Privacy Notice

1. Data Controller

Dania Mendoza is the data controller for the personal data processed through scrappy. If you have any questions about this notice or your data rights, please contact us via the app or Paddle support channels.

2. What Data We Collect

• Account data: name, email address, and authentication credentials used to create and secure your account.
• User content: diary entries, text, images, and other content you voluntarily add to your scrapbook.
• Usage data: feature usage, app interactions, and error logs to help us improve the service.
• Device & network data: IP address, browser type, and device identifiers for security and fraud prevention.

3. Why We Process Your Data

• Contract performance: to provide the scrappy service, authenticate you, and store your entries.
• Legitimate interests: to maintain security, prevent fraud, and improve the product.
• Consent: where required, for optional features or communications.
• Legal obligation: to comply with applicable laws and respond to lawful requests.

4. Who We Share Data With

• Service providers: hosting, analytics, and support tooling providers who process data on our behalf under strict confidentiality.
• Merchant of Record (Paddle): for sale of Premium subscriptions, subscription management, payments, tax compliance, and invoicing. Payment-related data collection by Paddle is governed by Paddle's privacy practices.
• Professional advisers: legal and accounting professionals where necessary.
• Authorities: where required by law or to protect our rights and users.

5. Data Retention

We keep your personal data for as long as your account is active or as needed to provide the service. If you delete your account, we will remove or anonymise your data within a reasonable period, unless we are required to retain it for legal, tax, or regulatory purposes.

6. Your Rights

Depending on your location, you may have the right to access, correct, delete, or restrict processing of your personal data, as well as the right to data portability and to object to certain processing. To exercise these rights, contact us through the app or Paddle support. We will respond within one month where required by law.

7. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews.

8. Cookies

scrappy uses essential cookies to maintain your session and authentication. We do not use tracking or marketing cookies. You can manage cookie preferences through your browser settings.

9. International Transfers

Your data may be processed and stored in countries outside your own. Where data is transferred outside the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions to ensure your data remains protected.

10. Changes to This Notice

We may update this Privacy Notice from time to time. We will notify you of significant changes through the app or by email where required.