This policy explains what personal data Scaplet, Inc. ("Scaplet", "we", "us") collects when you use scaplet.com and the Scaplet app, why we collect it, and the choices you have.
1. Our role
For account, billing and website data, Scaplet is the controller. For the content and data you or your workspace bring into Scaplet, such as Search Console data and site content, we act as a processor on behalf of your workspace and only use it to provide the service.
2. What we collect
We collect only what we need to run Scaplet:
- Account details: your name, email address, and the provider you sign in with (Google, GitHub or an email code).
- Workspace data: the domains you add, chats, drafts, reports and the history of changes Scaplet makes.
- Connected data: Search Console properties and performance data you choose to connect.
- Technical data: IP address, browser and device details, and an approximate location and timezone derived from your IP.
- Communications: emails you send us and your waitlist or newsletter sign-ups.
We also read the public pages of the websites you add, and pull public search data about them, such as keywords, rankings and backlinks.
3. Google user data
When you connect Google Search Console, Scaplet requests read-only access (the webmasters.readonly scope). We use it to show your search performance and find SEO opportunities for the sites in your workspace. Nothing else.
Scaplet’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train general AI models. Tokens are stored encrypted, and you can disconnect at any time from the app or from your Google account.
4. How we use it
- To provide, secure and improve Scaplet.
- To sign you in, including sending one-time login codes.
- To run the AI agents that research your site and write drafts you asked for.
- To send product and service emails. Marketing emails are opt-in and every one has an unsubscribe link.
- To respond to support requests and meet legal obligations.
Where GDPR applies, we rely on performance of our contract with you, our legitimate interest in running and securing the service, your consent (for marketing), and legal obligations.
5. AI processing
Scaplet uses large language models from providers such as OpenAI, accessed through Vercel AI Gateway or Microsoft Azure OpenAI. We send them only what a task needs. These providers are contractually barred from training their models on your data, and we do not use your data to train models either.
6. Who we share it with
We never sell your personal data. We share it only with service providers that help us run Scaplet, under contracts that limit their use of it:
- Hosting and infrastructure: Vercel and our database and cache providers.
- AI models: OpenAI, Microsoft Azure and Vercel AI Gateway.
- Site and search data: Firecrawl, DataForSEO and Google PageSpeed Insights.
- Email: Resend.
- Payments: our payment processor, which handles card details directly. We never see or store full card numbers.
We may also disclose data if the law requires it, to protect our users or Scaplet, or as part of a merger or acquisition, in which case this policy continues to apply.
7. Where data is stored
Our servers are located in the United States. When we transfer personal data from the EEA, UK or Switzerland, we rely on Standard Contractual Clauses or another approved transfer mechanism.
8. Security
Data is encrypted in transit and at rest, integration tokens are encrypted and scoped per workspace, and staff access is limited and logged. Read more on our Security page.
9. Retention
We keep your data while your account is active. When you delete a workspace or account, we remove its data from our systems within 30 days, except where we must keep records for legal, tax or security reasons.
10. Your rights
Depending on where you live, you can ask to access, correct, export or delete your personal data, or object to or restrict how we use it. You can do most of this in the app. For anything else, email hey@scaplet.com and we will reply within 30 days. You can also complain to your local data protection authority.
11. Cookies
We use essential cookies to keep you signed in and to secure the app. We do not use third-party advertising cookies.
12. Children
Scaplet is not meant for anyone under 16, and we do not knowingly collect their data.
13. Changes
If we change this policy in a meaningful way, we will update the date above and let account owners know by email before the change takes effect.
14. Contact
Questions about privacy? Email hey@scaplet.com.
