Privacy Notice

Scrollcraft is operated by Tom Baker ("Scrollcraft", "we", "us"). We are the data controller for the personal data described in this notice — meaning we decide how and why your data is processed.

• Account data — name, email address, and login credentials (including Google sign-in identifiers). Used to create and secure your account and provide the service. Legal basis: contract performance.
• Membership data — your plan, purchase status, and entitlement records. Used to give paying members access to the library. Legal basis: contract performance.
• Support messages — anything you send us when you ask for help. Used to respond and resolve issues. Legal basis: legitimate interests.
• Usage and device data — pages viewed, approximate device and browser information, and IP address. Used for security, fraud prevention, and product improvement. Legal basis: legitimate interests.

Payment card and billing details are collected and processed by Paddle, our Merchant of Record — we never see or store your full card details.

• Paddle — our Merchant of Record — for the sale of memberships, subscription management, payments, tax compliance, and invoicing.
• Service providers — hosting, database, authentication, and analytics providers who process data on our behalf under contract.
• Professional advisers — legal and accounting advisers where needed.
• Authorities — where required by law.

We do not sell your personal data.

Some of our service providers process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

We keep your data for as long as your account is active and as long afterwards as needed for legal, tax, and accounting obligations. When data is no longer needed it is deleted or anonymised.

We apply appropriate technical and organisational measures — including encryption in transit, access controls, and row-level security on our database — to protect your personal data.

Depending on where you live (including the UK and EEA), you have the right to: access your data, have it corrected or erased, restrict or object to processing, data portability, and to withdraw consent where processing is based on consent. We respond to requests within one month. You also have the right to complain to your supervisory authority (in the UK, the ICO).

To exercise any of these rights, contact us via the support channel on the site.

We use essential cookies and local storage to keep you signed in and to make the service work. We do not use third-party marketing cookies. You can clear site data at any time through your browser settings; essential cookies are required for sign-in to function.

We may update this notice from time to time. Material changes will be signposted on this page with a new "last updated" date.