Firecrawl

GDPR overview

Firecrawl never claims GDPR compliance in so many words: the acronym appears once in the terms of service, and only as an obligation placed on the user. The privacy policy nonetheless carries an EU Rights to Information section granting eight rights, namely information, access, rectification, erasure, restriction, portability, objection including profiling and direct marketing, and automated decision-making, and states that they are respected for all users regardless of citizenship. Requests go to help@firecrawl.com, and the right to complain to a national supervisory authority is acknowledged. Transfers are explicit: data leaves the home country for the United States, with a warning that protection there may be weaker. What is absent is just as clear, with no Article 27 representative, no named DPO and no standard contractual clauses. A countersigned standard DPA is offered from the Standard plan upward.

Who owns the data?

The terms of service state that content and intellectual property posted by users belongs to the user who posted it. That ownership comes with a wide grant, however: by submitting content or feedback you give the publisher a worldwide, irrevocable, non-exclusive, royalty-free license to use, reproduce, modify, publish, translate and distribute it in any existing or future medium, together with the right to sub-license those rights, and the grant survives termination. Ownership of the Services themselves stays with SideGuide Technologies; you hold rights only over what you generate. Payment cards are not kept in-house but held by Stripe. The terms were last revised on 5 November 2024 and the privacy policy on 26 December 2024.

Reuse rights

Nothing in the terms limits what you do with the content you submit or the data you pull back: you keep ownership and need no permission to reuse it, while the contract pushes responsibility for lawful use, including GDPR and CCPA compliance, onto you. On the publisher's side, the privacy policy lists service delivery, caching and indexing, service, product and billing emails, site performance, personalization, payment processing, product improvement, marketing and advertising, with cookies tracking unauthenticated visitors. The named third-party recipients are Stripe for payments, PostHog for product analytics, Crisp for support chat and Vercel Analytics for marketing. Neither document says anything about training AI models on customer data, which is a silence rather than a commitment. Do Not Track signals are honored, and data is encrypted in transit over TLS, at rest only on request.

Data retention & training

Hosting summary

The privacy policy is unambiguous on jurisdiction: the business is operated from the United States, the servers are located in the United States, and that is where user data and information are stored. As far as the publisher is aware, the third parties it shares information with are American as well. The document adds the usual caveat that, given the nature of internet communications, data may transit through other countries along the way, and it explicitly warns European users that their information leaves their home country for a jurisdiction that may not offer the same level of protection. No European data-residency option is offered at any plan level. Zero Data Retention, meaning no storage of scraped content after the request, is available only on Enterprise and only for approved use cases. Domain resolution points to 76.76.21.21, an anycast node operated within Amazon's AS16509 and located in the United States, which is consistent with the declared hosting.