Privacy notice

Who is responsible

The controller for personal data on Pullwire is:

Saas Labs LLC
1309 Coffeen Avenue
Sheridan, WY 82801
United States

Email: hello@pullwire.dev. Write to this address for anything in this notice.

When you use the website

Our hosting provider (Vercel) receives the usual request data every website gets: IP address, time, page, browser and referrer. It needs this to deliver pages and to fend off attacks. Our own code only stores a keyed fingerprint (HMAC) of your IP address where we limit free use, for example the try-it boxes and the sign-in form; those counters are deleted after about two days.

We do not use advertising or tracking cookies. When you are signed in, one essential cookie keeps your session. If we switch on product analytics (PostHog, EU region) it runs without cookies or local storage and without session recordings; error reports (Sentry) leave out cookies, request bodies and API keys.

Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Your account

• Sign-in: your email address. We send sign-in links through Resend. If you sign in with Google or GitHub, we receive the email address and the name that account shares.
• API keys: we store only a hash of each key, never the key itself.
• Runs: which tool you ran, with which input, the results, the credits used and when. We need this to deliver results to you, to bill credits correctly and to fix errors.
• Payments: when you buy credits, Stripe handles the payment. We never see your full card number; we keep what an invoice needs (name, address, amount, date).

Legal basis: the contract with you (Art. 6(1)(b) GDPR); for invoices also our legal duties (Art. 6(1)(c)). We keep account data while your account exists. When you ask us to delete your account, we delete it and your runs; invoices stay as long as tax law requires.

Data our tools fetch for you

Our tools read public web pages on your request. You decide what to fetch and what to do with the results, so for any personal data in those results you are the controller and we process it on your behalf. Results stay in your account until you delete them or close the account. Email addresses and domains on our do-not-contact list are removed from the contact fields of every result we deliver, including when you reopen or export an older run. Dataset files saved before the opt-out and free text, such as the content of a scraped page, are not rewritten.

B2B outreach

We sometimes email people at companies who could use Pullwire. For that we use business contact details that are publicly available, for example on a company website or in a public business directory: name, work email, company, role and the company website. We write only about our product, only to work addresses, and never buy lists of private contacts.

Legal basis: our legitimate interest in telling businesses about a service that fits their work (Art. 6(1)(f) GDPR). You can object at any time and without giving a reason: use the opt-out page or reply “stop” to any of our emails. We then put your address (or, if you ask, your whole domain) on a do-not-contact list. That list holds only the address or domain and the date, and we keep it so we never contact you again.

We delete outreach contact data at the latest 12 months after our last email, unless you reply and we stay in touch, or you become a customer.

Who helps us

These providers process data for us under data processing agreements:

• Supabase: database and sign-in, hosted in Frankfurt, Germany (eu-central-1).
• Vercel: hosting and delivery of the website and API.
• Resend: sending sign-in and service emails.
• Stripe: payments.
• Sentry and PostHog (EU region): error reports and product analytics, when switched on.
• Google and GitHub: only if you choose to sign in with them.

Some of these companies are based in the USA, and Pullwire’s operator is a US company. Where personal data leaves the EU or UK, we rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission’s standard contractual clauses otherwise.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, and to receive it in a common format. You can object to any processing based on legitimate interest, and you can withdraw a consent at any time. Write to hello@pullwire.dev; we answer within one month. You can also complain to a data protection authority, for example the one where you live or work.

Changes

When we change how we handle data, we update this page and the date at the top. If a change affects your account in a meaningful way, we tell you by email first.