Privacy Policy

1. Data Controller

Trading name: The Screenwriting Company (trading as Scriptor)
Address: Manchester, United Kingdom
Contact Email: support@scriptor.uk

Scriptor is operated by a sole trader using the trading name The Screenwriting Company. The operator is responsible for your personal data. For privacy and data protection enquiries, please contact us at the email address above.

2. What We Collect

We collect the following personal data:

Sign-up Data (Provided by You)

• Email address: Required for account creation and authentication
• Name: Optional, collected if you sign in with Google or provide it in your account
• Profile image: Optional, collected if you sign in with Google OAuth

User Content (Provided by You)

We store your screenplays, files, projects, and other creative content that you create using our Service. This content is stored securely and is accessible only to you (and any collaborators you explicitly share with).

Important: We do not use your files for advertising or AI training. Service providers process content as needed to deliver the Service. When you choose AI features, relevant content is sent to OpenAI. Provider retention is explained in Section 5.

Usage Logs (Collected Automatically)

We automatically collect basic usage information:

• Internet Protocol (IP) address
• Browser type and version
• Device information (type, operating system)
• Pages visited and time spent on pages
• Diagnostic and performance data
• Product analytics metadata, such as feature usage, file type, export status, search result counts, and pseudonymous internal identifiers such as user ID or file ID. We do not send screenplay text, document contents, AI prompts, or AI responses to analytics providers.

Security Audit Logs (Collected Automatically)

We process security and diagnostic information to protect accounts, investigate faults and prevent abuse. This can include IP addresses, browser and device information, account identifiers, email addresses, event times and the outcome of sign-in attempts. Axiom processes security logs on our behalf.

3. Why We Collect It & Lawful Basis

We process your personal data based on the following legal grounds under UK GDPR:

• Contract (Article 6(1)(b)): To provide the service and manage your account. This includes authentication, storing your content, processing payments, and sending service-related communications and responding to support enquiries.
• Legitimate Interests (Article 6(1)(f)): For security, fraud prevention and understanding product usage. This includes security audit logging and anonymous, aggregate usage statistics (collected without cookies/identifiers for non-consenting users).
• Consent (Article 6(1)(a)): For personalised analytics tracking (sessions and user journeys). You can withdraw consent at any time in Settings.

4. Cookies

We use cookies and similar technologies. Personalised tracking is opt-in only. If you do not consent, we use a cookieless, anonymous mode to measure aggregate usage without storing data on your device.

Essential Cookies

Required for the Service to function (authentication, session management). These do not require consent.

We also use browser storage for preferences such as your theme, screenplay font and writing controls, and to help recover unsaved work. This functional storage is separate from optional analytics.

Analytics Cookies (Opt-in Only)

• Google Analytics (GA4): Uses Google Consent Mode v2, IP anonymisation enabled, ad storage disabled. Loaded only when you explicitly consent. Used for page views and marketing attribution only.
• PostHog: EU-hosted product analytics with two modes:
  - Anonymous, cookieless aggregate measurement when analytics are disabled
  - Personalised analytics (persistent identifiers, richer journey analysis) only with your explicit consent

We do not use session recordings. Product analytics events are limited to operational metadata such as feature names, file types, export outcomes, counts, booleans, and pseudonymous internal IDs. We do not use analytics tools to collect the contents of your scripts, notes, uploaded files, assistant prompts, or assistant responses.

A cookie banner lets you accept or decline optional analytics. You can change your choice in Settings.

We do not use analytics cookies or persistent identifiers until you consent. If you do not consent, analytics remain in a cookieless anonymous mode for aggregate product measurement only.

5. Third-Party Processors

We use the following third-party services to provide our Service. We do NOT sell, rent, or share your personal data or content with third parties for advertising, marketing, or any other purpose except as described below.

Hosting & Data Storage

• Vercel: Hosts the application in the EU and processes requests needed to deliver the Service
• Supabase: Provides database and file storage in the EU for accounts, writing projects and uploaded files

AI Service Provider (OpenAI)

Purpose: Powers our Scriptor Assistant AI features through OpenAI's API.

Data Shared: When you use Scriptor Assistant, your files and prompts are sent to OpenAI to generate responses. Files are used only for context in that specific request.

