Who is responsible for your data

The data controller for OVISCRAPER is Louis ENGEL, trading as OVISCRAPER, entrepreneur individuel registered in France (SIREN 940 567 605, SIRET 940 567 605 00016), registered office at 1 Place Saint-Antoine, 67200 Strasbourg, France, principal activity 73.11Z (advertising agencies).

For any question about this policy or your personal data, you can write to gestion.exonobis@gmail.com.

What OVISCRAPER does

OVISCRAPER is a website and a companion Chrome extension that let a signed-in user search Google for businesses, identify their websites, analyse the publicly accessible pages of those websites, and extract published professional contact details such as email addresses and phone numbers, in order to organise and export them.

Every search, every website analysed and every export is started deliberately by the user from the extension's own interface. OVISCRAPER does not run in the background outside of a search you launch, and it does not monitor or record your general browsing.

Account data

When you create an OVISCRAPER account we store your email address, first name, optional last name and phone number, a salted hash of your password (never the password itself), your preferred language, and, where you gave it, your record of consent to the Terms of Service, this Privacy Policy and marketing emails (date, version and source of each consent).

Chrome extension authentication data

Signing in to your OVISCRAPER account from the extension sends your email and password once, over HTTPS, to our server; the password is never kept afterwards, neither in the extension nor, as plain text, on our server. The server returns a personal access token, which the extension stores locally in chrome.storage.local together with your first name, plan and quota, so it can recognise you without asking for your password again.

On our server, only a cryptographic hash of that token is stored, together with the device name, the extension version, the browser's user agent and the IP address used when the token was created, and its expiry date. This lets us show your connected devices in Account > Security and revoke a device, or all devices, at any time; a token also expires automatically (60 days by default) and is deleted a few weeks after it expires or is revoked.

Search and scraping data

Some of what the extension produces during a search never leaves your browser: the list of businesses found, their full email addresses and phone numbers, and the raw Google results are kept only in the extension's local session storage (chrome.storage.session) on your device, so the window can display them and you can export them; they are cleared when you close your browser and are never uploaded to OVISCRAPER.

To enforce the Free/Premium limits and to open a usage report ("job"), the extension sends the text of the search(es) you run and the number of pages requested to our API, and, as each business website is analysed, that website's identifying key together with the number of emails and the number of phones found on it (never the email addresses or phone numbers themselves).

On our server we store the search text and page count you requested (so limits can be enforced and you can review your activity), and, for each website analysed, only a one-way cryptographic hash of its identifying key plus the counts of emails and phones found - never the website's full address, its content, or the contact details themselves. Daily totals (searches, pages, websites, emails, phones) are also kept as aggregated statistics.

Billing and subscription data

If you subscribe to the Premium plan, your card details are entered directly on Stripe's own secure Checkout page; OVISCRAPER never receives or stores your full card number, expiry date or security code. Stripe processes that payment information under its own privacy policy.

We keep the identifiers and status Stripe gives us that are necessary to operate your subscription: your Stripe customer and subscription IDs, the price and plan you chose, whether renewal is active, and the date of a failed payment if one occurs. If you fill in billing details for an invoice, we also store the company or billing name, address and VAT number you provided. We do not store any bank or card number.

Affiliate program data (optional)

If you choose to join the OVISCRAPER affiliate program, we additionally collect the bank details needed to pay your commissions: account holder name, IBAN and BIC. This only applies if you request affiliate status; it is not collected from ordinary user accounts.

Technical and security data

We record the IP address and browser user agent associated with security-relevant events, such as creating an extension access token or an administrator action, in order to secure accounts, detect and prevent abuse, and keep an audit trail. OVISCRAPER only reads the IP address of your connections to our server; it does not request your device's GPS or precise location, and the extension has no location permission.

Support requests

If you contact support, whether by email or through a ticket in your account, we keep the subject, category and messages you exchange with our team in order to answer you and keep a record of the conversation.

Why we use your data and our legal bases

We use your data to provide your account and the service you asked for (performance of our contract with you); to secure the platform, prevent abuse of the Free/Premium quotas and investigate incidents (our legitimate interest); to send you product or marketing emails only if you opted in (your consent, which you can withdraw at any time); and to keep the billing and accounting records the law requires us to keep (legal obligation).

Who receives your data

Data is processed by service providers acting on our behalf under their own confidentiality and security commitments: OVH, our hosting provider, hosts the website, the database and the transactional emails sent by the server; and Stripe processes card payments and manages Premium subscriptions when you choose to subscribe.

