Privacy policy

It covers the hosted SarvCrawl service at this site, its API, the SDKs and CLI, the MCP server and the console.

It does not cover:

• a self-hosted deployment of the open-source stack — nothing in it reaches us, so there is nothing here for us to describe (see self-hosted deployments);
• sites the crawler fetches on your instruction, which have their own policies; or
• other Sarv products, which publish their own.

Account data

What you give us to have an account, and what the account needs to work:

• Your email address, and your name if you give one.
• A password, stored only as a one-way hash. We never hold the password itself.
• Where you sign in with Google or GitHub, the provider's stable account identifier plus the email and display name they release. We use the numeric or opaque identifier as the join key rather than the email, because an email on those accounts can change.
• Your organisation, and your role in it — admin or user, or super admin for our own platform operators.
• Whether the account is active, and when it last signed in.

Session and key data

• One record per live login: when it started, when it was last seen, when it expires, and the IP address and user-agent string it was created from. That is what makes "why am I signed out?" and "what devices are signed in?" answerable, and it is what lets you end one session without ending all of them.
• For each API key: the label you gave it, the first twelve characters for masked display, a SHA-256 hash of the key, its status, and when it was last used. The key itself is not stored and cannot be recovered.

Usage data

• The jobs you run: type, target URL or file, the bounds you set, status, timings, per-job worker logs, and the token count consumed.
• API request metadata — route, timestamp, status, which key was used — kept for rate limiting, abuse investigation and your own usage charts.
• Server logs from the stack's own components, which include IP addresses.

Content you ingest

The pages and files you submit, the markdown they are converted to, the chunks, the embeddings and the conversion audit scores. This is covered separately under content you ingest because our role in it is different.

Communications

• What you send us — support requests, security reports, enquiries — and our replies.

Running the Service

Authenticating you, authorising what you can reach, queueing and executing jobs, returning search results. Legal basis: performance of our contract with you.

Metering

Counting the tokens the pipeline consumes, showing you your usage, and enforcing an allowance. Legal basis: contract.

Security and abuse prevention

Detecting credential stuffing, rate-limit evasion, abusive crawl patterns and compromised keys. Legal basis: legitimate interests — keeping the Service and third-party sites safe.

Support

Answering your questions, which sometimes means reading the job or log you are asking about. Legal basis: contract.

Service notices

Telling you about an incident, a breaking change or a change to these documents. Legal basis: contract and legal obligation.

Improving the Service

Aggregate, non-identifying analysis of what fails and where — which parsers stumble, which queues back up. Legal basis: legitimate interests. Never your content, and never anything that identifies a person.

Legal compliance

Meeting tax, accounting and other statutory obligations, and responding to lawful requests. Legal basis: legal obligation.

• We do not train models on your data. Not on your content, not on your queries, not on your usage. There is no training or fine-tuning step anywhere in the pipeline — it is retrieval end to end: crawl, parse, chunk, embed, search.
• We do not sell personal data, and we do not share it for cross-context behavioural advertising.
• We do not run advertising or third-party trackers on the product, and this site sets no analytics cookie.
• We do not read your corpus for our own purposes. Access to production content is restricted, logged, and happens only to fix a fault or answer a support request you raised.

When you crawl a site or upload a file, we process whatever it contains — and that can include personal data about people who are not our users and have never heard of us.

For that content you are the controller and we are your processor. In practice:

• We process it only on your instruction, for the purpose of running the Service for you.
• You are responsible for having a lawful basis to have it processed, and for answering a data-subject request about it — you hold the context we do not.
• You confirm you may lawfully fetch every source you submit. That obligation is set out in the terms of service.
• Deleting a knowledge base or a job deletes its rows, its stored objects and its search index entries.
• We will pass on any request or complaint that reaches us about content in your corpus rather than acting on it ourselves, unless the law requires otherwise.

If you are processing personal data at any scale, ask us for a data processing agreement at sales@sarv.com. Where one is signed, it governs this relationship.

The vendor list is short because most of the stack is ours: PostgreSQL, Redis, RabbitMQ, MinIO and Elasticsearch all run on infrastructure we operate, not a managed third-party data service.

Sign-in providers — Google, GitHub

Only where you choose to sign in with one. They tell us an account identifier, an email and a display name; we tell them nothing about your use of SarvCrawl. Both are optional and disabled unless credentials are configured.

Hosting and network providers

The operators of the infrastructure the Service runs on, who necessarily handle traffic in transit and data at rest on their hardware.

Email delivery

To send the transactional mail the account needs — verification, password reset, security notices.

Professional advisers

Auditors and lawyers, under a duty of confidence, where we need advice.

Authorities

Where a valid legal request compels it. We check that a request is lawful and no broader than it claims to be, and we will tell you unless we are prohibited from doing so.

An acquirer

If the business is merged, acquired or sold, data may transfer as part of it — under this policy, and with notice to you.

Every vendor with access is bound by contract to process data only on our instructions and to protect it. If we add a vendor with meaningful access to your data, we will update this page.