Our Data Storage:We do NOT store your AI chat conversations, prompts, or AI-generated responses on our servers. We only pass this data through to OpenAI's API to generate responses. Your original files and screenplays remain stored on our servers (as described in Section 2), but AI chat data is not separately stored or logged by us.

Provider retention: We request that AI responses are not stored for later retrieval. OpenAI may retain prompts, responses and related metadata in abuse-monitoring logs for up to 30 days by default, with exceptions under its data controls policy. This is separate from storing your writing in Scriptor. See OpenAI's data controls.

Intellectual Property Protection:

• Your files are NOT used to train AI models
• Your content is processed only for the immediate request and is not stored for training purposes
• You retain all intellectual property rights to your content
• While OpenAI logs API requests for security monitoring, your content is not used for model training or improvement

Location: Outside the UK/EU. Data transfers are subject to appropriate safeguards (see Section 6).

Payment Processing

Stripe: Processes subscription payments and manages billing. We share email address, name and billing details. Card details are processed by Stripe; Scriptor does not store your full card number.

Analytics and Product Measurement

• Google Analytics: US-based. Enabled only with your consent and used for page views and marketing attribution. IP anonymisation enabled.
• PostHog: EU-hosted. Anonymous cookieless aggregate measurement may run under legitimate interests; personalised analytics are enabled only with your consent. Product analytics events are limited to metadata such as page views, feature usage, file type, file ID, export status, search result counts, error/diagnostic signals, and pseudonymous user identifiers. We do not send document contents or AI conversations to PostHog.

Authentication

Google OAuth: Allows you to sign in with your Google account. We receive name, email address, and profile image (if you choose to sign in with Google).

Service Emails and Support

Service Emails: We use email service providers to send verification emails and service-related communications.

When you contact support, we process your name, email address and message to respond to your enquiry. Contact form messages are delivered through Resend. We do not send marketing emails.

6. International Transfers

Some of our third-party service providers are located outside the UK/EU:

• AI service providers (United States)
• Payment processors (United States)
• Analytics providers (United States)
• Authentication providers (United States)
• Email delivery providers

When we transfer your data outside the UK/EU, we ensure appropriate safeguards are in place, including:

• UK Addendum to Standard Contractual Clauses (SCCs)
• Adequacy decisions by the UK government

Important: Despite these transfers, your files are NEVER used for AI training, regardless of where they are processed. However, API requests to OpenAI are logged for security and abuse monitoring purposes (retained for up to 30 days).

7. Data Retention

We retain your data only for as long as necessary:

• Account data and user content: Retained while your account is active, unless you delete content earlier. Account deletion removes your account and associated content from the application. This does not necessarily remove all copies held in backups, security logs or billing records at the same time. Limited records may be retained where necessary for security or legal obligations.
• Logs: Any logs relating to you are retained for 30 days (including security logs processed in Axiom), then deleted.
• Legal obligations: We may retain certain data to comply with legal obligations, resolve disputes, or enforce our agreements.

You can delete your account and all associated data at any time from your account settings page.

8. Security

We implement appropriate technical and organisational measures to protect your personal data:

• Encryption in transit (HTTPS/TLS)
• Controls designed to restrict access to stored personal data
• Secure authentication and session management
• Access controls and security audit logging

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Your Rights

Under UK GDPR, you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Correct inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data and content. You can delete your account and all associated data at any time from your account settings.
• Right to Restrict Processing: Request that we limit how we process your personal data in certain circumstances
• Right to Data Portability: Receive your personal data in a structured, commonly used format and transmit it to another service
• Right to Object: Object to processing of your personal data based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for personalised analytics at any time. This does not affect the lawfulness of processing before withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please contact us at support@scriptor.uk. We will respond to your request within one month (or inform you if we need more time).

Right to Lodge a Complaint

You can raise a data protection complaint by emailing support@scriptor.uk. We will acknowledge it within 30 days, investigate it without undue delay, keep you informed and tell you the outcome.

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

10. Children's Privacy

Our Service is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13.

If we become aware that we have collected personal data from a child under 13, we will delete it immediately. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@scriptor.uk.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending you an email notification (for significant changes)

You are advised to review this Privacy Policy periodically for any changes. Changes are effective when posted on this page.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Email: support@scriptor.uk
Address: Manchester, United Kingdom