We never sell your personal data or your browsing/usage data, we never share it with data brokers, and we do not hand it to advertising or marketing platforms. Outside of the service providers above, we only disclose data when the law requires it, to exercise or defend a legal claim, or with your explicit agreement (for example, to look into a specific support request you brought to us).

Chrome extension permissions

activeTab lets the extension read the tab you are actively working in only when you trigger an action from its own interface, such as analysing the page currently open.

tabs lets the extension open, track and close the Google search tab and the business-website tabs it needs while a search you started is running, and detect which Google search page is active.

downloads lets the extension save the result file (CSV/Excel) you export to your computer; the file is generated and saved locally and is never uploaded anywhere by OVISCRAPER.

storage keeps, on your device only, your extension preferences, your authentication state (access token, plan and quota, never your password) and, while a search is running, the businesses found so far so the window can display and export them.

Host permissions to http(s) websites are required because the business websites the extension analyses are discovered dynamically from your own Google searches and cannot be known in advance; they let the extension's background service fetch and read the publicly available pages of those sites so it can look for a published email address or phone number. The extension does not use these permissions to observe your general browsing: it only injects a content script on Google search-result pages to read the results list, and it only fetches a website in the background as part of a search you started.

No remotely hosted code

The extension does not download or execute JavaScript or WebAssembly code from a remote server. It calls our API over HTTPS and only receives structured JSON data (your account status, quota, search results); that data is never executed as code.

International transfers

OVH, our hosting provider, hosts our website, database and files in the European Union. Stripe is used for payment processing and may process data in other jurisdictions, including the United States, under the safeguards it applies to its own processing (such as standard contractual clauses), as described in Stripe's own privacy policy. We do not use any other provider that would transfer your personal data outside the European Economic Area.

How long we keep it

Your account data is kept for as long as your account is active. If you request deletion from Account > Privacy, we verify your password, then, once processed, your name, email, phone number and password are permanently replaced with anonymous values and your billing profile, active sessions and pending tokens are deleted; a deletion request can be cancelled at any time before it is processed.

After anonymisation, aggregated and technical records tied to the anonymised account (such as usage statistics, invoices and the security/audit log) may be kept for the period necessary to meet our legal, accounting and dispute-defence obligations.

Extension access tokens expire automatically (60 days of validity by default) and are permanently deleted about a month after they expire or are revoked. Password-reset and email-verification links are valid for a short time and are deleted automatically shortly after they expire or are used.

Your rights

You have the right to access, correct, delete and obtain a copy of your personal data, to have its processing limited, to object to it, and to withdraw your consent at any time, without it affecting the lawfulness of processing carried out before the withdrawal.

From Account > Privacy you can download an instant export of your personal data (JSON file) and request the deletion of your account; you can also change your marketing consent from the same page.

You can exercise any of these rights, or ask a question about this policy, by writing to gestion.exonobis@gmail.com. If you believe your rights are not being respected, you can also lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority (www.cnil.fr).

Security

Passwords are stored only as salted hashes (password_hash), never in plain text; extension tokens are stored only as cryptographic hashes and can be revoked individually or all at once from Account > Security; connections to our website, our API and Stripe use HTTPS; and administrative actions on accounts are logged.

Cookies

The website uses cookies and similar technologies as described in our dedicated Cookie Policy, available from the footer of every page. This Privacy Policy does not replace that policy.

Chrome Web Store User Data / Limited Use

OVISCRAPER's use and transfer of information received from the Chrome extension's permissions adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

Data handled by the extension is used only to provide, maintain, secure or improve the extension's disclosed core functionality: helping you find business websites and their published email addresses and phone numbers from your own Google searches. Browsing-related data is processed only to the extent needed for that visible, user-initiated workflow.

We never sell your personal data or your browsing data, and we never transfer it to advertising platforms, data brokers or other information resellers. We never use it for personalised or interest-based advertising, retargeting, advertising-related profiling, creditworthiness assessment, or lending.

Any transfer of data to a third party is limited to providing or improving the service (our hosting and payment providers), securing the platform and preventing abuse, complying with a legal obligation, or a transfer you have explicitly approved (for example, a support request you bring to us).

Human access to your data is restricted to what is necessary and authorised: to answer a support request you have raised, to investigate a security incident or a suspected abuse, to comply with a legal obligation, or on aggregated/anonymised data used for the internal operation of the service. Staff access to identifiable account data is limited to the team members who need it for these purposes.

Changes to this policy

We may update this Privacy Policy as the service evolves. The date at the top of this page indicates the latest revision. We encourage you to review it from time to time.