The hosted Service runs on infrastructure in India. Where a vendor or a sign-in provider operates elsewhere, data reaching them may be processed outside India — see international transfers.

Account data

For as long as the account exists. On closure, deletion begins after a 30-day window in which you can still export — start that with delete your account.

Content and derived artefacts

Until you delete them, or until the account closes. Deleting a knowledge base or job removes its rows, objects and index entries.

Session records

Until the session expires or is revoked, then a short period for security review.

API key records

While the key exists; revoked keys keep their metadata as an audit trail, without the key.

Job and usage records

Retained while the account exists, because they are your usage history and our billing record.

Server logs

A rolling window measured in weeks, then discarded.

Backups

Age out on their own cycle after a deletion, so a deleted item can persist in a backup briefly before it is overwritten.

Records the law requires us to keep

For the statutory period, whatever else this table says.

• Traffic is encrypted in transit with TLS.
• Passwords are stored only as one-way hashes. API keys are stored only as SHA-256 hashes.
• Sessions and keys are independently revocable, and a role change, deactivation or password reset invalidates every outstanding token for that user on its next use.
• With no signing key configured, authentication returns an error rather than issuing a guessable token. Sign-in providers are off unless configured, rather than falling back to something weaker.
• Outbound fetching blocks private, link-local and cloud-metadata address ranges, so a submitted URL cannot be turned against internal infrastructure.
• Access to production data is restricted to the people who need it, and internal data services are not reachable from the internet.
• Roles are enforced at the API, not only hidden in the interface.

No system is perfectly secure. Where a breach is likely to result in a risk to your rights, we will notify you and the relevant authority within the time the law requires. If you find a vulnerability, report it privately to sales@sarv.com — good-faith research that follows our security policy is welcome and will not be met with legal action.

Wherever you are, we will honour the following for your account data. For content in a customer's corpus, the request belongs with that customer as controller — we will forward it.

• Access — a copy of what we hold about you.
• Correction — fix anything inaccurate or incomplete.
• Deletion — erase it, where we have no overriding legal reason to keep it. To close your account outright, use delete your account: it confirms by email and then runs on its own, so it does not depend on us answering a message.
• Portability — receive it in a machine-readable form. Your corpus exports to JSONL or CSV from the console at any time, without asking us.
• Restriction and objection — pause or object to a particular use, including anything resting on legitimate interests.
• Withdraw consent — where a use rests on consent, withdraw it without affecting what was lawful before.
• Complain — to us, and to your data protection authority.
• No automated decisions — we make no decision about you by automated means alone that has a legal or similarly significant effect.

India — DPDP Act, 2023

If you are in India, you have the rights to access a summary of your personal data and our processing of it, to correction and erasure, to nominate someone to exercise your rights if you cannot, and to a grievance redressal mechanism. Send a grievance to sales@sarv.com. We will acknowledge within 72 hours and respond substantively within 30 days.

EU, EEA and UK — GDPR

The rights above are the GDPR rights, and we apply them to everyone rather than only where they are compulsory. You may complain to your national supervisory authority.

California — CCPA/CPRA

You may ask what categories we collected, used and disclosed, ask for a copy, ask for deletion, and ask us to correct it. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing for you to opt out of. We will not discriminate against you for exercising a right.

How to ask

For account closure, the deletion form is the fastest route and needs no reply from us. For anything else, email sales@sarv.com from the address on your account. We may ask you to verify your identity — we will not hand your data to someone who merely claims to be you. Expect a substantive reply within 30 days; if a request is genuinely complex we will tell you why and how much longer we need.

This marketing site sets no analytics or advertising cookie. There is nothing here to consent to.

The console sets only what signing in requires: a session token and, where you have chosen one, a stored interface preference. There is no third-party tracker in the product.

We honour Do Not Track and Global Privacy Control signals, which is easy for us because there is no cross-site tracking to switch off.

The Service is not directed at children. We do not knowingly collect data from a child. If you believe a child has given us personal data, write to sales@sarv.com and we will delete it.

When you run the open-source stack yourself, we receive nothing — no content, no telemetry, no usage counts. The deployment does not call home.

That makes you the controller and the processor both. Whatever privacy notice your users need is yours to write, and whatever the deployment stores is yours to secure — starting with keeping the data services off the public internet.

We operate from India and the hosted Service runs there. If you are outside India, using the Service means your data is processed there, under laws that may differ from your own.

Where a vendor processes data in another country, we rely on an appropriate transfer mechanism — standard contractual clauses or an adequacy finding, as applicable — and on contractual commitments to protect it to the standard described here.

We will update this page as the Service changes. For a material change — a new category of data, a new purpose, a new vendor with meaningful access — we will give notice by email or in the console before it takes effect.

The date at the top of this page is when it last changed. Continuing to use the Service after a change takes effect means you accept it.

Where to write, depending on what you need:

• Privacy questions, requests and grievances · Security reports · Anything about the terms of servicesales@sarv.com

If we have not resolved a complaint to your satisfaction, you may take it to the data protection authority where you live. That right is yours regardless of anything in this policy.