Privacy

Intercrawl is operated by Searithm Technology, which is responsible for the data described on this page. Searithm Technology (registration no. 202603272097 (MA0353343-T)) is a business registered in Malaysia, at Executive Suite 2, Level 3, Wisma Suria, Jalan Teknokrat 6, Cyber 5, 63000 Cyberjaya, Selangor, Malaysia.

When Intercrawl processes personal data that is part of your sites, or of the requests it handles for them, it does so on your behalf: you decide what is processed, and our Data Processing Agreement applies. This page describes the data Intercrawl holds for itself: about you, your account and how Intercrawl is used.

The free parity scan reads a site you point it at: its robots.txt, sitemap and up to 100 public pages, fetched or rendered as a human visitor, Googlebot, GPTBot and ClaudeBot would see them. Intercrawl stores the resulting page text, word and link counts, one screenshot per page (the human view), and the raw HTML of every view. If someone signed in asks to see what a crawler received as a picture, that picture is stored with the scan. A scan is not tied to an account. A random, unguessable link identifies it.

If you create an account, Intercrawl stores your name, your email address, the sites you add, and when you accepted the Terms of Service. If you give them, it also stores your company name and your role (both optional, and you can change or remove them in your account settings). For each API token you create, only a one-way hash of it and its first characters are stored. Your password is never stored as you wrote it: only a one-way hash of it is kept. When you set or change a password, it is checked against a public list of passwords exposed in data breaches by sending only the first five characters of a one-way hash of it, never the password itself.

If you sign in with Google, Intercrawl receives your name and email address from Google, and Google’s confirmation that the address is verified. Intercrawl does not store your Google profile picture and gets no access to anything else in your Google account. Google account data is used only to create your account and sign you in. It is not sold or shared with anyone else.

If you connect a site to Vercel, Intercrawl stores the Vercel project’s ID and name, its team ID, the ID of the routing rule it added, and the connection’s API token as above; it never stores a Vercel sign-in or access token. If you connect a site to Cloudflare, Intercrawl stores the zone’s name, the name of the Worker it added, the hostnames it routes, and the connection’s API token as above; the access you approve on Cloudflare is used once and given back, and is never stored.

Serving: when a crawler asks for one of your pages, Intercrawl keeps a rendered copy of the page for up to 30 days, so the next crawler can be answered at once. The crawler’s user agent and IP address are checked as the request is answered and are not stored. Intercrawl keeps no log of these requests: for each site and day it stores only counts (renders, cached answers, fallbacks, and how many crawler requests were verified, unverified or spoofed).

DNS mode: if you point a hostname at Intercrawl, every request to it passes through Intercrawl’s edge. A visitor’s request is passed on to your site and nothing about it is stored; a crawler’s request is handled as above. Intercrawl stores the hostname and your site’s address.

Audits: each daily audit of your site stores the same kinds of data as a free scan, for 30 days. Each audit also leaves a summary used for monthly reports: counts only (pages checked, matching, needing attention, blocked, and per crawler how many pages it could read and how many matched), with no page address, title or content. Summaries are kept for as long as the site is in your account.

Alerts: Intercrawl stores the channels you turn on, including a Slack webhook address and your own webhook address, until you change them or remove the site. Each alert sent is recorded with its channel, time and outcome; records of an audit’s alerts are deleted with the audit after 30 days, records of test alerts with the site.

Reports: a report share link lets anyone who has it open that one report without signing in; you can set it to expire and can revoke it at any time, and only a fingerprint of the link is stored. A report PDF is kept for up to 30 days so the same report is not made twice.

Crawler policy: Intercrawl stores your draft policy and what was last applied. The access you approve on Cloudflare to apply it is used once and given back, and is never stored.

Share cards: Intercrawl stores your card template and, if you upload one, your logo, redrawn as a new image (the file you upload is not kept). Cards are kept for up to 30 days and made again when needed.

Without an account, the only personal data Intercrawl collects is a work email address, if you ask for a trial on a results page. That address is stored to follow up about the trial and is kept for 12 months, or deleted sooner on request. Intercrawl also stores a salted, one-way hash of the IP address behind a scan, a trial request, a sign-in, a sign-up or a password reset, used only to apply rate limits. Raw IP addresses are never stored.

Account emails (confirming your address, resetting your password, confirming a change of email address) are sent from no-reply@intercrawl.com, and alerts you turn on from alerts@intercrawl.com to your account’s own address, through our email delivery providers, Resend and, if it is unavailable, Cloudflare. They contain no tracking pixels and no tracked links.

Scan data and account data are stored in the United States, and scans and requests are processed on Cloudflare’s global network as they run. Results pages default to unlisted: reachable only with their link, marked noindex so search engines are asked not to index them, and excluded from Intercrawl’s own sitemap. A scan’s creator may make it public or delete it; deleting a scan removes its stored data. Every scan and audit is deleted automatically 30 days after it runs, with its screenshots, pictures and raw HTML.

Account data is kept until you delete your account in its settings, which removes your name, email address, company name, role, sign-in methods, sites, API tokens, connections, alert settings, policies, card templates and logos, audit summaries and report share links. A record that a scan ran or that an account was created or deleted (the domain scanned or the sign-in method, and the date, with no page content, name or email address) is kept afterward in aggregate usage counts.

If a site was connected to Vercel, the routing rule Intercrawl added stays in your Vercel project until you remove it there, also after a disconnect, the site’s removal or the account’s deletion. Until then a one-way hash of the connection’s token and a one-way hash of the site’s domain are kept, so crawlers that rule sends get your site’s own pages and never an error. Both are deleted when you confirm on the Sites page that the rule is removed, or once the rule has gone unused for 30 days.

Intercrawl stores data in the United States and runs on a global network, so your data may be processed outside your own country. Where the law requires a safeguard for such transfers (for example from the European Union or the United Kingdom), we rely on our providers’ standard contractual clauses, and on the clauses in our Data Processing Agreement for data we process on your behalf.

Intercrawl does not sell personal data, does not use scanned page content for anything other than providing Intercrawl to you, and does not place tracking cookies. Site traffic is measured with Cloudflare Web Analytics, which is cookieless and does not track individual visitors: it reports aggregate visit statistics only. A cookie on a results page holds a deletion token for the scan that created it, so only that browser can delete or change the visibility of that scan. When you sign in, cookies keep you signed in; they are removed when you sign out. The scan, sign-up and sign-in forms are protected by Cloudflare Turnstile, which checks that a person is using them.

Intercrawl uses these service providers to run the service:

You can ask to see the personal data Intercrawl holds about you, to have it corrected or deleted, to receive a copy of it, or to object to how it is used. Write to hello@intercrawl.com; we reply within 21 days. Most of it you can also change or delete yourself in your account settings. These rights come from the law where you live, such as Malaysia’s Personal Data Protection Act 2010, the EU and UK GDPR, or US state privacy laws, and you may also complain to your data protection authority.

All traffic to Intercrawl is encrypted. Passwords, API tokens and share links are stored only as one-way hashes, every database table allows each account to read only its own rows, and the service keys that reach the database are held only by Intercrawl’s servers. If a breach affects your personal data, we will tell you without undue delay.

We may update this page. If a change is material, we will tell account holders by email or in Intercrawl before it takes effect. The date at the top shows when it last changed.