Privacy Policy
This policy explains what personal data Cdpfleet LLC ("cdpfleet", "we", "us") processes when you visit cdpfleet.com, join our waitlist, or use the cdpfleet service, and what rights you have. cdpfleet is available to businesses and to individuals aged 18 or over.
1. Who is responsible
The controller of your personal data is:
Cdpfleet LLCEmail: [email protected]
For any privacy question or request, write to [email protected].
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Website visits: IP address, browser user agent, requested page, time | Delivering the website, security, preventing abuse | Legitimate interests (Art. 6(1)(f)) |
| Waitlist: the email address you enter, which form you used, and when | Inviting you when access opens | Consent (Art. 6(1)(a)); you can withdraw it at any time |
| Account: name and business email of the account contact, API key fingerprints (we store only a one-way hash, never the key), subscription details | Providing the service and support | Contract (Art. 6(1)(b)) |
| Usage records: session IDs, start and end times, browser type, the server that ran the session, data volume, the reason a session ended, and per session the destination hostnames your browser connected to through the proxy layer, with byte and connection counts and which proxy or rule carried them | Metering and billing (including the cdpfleet residential proxy, billed by traffic), enforcing plan limits and acceptable use, abuse prevention, statistics shown to you | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Billing: company name, billing address, tax ID, payment status. Card details are handled by Stripe; we never see or store them | Invoicing and payment | Contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) |
| Community plan card verification: from Stripe, a fingerprint that identifies the card without revealing its number, the card brand and issuing country, and the time of verification | Making sure each customer and each card holds only one free Community account; preventing fraud and abuse | Legitimate interests (Art. 6(1)(f)); contract (Art. 6(1)(b)) |
| Community plan request data: for sessions on the free Community plan, the websites and pages accessed, the browser, version and launch options, request and response metadata (such as status codes, headers and timing), and whether pages loaded or were blocked or challenged by bot protection | Understanding which browser configurations work on which websites, including by training and evaluating machine-learning models, and improving the service (see section 4A of our Terms) | Contract (Art. 6(1)(b)), as the condition of the free plan; legitimate interests (Art. 6(1)(f)) |
| Website analytics: pages you visit on cdpfleet.com, referrer, device and browser type, approximate location (from your IP address, which Google doesn't store), and an analytics cookie ID | Understanding how the website and documentation are used, to improve them | In the EEA, the UK and Switzerland: consent (Art. 6(1)(a)), asked for before any analytics cookie is set. Elsewhere: legitimate interests (Art. 6(1)(f)); you can opt out any time |
| Correspondence: emails you send us | Answering you | Legitimate interests (Art. 6(1)(f)) or contract |
Browser session content and recordings
The browsers you run on cdpfleet load whatever pages your code directs them to. We don't routinely inspect the pages your sessions load or the data your code sends and receives. We do record sessions as video so you can replay them: headful sessions from their display, and headless sessions you launched with "cdp": true or "live_view": true, within your recording limits, unless you launch with "record": false. A recording shows whatever the browser displayed, which can include personal data on the visited pages. Recordings are stored privately in our object storage (Hetzner, Germany), available only to your account, and deleted automatically after your retention period (7 days on the free tier, up to 30 days on a recording plan) or when your account's recording minutes are used up, oldest first. You can delete any recording at once. Our staff may watch a running session (view only, never taking control) or play its recording when you ask for support, to troubleshoot a fault in the service, or to investigate suspected abuse; each such access is logged. You decide what your sessions process and are responsible for doing so lawfully. Where your sessions process personal data on your behalf, we act as your processor; a data processing agreement is available on request.
Community plan. Sessions on the free Community plan aren't recorded. We do collect the request data described in the table above, which can incidentally include personal data contained in the addresses or responses of the pages accessed; our Terms forbid using Community sessions to sign in to accounts or to process personal data, and we minimize, de-identify or aggregate the data we keep.
