Privacy Policy

1. Who is responsible

The controller of your personal data is [Legal name of your business], [Registered business address], Romania. Contact us about privacy at [privacy@your-domain].

Our privacy contact is [Your full name], Founder. This person is also the person in charge of personal information under Quebec law, and the contact channel for data subjects under Brazil’s LGPD and India’s DPDP Act. We have not appointed a data protection officer because the law does not require one for a service of our size and type.

2. What we collect

We don’t ask for sensitive data, such as health or political opinions. Please don’t enter it in a category or an edit.

3. Why we use it, and our legal basis

We don’t send marketing emails. If we ever start, we will ask first where the law requires it, and every email will have an unsubscribe link. We don’t sell personal data, share it for cross-context behavioural advertising, show ads, or use your content to train AI models.

Niche rankings are automated, but they score markets, not you. We make no automated decisions that have legal or similarly significant effects on you.

4. Who we share it with

Anthropic. When you start a job, we send its inputs to Anthropic using your API key. Inputs include the category, the plan and the evidence, plus any edits you made. Anthropic processes them under your own Anthropic account and its policies, including its data retention rules. Anthropic’s web search fetches public web pages during a run.

We also disclose data when the law requires it, to protect our rights or someone’s safety, or to a business that takes over Margin Scout. If that happens, we will tell you.

5. International transfers

We are based in the European Union. Supabase and Vercel store and process data in the United States. Those transfers are covered by the European Commission’s Standard Contractual Clauses in their data processing agreements, with the UK and Swiss addenda. Vercel is also certified under the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards.

6. How long we keep it

• A project (a search with its plans, outlines, books and Notion content) is deleted 7 days after the last money was spent on it: a search, a plan, an outline, writing or a polish. Opening, editing or downloading it doesn’t keep it. We warn you 3 days before, in the app, with a download of its files and search results.
• After that we keep a receipt of the project: its name, its niche, its dates, its grade, and what each paid step cost and when. It holds none of the project’s content. It keeps your spending totals, Insights and exports correct, and is deleted with your account.
• Pages we built in your own Notion workspace are yours and are never deleted by us. Saved search findings and job records we no longer need are deleted after 7 days.
• Account data is kept while your account exists. You can delete runs or the whole account from the Account page. It is removed from the live database at once, and from backups within 30 days.
• Your API key and Notion token are kept until you remove them or delete your account.
• Server and sign-in logs are kept for short periods, generally no longer than 90 days.
• The record of which terms you accepted is kept while you have an account and for 3 years after, so we can show what you agreed to.
• Billing and tax records are kept as long as tax and accounting law requires, which can be up to 10 years.
• Support emails are kept for up to 2 years after the issue is closed.

7. Security

All traffic is encrypted in transit. API keys and Notion tokens are encrypted with AES-256-GCM, using a secret that is held outside the database. Database access rules mean each account can read only its own rows. Keys and tokens are never sent back to the browser; you only ever see their last 4 characters. No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

8. Your rights

Everyone. You can ask us to tell you what we hold, correct it, delete it, or give you a copy in a portable format. Use the Account page, or email [privacy@your-domain]. We reply within one month and may need to confirm it is you. We don’t charge for requests and we won’t treat you differently for making one.

EU, EEA, UK and Switzerland. You also have the rights to restrict processing, to object to processing based on our legitimate interests, and to withdraw consent at any time. You can complain to the data protection authority where you live or work, or to our lead authority, ANSPDCP (Romanian National Supervisory Authority for Personal Data Processing).

United States. Residents of California, Virginia, Colorado, Connecticut, Texas and other states with privacy laws can ask to know, delete or correct their data, and to opt out of sale, sharing, targeted advertising and profiling. We don’t sell or share personal data or use it for targeted advertising, so there is nothing to opt out of; browser Global Privacy Control signals are respected. We honour these requests whether or not a state law applies to us. If we refuse a request, you can appeal by replying to our answer.

Canada. You can access and correct your data by contacting our privacy contact. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

Brazil. You have the rights in Article 18 of the LGPD, and can contact us or Brazil’s data protection authority (ANPD).

Australia, India and elsewhere. You can access and correct your data and complain to your local authority, for example the OAIC in Australia. We honour reasonable privacy requests wherever you live.

9. Cookies

We use only what is strictly needed to keep you signed in and remember one display setting. There are no analytics or advertising cookies. See the Cookie Notice.

10. Children

Margin Scout is for people aged 18 and over and is not directed at children. If we learn that a child has an account, we delete it and its data.

11. Changes

If we change this policy in a way that matters, we will email you before the change applies.