Privacy policy
Written for the product as it actually works. Controller: , (see imprint). Contact: privacy@scrollsonar.com.
What data we process and why (legal basis)
- Contract: your account, your workspace, the research you request and payments.
- Legitimate interest: security, abuse prevention (free tool limits using a daily IP hash), cookieless analytics on public pages and preventing repeat free trials (we store a hash of the payment method fingerprint provided by Stripe, never the card number).
Sign-up source
When you create an account we store the referring domain, UTM parameters, first page visited and time, and pass them to Stripe with the subscription so we know which channels bring in customers.
Cookies
We only use the essential cookies needed to keep you signed in. Analytics works without cookies. To remember where your visit came from until you sign up we use tab storage (sessionStorage), which is cleared when you close the tab.
Public creator data
We only analyze public content: posts, metrics, transcripts, bios and public profiles. We link to the original posts and don't host them. When a creator's public bio includes a business email, we store it with its source and date to show it to paying users looking for collaborations (a legitimate interest of both parties in professional contact). Public pages never show emails. Any creator can ask us to delete their email or profile on this page; we apply it immediately and add them to an exclusion list.
Providers that receive data
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase (EU, Ireland) | Accounts, authentication and saved workspace. | Email, account data, chats, brands and saved items. |
| Cloudflare | Website hosting, background jobs and caching. | Technical request data (IP, browser) in its logs. |
| ScrapeCreators | Querying public social media data. | Search phrases, public URLs and selected platforms. Returns public profiles and posts. |
| OpenAI | Writing answers, analyses and briefs. | The prompt and the public text needed. We ask that requests are not stored (store: false). |
| Stripe | Payments, subscriptions and invoices. | Payment data (handled by Stripe), email and sign-up source as subscription metadata. |
| PostHog (EU) | Cookieless analytics on public pages. | Page views with a daily hash of IP and browser. No session recording. |
| Sign in with Google and website icons (favicon service). | Your Google account data if you choose that sign-in; the domain of the analyzed website to fetch its icon. | |
| Apple | Reading an app's public listing. | The app's public ID when you paste an App Store link. |
| Resend | Transactional emails and alerts. | Your email and the alert content. |
Transfers outside the EU
When a provider processes data outside the EU/EEA, it does so under the EU-US Data Privacy Framework or standard contractual clauses.
Retention and deletion
You can delete your account from Settings: your subscription is cancelled and your account, chats, brands, saved items and alerts are deleted. Invoices are kept for as long as tax law requires (for example, 10 years in Germany). The public data cache is refreshed and purged regularly.
Automated decisions
The AI model only writes up the research. It does not decide plans or prices, and it has no legal effects on you.
Age
The service is not intended for anyone under 16.
Your rights
Access, rectification, erasure, objection, restriction and portability by writing to privacy@scrollsonar.com. You can also lodge a complaint with your data protection authority.