Cookies and analytics
We use Google Analytics on our website, documentation and dashboard to see which pages are visited and how. It sets the cookies _ga and _ga_<id>, which hold a random ID and last up to two years.
- In the EEA, the UK and Switzerland no analytics cookie is set unless you click Accept on our banner. Until then, and if you decline, Google receives only cookieless signals without an identifier.
- Elsewhere analytics is on by default; you can turn it off at any time.
Change your choice at any time: Cookie settings (also linked at the bottom of every page). Your choice is remembered in your browser's local storage. We don't use advertising cookies, and analytics data is not used for ads.
Signing in to the dashboard uses cookies set by our sign-in provider, Clerk, which are necessary to keep you signed in. Fonts are served from our own servers. The admin console used by our staff keeps its sign-in only in the browser's session storage.
3. Who we share data with
We don't sell personal data or share it for advertising. We use these service providers, who process data only on our instructions:
| Provider | What for | Location |
|---|---|---|
| Cloudflare, Inc. | DNS, content delivery and attack protection for cdpfleet.com | Global network; USA |
| Hetzner Online GmbH | Servers that run cdpfleet, its database, and object storage for session recordings | Germany, Finland |
| Stripe, Inc. and its affiliates | Payment processing, once you subscribe | USA, EU |
| Clerk, Inc. | Sign-in and account authentication for the dashboard | USA |
| Google LLC / Google Ireland Limited | Website analytics (Google Analytics) | USA, EU |
| Residential proxy network provider | Carries the traffic of sessions that use the cdpfleet residential proxy, through residential connections in the country you choose. It receives that traffic and the exit-targeting options, not your account details. | Global; the exit country you choose |
We may also disclose data where the law requires it, or to protect our rights and the security of the service. If the cdpfleet residential proxy is misused (see section 7 of our Terms), we may share the relevant session records — times, destination hostnames and traffic volumes — with the proxy network provider and with law enforcement.
4. International transfers
Cdpfleet LLC is based in the United States, and some providers above process data there. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to the United States or other countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) or on the recipient's certification under the EU–U.S. Data Privacy Framework.
5. How long we keep data
- Server logs (including IP addresses): up to 35 days.
- Website analytics: for the retention period set in our Google Analytics account, at most 14 months.
- Waitlist entries: until you're invited and have either signed up or not responded for 12 months, or until you ask us to delete yours.
- Per-session usage records: 3 full months after the month in which the session ran. Daily usage totals are kept for as long as your account exists.
- Session recordings: 7 days on the free tier, up to 30 days on a recording plan, and fewer if your account's recording minutes fill up (oldest deleted first).
- Community plan request data: up to 24 months in a form linked to your account; after that, or when your account ends, only in de-identified or aggregated form (including in trained models).
- Community card fingerprint: for as long as your account exists and up to 24 months after it ends, to prevent repeated free accounts.
- Account data: for as long as your account exists, then deleted within 90 days, unless we must keep it longer.
- Billing records: as long as tax and accounting laws require, typically up to 10 years.
- Database backups: overwritten on a rolling basis within 7 days.
6. Security
Traffic to our websites and APIs is encrypted with TLS. API keys are stored only as one-way hashes. Access to our servers is restricted to key-based administrator access, and network access to internal services is limited by firewalls.
7. Your rights
Depending on where you live, you have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting earlier processing. Residents of California and other US states with privacy laws have the right to know what we collect, to request deletion or correction, and not to be discriminated against for exercising these rights. We don't sell or share personal data as those laws define it.
To exercise any right, email [email protected]. We'll answer within one month, and may need to verify your identity first. If you're in the EEA, the UK or Switzerland, you can also complain to your local data protection authority.
8. Children
cdpfleet isn't directed at children and requires users to be at least 18. We don't knowingly collect data from anyone under 16.
9. Changes
We'll post changes to this policy on this page and update the date at the top. If a change materially affects how we use personal data we already hold, we'll tell account holders by email before it takes effect.