Privacy policy

Who operates the service#

ScreenshotAPI is the screenshot service trading as screenshotapi.tech, based in Hyderabad, India. Our designated support, privacy and grievance email is support@screenshotapi.tech. The service is operated by Screenshot API at Suraram, Hyderabad.

Data we process and why#

Account information includes your authentication-provider identifier, email and display name. We use it to provide access and maintain your account. API-key records, usage counts, capture history, request identifiers, errors and timing help us deliver, meter, secure and troubleshoot the service.

Payment and subscription identifiers, plan information and verified payment/refund events support billing. Dodo Payments handles payment collection; do not send card details to our screenshot API. When transactional email is enabled, we send your verified email address and necessary message content to Resend for welcome messages, low-credit alerts, capture-failure notifications you enable, privacy-request acknowledgements and completion notices, and essential service notices.

Email preferences are stored with your account. We record delivery identifiers, status and retry metadata for up to 90 days, and keep a hashed suppression entry after bounces or complaints to prevent further delivery. Pending message content expires within 23 hours; accepted messages are removed from our delivery queue payload.

For a privacy request, a verified contact address may be retained until the final notice is queued, including after account closure. Resend processes its own delivery records under its retention arrangements. Email open and click tracking are disabled.

You can change optional notifications in account settings. Capture-failure emails include the target URL without login credentials, query strings or fragments, the failure category, time, elapsed duration, format, request identifiers and released credits when available. Successful captures do not generate notification emails.

These messages do not subscribe you to marketing emails.

Capture inputs and outputs#

We process submitted URLs, capture settings, optional custom scripts/styles, callback destinations, rendered images/PDFs and inspection output to perform your instructions. These may contain personal or confidential information from the target page. Only submit content you are authorised to process, with an appropriate legal basis.

Avoid credentials, sensitive information and personal data in URLs. Isolation and encrypted submission fields do not make all stored capture content anonymous or encrypted end to end.

Optional analytics and browser preferences#

Privacy settings offers separate choices for product analytics, performance and diagnostics, and masked session replay. All optional collection stays off until you consent. Product analytics uses PostHog to measure filtered page visits, navigation, feature choices, capture settings and outcomes, code-copy and download actions, checkout interactions, active time and scroll depth.

It may include browser/device and session information. When signed in, product events may use your authentication-provider account identifier; names and email addresses are not supplied as profile properties. With product analytics consent, PostHog stores a browser identifier in localStorage so return visits can be measured.

Diagnostics consent permits web performance measurements and generic error categories, without raw error messages or request contents; diagnostics alone uses in-memory identifiers. Session replay requires an additional choice and product analytics consent. Replay is limited to public landing, blog, pricing and legal pages.

Private workspace, capture, billing, authentication, API-key and privacy-control screens are excluded. Replay masks text, inputs and element attributes, blocks images, code, forms and embedded content, and excludes console logs and network request bodies/headers. The configured PostHog ingestion endpoint is in its EU region; this does not mean all service or provider processing stays in the EU.

Raw capture URLs, screenshots, custom scripts/styles, API-key secrets, card details and form contents are excluded from product analytics. No advertising trackers are enabled. Your versioned choice is stored per site origin for up to 180 days; older choices do not authorize new collection purposes.

Rejecting or withdrawing optional collection does not restrict the service. Use the persistent Privacy settings button to customize or withdraw your choice. Withdrawal stops future collection and clears active analytics identifiers; it does not delete events already sent.

Global Privacy Control, Do Not Track and account privacy objections override optional collection. Operational authentication, billing and capture records have separate service purposes. Server product analytics remains disabled unless separately configured and subject to account privacy controls.

Providers and international processing#

The implementation uses Clerk for authentication, Dodo Payments for checkout/billing, hosting infrastructure, PostgreSQL and Redis for account/job records, Cloudflare R2 for capture storage, optional PostHog analytics, and Resend for transactional account emails when enabled. Providers may receive account, device, network or transaction information needed for their functions. Payment providers may have independent legal responsibilities.

Processing may occur outside India according to the provider and service configuration. Contact support@screenshotapi.tech for questions about providers, processing locations and available transfer safeguards.

Retention and deletion#

Our maintenance configuration uses default retention periods for capture history and settled capture records of 30 days, unused monthly usage records of 90 days, and capture files of 30 days. Completed privacy-request records are retained for up to one year. Closed-account billing and acceptance evidence use a configurable default of approximately seven years after the last relevant account update.

Deletion timing depends on maintenance scheduling, provider retention and any applicable retention obligations; cache expiry or expiring links alone do not delete files. Account closure freezes new captures and API keys, stops subscription renewals, drains queued work, removes account content and requests provider deletion. Closure is not marked complete until required provider and backup review is recorded.

Billing or other records that must be retained under law may remain restricted. Provider retention and backup expiry depend on the verified deployment and provider obligations.

Your choices and requests#

Depending on the law that applies, you may have rights to information/access, correction, deletion, portability, restriction, objection, consent withdrawal, grievance handling, appeal or nomination. These rights may have legal exceptions and require proportionate identity verification. You may also complain to the competent regulator.

Sign in and open Privacy and account controls to download paginated account records, update profile details, submit a request and track its status. Account closure and exports require recent sign-in verification. Exports omit authentication secrets and generated API-key hashes; additional provider records can be requested through support.

Our designated request address is support@screenshotapi.tech, including for people who cannot sign in. Privacy settings controls optional browser analytics; an account-level objection also disables optional server analytics and is checked across signed-in browser sessions.

Regional safeguards#

The operator must assess India's Digital Personal Data Protection Act, 2023 and its Rules according to their notified commencement dates, together with applicable existing Indian laws. EU/EEA and UK customers may trigger data-protection, cookie, representative and international-transfer duties. US privacy duties vary by state, business activity and statutory thresholds; there is no single general US privacy act that establishes worldwide compliance.

Other markets require their own applicability assessment. This notice does not certify compliance in every country.

Children and changes#

The service is intended for adults using developer tools, not for children. Do not use it to collect children's personal data without all legally required permissions and safeguards. This statement is not an age-verification system.

Material changes to the effective policy will be versioned and communicated as required; additional consent will be sought where required.