Privacy Policy

Scope ApS is the data controller for all personal data processed through the Scope platform ("Service"). You can reach our privacy team at privacy@scopemc.net.

We are subject to the EU General Data Protection Regulation (GDPR) 2016/679, the Danish Data Protection Act (Databeskyttelsesloven), and are supervised by Datatilsynet (datatilsynet.dk).

We do not sell personal data. We do not use data for advertising or profiling beyond what is described above.

• Passwords are stored using scrypt (N=16 384, r=8, p=1) — industry-standard memory-hard hashing. We never store plaintext passwords.
• All data in transit is encrypted with TLS 1.2+ (HTTPS). HTTP traffic is redirected automatically in production.
• Authentication uses short-lived JWT access tokens (15 min) and HttpOnly, Secure, SameSite=Strict refresh cookies (7 days).
• API endpoints enforce rate limiting and per-organisation quotas to prevent abuse.
• Database access uses parameterised queries (Drizzle ORM) — SQL injection is structurally prevented.
• Outbound HTTP calls are restricted to an explicit allowlist (Stripe, Groq, Anthropic, Spark).
• Security headers: HSTS, CSP, X-Frame-Options: DENY, X-Content-Type-Options, Referrer-Policy are applied on every response.

We share data with the following sub-processors, each bound by a Data Processing Agreement (DPA):

• Stripe, Inc. — payment processing. Card data is processed on Stripe's PCI-DSS-certified infrastructure. Stripe acts as an independent data controller for its own compliance obligations. Stripe Privacy Policy
• Groq, Inc. (optional, if AI_PROVIDER=groq) — AI inference. Server performance metrics (no personal player data) are sent to Groq's API to generate recommendations. Groq processes data in the US under SCCs.
• Anthropic, PBC (optional, if AI_PROVIDER=anthropic) — AI inference. Same scope as Groq above.
• Infrastructure provider — hosting (database, Redis, API server). We use providers with EU data-centre options and standard contractual clauses where data is processed outside the EEA.

When data is transferred outside the European Economic Area (e.g., to Groq or Anthropic in the US), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c) GDPR) and, where applicable, the UK International Data Transfer Agreement.

You have the following rights regarding your personal data (Art. 15–22 GDPR):

• Right of access (Art. 15) — request a copy of your data.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure (Art. 17) — "right to be forgotten" (subject to legal retention obligations).
• Right to restrict processing (Art. 18).
• Right to data portability (Art. 20) — receive your data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)) — withdraw any consent at any time without affecting prior processing.

To exercise any of these rights, email privacy@scopemc.net. We will respond within 30 days. If you are unsatisfied with our response, you may lodge a complaint with Datatilsynet (Danish Data Protection Authority).

We use a session cookie for authentication and browser localStorage for preferences. See our full Cookie Policy for details. You can manage or withdraw consent at any time using the cookie settings button in the footer.

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at privacy@scopemc.net and we will delete it immediately.

We will notify you of material changes by email and by updating the "Last updated" date above. Continued use of the Service after the effective date constitutes acceptance of the revised policy. Historical versions are available on request.