell personal data, and we support the rights granted to you by the GDPR (EU), UK GDPR, California’s CCPA/CPRA, Brazil’s LGPD, Canada’s PIPEDA, and equivalent laws worldwide.
This Policy covers two distinct roles we play:
- As controller, when we process personal data of our website visitors, account holders, billing contacts, and prospects.
- As processor, when Customers use the Service to process personal data they have chosen to extract. In that case the Customer is the controller, and our obligations are set out in the Data Processing Agreement.
02Who we are
The data controller is:
03Data we collect
3.1 — Account data
When you create an account we collect your name, business email address, company name, country, and role. If you use single-sign-on, we receive your provider identifier and the email associated with it.
3.2 — Billing data
For paid plans we collect a billing address, VAT/tax ID where applicable, and partial payment method data (last four digits, card brand, expiration). Full card data is handled by our PCI-DSS compliant payment processor and never reaches our servers.
3.3 — Usage & technical data
When you interact with the Service, we collect: API request metadata (timestamps, endpoint, response code, proxy type used, target hostname, credit cost), IP address of the calling machine, SDK version, dashboard clicks, and session identifiers. We use these to operate, secure, and improve the Service.
3.4 — Website data
When you visit hypedata.io we collect standard server logs (IP, user-agent, referrer, pages visited, timestamp) and privacy-friendly analytics that do not rely on cross-site tracking cookies.
3.5 — Communications
Emails you send to us, chat transcripts, and call records related to support or sales.
Content returned by the Service (the target website’s HTML, JSON, or parsed data) is not stored by us beyond the response life-cycle, unless you explicitly enable caching or snapshot features. When such content contains personal data, we act as processor under the DPA, not as controller.
04How we use data
- Provide the Service — authenticate you, route requests, bill usage, deliver support.
- Secure the Service — detect abuse, mitigate fraud, prevent credential stuffing and account takeover.
- Communicate — transactional emails (receipts, security alerts, material changes) and, with consent, product updates and educational content.
- Improve the Service — analyse aggregate usage, debug performance issues, tune anti-bot strategies.
- Comply with law — keep accounting records, respond to lawful legal process, meet export-control and sanctions obligations.
We do not use personal data to train third-party foundation models. We do not sell personal data. We do not share personal data for cross-context behavioural advertising within the meaning of the CPRA.
05Legal bases (GDPR)
Where the GDPR or UK GDPR applies, we rely on the following legal bases:
| Processing | Basis |
|---|---|
| Creating and operating your account | Contract (Art. 6(1)(b)) |
| Billing and accounting records | Legal obligation (Art. 6(1)(c)) |
| Security, fraud prevention, product analytics | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails | Consent (Art. 6(1)(a)) |
| Responses to law enforcement requests | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may request a copy of the balancing test by contacting privacy@hypelabs.llc.
07International transfers
HypeLabs is based in the United States, and certain sub-processors operate globally. When we transfer personal data outside the European Economic Area, the UK, or Switzerland, we rely on:
- the European Commission’s Standard Contractual Clauses (2021/914) and the UK IDTA or Addendum, supplemented by technical and organizational measures commensurate with the risk;
- adequacy decisions, where available;
- your explicit consent, where no other basis applies.
A copy of the SCCs or equivalent transfer instrument is available on request.
08Retention
| Category | Retention |
|---|---|
| Account profile | Duration of contract + 90 days |
| Billing & invoices | 7 years (US federal & state tax) |
| API request metadata & logs | 90 days |
| Security & audit logs | 12 months |
| Scraped content (responses) | Not retained (processed in memory, streamed to Customer) |
| Support correspondence | 3 years from last message |
| Marketing contact lists | Until consent is withdrawn |
09Your rights
Subject to applicable law, you have the right to:
- Access your personal data and receive a copy of it.
- Rectify inaccurate or incomplete data.
- Erase data (subject to legal retention obligations).
- Restrict or object to processing based on legitimate interests.
- Port your data to another controller in a commonly used format.
- Withdraw consent at any time, without affecting prior lawful processing.
- Not be subject to solely-automated decisions with legal or similarly significant effects. Hypedata does not make such decisions.
To exercise any right, email privacy@hypelabs.llc. We will respond within thirty (30) days. If you are unhappy with our response, you may lodge a complaint with your supervisory authority (e.g. the CNIL in France, the ICO in the UK, the LfDI in Germany).
California residents have additional rights under the CCPA/CPRA, including the right to know categories of data collected, the right to delete, the right to correct, and the right to limit the use of sensitive personal information. We do not sell or share personal data as defined under the CPRA.
11Children
The Service is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@hypelabs.llc and we will delete it.
12Security
We protect personal data with technical and organizational measures described in our Security Statement, including encryption at rest (AES-256) and in transit (TLS 1.3), least-privilege access controls, MFA for all staff, continuous vulnerability scanning, and incident response procedures. No system is perfectly secure; where a breach affecting your personal data occurs, we will notify affected users and regulators as required by law.
13Changes to this Policy
We may update this Policy as our practices or legal obligations evolve. We will post the revised version with an updated “Effective” date. Material changes will be notified by email at least 30 days before they take effect.
14Contact
For any privacy question, request, or complaint:
Sheridan, WY 82801 · United States
privacy@hypelabs.llc