Privacy Policy.
Plain language, no dark patterns.

01What we collect

We collect three categories of information — only what's needed to deliver the product, only when you give it to us.

Account data

When you sign up: name, work email, password (managed by Appwrite), authentication provider tokens if you use Google or LinkedIn SSO. If you upgrade to a paid plan: company name and billing address (handled by Stripe — we never see your card number).

Product data

To deliver the daily brief, we process: your business URL, voice samples you paste during onboarding, the competitor list you build, any briefs we generate for you, and any content you approve or edit. This is the substance of the service.

Usage data

Standard product telemetry — which features you use, error logs, performance metrics, anonymous page-view counts. We use this to keep ScoutRival fast and to know which features matter. We do not sell, share, or rent any usage data.

02How we use it

Each piece of data serves a specific purpose. Here's the full list — there is no "other":

• Account data — authentication, account recovery, billing, support replies
• Business URL + voice samples — generating the daily brief and brand-voice-matched drafts
• Competitor list — running the daily crawl across the sources you've authorized
• Briefs + content — displaying them back to you and (with your approval) publishing to your connected channels
• Usage telemetry — improving the product · debugging · capacity planning
• Marketing emails — only if you opt in. Unsubscribe link in every email.

We do not use your data to train shared AI models. Your content does not improve other customers' results.

03Third-party services

We use a small, deliberate set of sub-processors. Each one has a specific job:

// APPWRITE

Authentication, database, and file storage, running on our own managed infrastructure. Holds your account credentials and product data.

// STRIPE

Billing, subscription management, payment processing. PCI-DSS Level 1. We never see your card number. stripe.com/privacy

// GOOGLE APIs

Search Console (Search Analytics) and the Chrome UX Report — accessed only when you connect them, to power your SEO & AI-Visibility reports. See section 10 for the full disclosure. policies.google.com/privacy

// AI PROVIDERS

OpenRouter, Anthropic, OpenAI, and Google (Gemini) for text; fal.ai for images. Used to generate your content — via no-training / zero-retention modes where available. On paid plans you can bring your own API keys.

// DATA COLLECTION

Apify and our own crawling service, plus a self-hosted SearXNG search instance. Used to collect publicly-accessible competitor and market signals from the sources you choose. Your personal data does not pass through them.

// RESEND

Transactional email delivery (sign-up verification, billing receipts, daily brief notifications). resend.com/privacy

// HOSTING

Our application and databases run on our own managed cloud infrastructure. Standard server logs (IP, user-agent, timestamp) are processed to operate and secure the service.

// PLAUSIBLE

Privacy-respecting, cookieless website analytics. No personal identifiers, no cross-site tracking. plausible.io/privacy

04Cookies & tracking

We use the fewest cookies we can get away with. Specifically:

• Session cookies — required to keep you logged in (set by Appwrite). Strictly necessary.
• Preferences — a small cookie storing your monthly/annual pricing toggle, theme preference, dismissed banners. No personal data.
• Stripe checkout — Stripe sets cookies during paid checkout. Required for fraud prevention.

We do not use third-party advertising cookies, retargeting pixels, or cross-site trackers. There is no cookie banner because there is nothing to consent to beyond what's strictly necessary.

05Data retention

We hold data only as long as it's useful. Specifically:

1. Active account data — kept for as long as your account is active
2. After cancellation — your data is retained for 30 days so you can change your mind, then deleted
3. Briefs + content you've shipped — kept for 90 days after cancellation in case you need to re-export, then deleted
4. Billing records — retained for 7 years per tax/accounting requirements (kept by Stripe)
5. Usage logs — anonymized after 90 days, fully deleted after 13 months

You can request immediate deletion at any point — see Your Rights below.

06Your rights · GDPR + CCPA

If you're in the EU, UK, Switzerland (GDPR), or California (CCPA), you have these rights — and they apply to everyone equally because the easier path is to honor them globally:

• Access — request a full copy of everything we hold about you, in machine-readable format (JSON or CSV)
• Rectification — fix any inaccurate data we hold
• Erasure ("right to be forgotten") — delete your data permanently
• Portability — get your data in a format you can take elsewhere
• Restriction — pause processing while you decide what you want done
• Objection — opt out of marketing emails (do this from the email footer or in account settings)
• Withdrawal — revoke consent at any time

To exercise any of these: email [email protected]. We respond within 30 days, usually within 24 hours. No paperwork, no friction.

07Children's privacy

ScoutRival is a B2B product for businesses. We do not knowingly collect data from anyone under 16. If you believe a minor has provided us data, email [email protected] and we'll delete it immediately.

08How we keep data safe

• Encryption at rest — AES-256 at the storage layer
• Encryption in transit — TLS 1.3 on every endpoint
• Per-record access control — every record is scoped to its owner and enforced server-side
• Access control — least-privilege internal access, audit logged
• Encrypted secrets — API keys and OAuth tokens are stored encrypted (AES-256-GCM), never in plaintext
• Incident notification — within 72 hours per GDPR Article 33

09Updates to this policy

We update this policy when something changes — a new sub-processor, a new feature that processes data differently, a legal requirement. When we do:

• The "Last updated" date at the top changes
• Significant changes get an email notice to all account holders, sent at least 30 days before they take effect
• You can review past versions on request

10Google user data · Search Console

ScoutRival's SEO & AI-Visibility feature lets you connect your own Google Search Console account so we can display your organic search performance inside your dashboard. This section explains exactly what we access and how we use it, in line with the Google API Services User Data Policy.

What we access

• Search Console data (scope webmasters.readonly) — read-only access to your Search Analytics (clicks, impressions, average position, top queries) and your list of verified sites. We cannot add, edit, or delete anything in your Search Console account.
• Basic Google profile (scopes openid, email) — used only to show which Google account is connected.

How we use it

• Solely to display your search performance and to power your SEO score, reports, and recommendations inside ScoutRival.
• We store an encrypted Google refresh token and cache the retrieved metrics to render your dashboards.
• We never sell this data, use it for advertising, or use it to train AI models.

Disconnecting & revoking access

You can disconnect Google Search Console at any time inside ScoutRival, which revokes our access and deletes the stored token. You may also revoke access directly at myaccount.google.com/permissions.

11Contact

Anything privacy-related — questions, requests, complaints — goes to one inbox:

// PRIVACY OFFICE

[email protected]

// MAILING ADDRESS

ScoutRival · Dhaka, Bangladesh · (full registered address available on request)

// DATA PROTECTION OFFICER

[email protected]

// EU SUPERVISORY AUTHORITY

You also have the right to lodge a complaint with your local supervisory authority — for example the Irish DPC, German BfDI, or French CNIL.