Your data should have a clear purpose.

1. Information we collect

Account data: name, email address, verification status, account identifier, authentication events and profile metadata. Password handling and sessions are provided by Supabase Auth; Scrollhaus does not display or store your readable password.

Purchase data: checkout email, plan, payment status, Stripe customer, subscription and checkout identifiers, purchase date and access expiry. Stripe receives payment and transaction details directly.

Support and technical data: information you include in an email or booking request, plus IP address, device and browser information, request logs, security events and essential storage needed to provide and protect the site.

2. How and why we use data

We use data to create and secure accounts; verify email; match purchases to access; process renewals, cancellations and support; deliver requested resources; prevent fraud and abuse; maintain the service; and comply with tax, accounting and legal duties.

Depending on your location, the legal basis may be performance of a contract, legitimate interests in operating and protecting Scrollhaus, compliance with law, or consent where consent is required.

3. Service providers and disclosures

Data may be processed by Google Analytics for traffic measurement and Microsoft Clarity for interaction analytics and session replay, and by Supabase for authentication and database services, Stripe for checkout and payment operations, Hostinger for hosting and server logs, Cloudflare for DNS, security and delivery, Google Fonts for requested font files, and email or scheduling providers when you contact or book with us. Each provider processes data under its own terms and privacy notice.

We may disclose information when reasonably necessary to comply with law, enforce our terms, investigate fraud, protect users, or complete a business reorganization. We do not sell personal information.

4. International transfers and security

Providers may process information outside your country. Where required, transfers use legally recognized safeguards. We use access controls, row-level database security, signed payment webhooks and encrypted network connections, but no online service can guarantee absolute security.

5. Retention

Account and entitlement records are retained while your account or access remains active. Transaction and support records are kept as needed for delivery, fraud prevention, accounting, tax and legal obligations. Data is deleted or de-identified when it is no longer reasonably needed, unless law requires longer retention.

6. Your choices and rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection; withdraw consent; and complain to your local data-protection authority. Identity verification may be required before a request is completed.

Send privacy requests to admin@scrollhaus.ai. We will respond within the period required by applicable law.

7. Children and changes

Scrollhaus is not directed to children and we do not knowingly collect personal data from children who cannot legally consent. If you believe a child provided data, contact us. Material updates to this notice will appear here with a revised effective date.