Privacy Policy
Last updated: October 25, 2026
1. Controller
Max Benz, Am hohen Stein 36a, 01189 Dresden, Germany. Email: team@scoutsaas.com. This address also handles all privacy requests. We have not appointed a data protection officer because we are not legally required to.
2. Purposes, data, legal bases, recipients and retention
| Purpose | Data | Legal basis | Recipients | Retention |
|---|---|---|---|---|
| Hosting and delivery of the website | IP address, requested URL, timestamp, response status, user agent | Art. 6(1)(f) GDPR (legitimate interest in a secure and reliable service) | Cloudflare | Server logs: not kept by us beyond what Cloudflare retains for operation and security; no profile is built |
| Account creation and login by email code | Email address, display name, hashed single-use code, hashed session token, IP address for rate limiting | Art. 6(1)(b) GDPR (performance of the contract) | Twilio SendGrid (delivers the code), Cloudflare | Login codes: minutes until they expire, then removed. Sessions: 14 days or until revoked. Account data: while the account exists |
| Providing the workspace (records, documents, comments, activity history) | Content your team enters, uploaded files, member emails and roles, actor and time of changes | Art. 6(1)(b) GDPR | Cloudflare (D1 database, R2 storage) | While the workspace exists. After deletion of the workspace we remove the data; statutory retention duties remain unaffected |
| Subscription, payment and invoicing | Billing customer and subscription identifiers, status, billing period dates, invoice data, payment data handled by Stripe | Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR for tax and accounting duties | Stripe Payments Europe Ltd., Stripe Inc. | Accounting records for 8 years under German tax and commercial law (§ 147 AO, § 257 HGB) |
| Invitations and system emails | Recipient email address, invitation or message content, delivery status | Art. 6(1)(b) GDPR | Twilio SendGrid, Resend (only if configured by the workspace) | Invitation tokens: 7 days. Delivered email bodies are removed from the outbox |
| Optional reminder emails | Email address, reminder preferences, reminder content | Art. 6(1)(a) GDPR (consent, which you can withdraw at any time in the app) | Twilio SendGrid, Resend (only if configured by the workspace) | Until you withdraw consent or delete the workspace |
| Connecting an AI assistant through MCP (optional) | Workspace records that the assistant requests with your key, hashed key, expiry and last-use time | Art. 6(1)(b) GDPR | Provider of the assistant you choose (under your own agreement with it) | Keys: until expiry (1 to 90 days) or revocation |
| Security, abuse prevention and legal claims | Rate-limit counters, activity history, technical request data | Art. 6(1)(f) GDPR | Cloudflare | Short-lived counters; activity history while the workspace exists |
| Answering your emails | Email address, message content | Art. 6(1)(b) or (f) GDPR | Our email provider | Until the matter is resolved, then according to statutory retention duties |
Providing your email address and workspace data is necessary to create an account and use the service (Art. 13(2)(e) GDPR). Without it we cannot provide Scout SaaS. Card details are handled by Stripe and are not stored in our database.
3. Processors and international transfers
We use the following processors under data processing agreements (Art. 28 GDPR). Where data is processed in the USA, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, supported by Standard Contractual Clauses (Art. 46 GDPR).
| Provider | Service | Transfer mechanism |
|---|---|---|
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | Hosting, content delivery, database (D1) and file storage (R2) | EU-US Data Privacy Framework (certified) and Standard Contractual Clauses |
| Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland, and Stripe, Inc., USA | Checkout, payment methods, invoices and billing portal | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Twilio SendGrid, Inc., 1801 California Street, Suite 500, Denver, CO 80202, USA | Delivery of login codes, invitations and reminders | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Resend (only if the workspace configures it) | Delivery of invitations and opted-in reminders from the workspace’s own sender | Standard Contractual Clauses |
If you connect an AI assistant through MCP, the data that the assistant requests is shared with that assistant’s provider under your own agreement with it. As a business customer you can request a data processing agreement for the workspace data you store with us by email.
4. Cookies and local storage
We only use storage that is technically necessary. This is a session cookie that keeps you logged in (HTTP-only, expires after 14 days or when you log out), your cookie consent choice, and a local-storage entry that remembers which workspace you selected. The legal basis is § 25(2) No. 2 TDDDG, and processing of any personal data involved rests on Art. 6(1)(f) GDPR. We do not use analytics, advertising or marketing cookies, and we do not load external fonts or scripts on public pages. A consent manager lets you review or change your choice at any time through the “Cookie settings” link in the footer.
5. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Where processing is based on consent, you can withdraw it at any time with effect for the future. Write to team@scoutsaas.com to exercise these rights.
6. Right to lodge a complaint
You may complain to a supervisory authority. The authority responsible for us is Die Sächsische Datenschutz- und Transparenzbeauftragte, Devrientstraße 5, 01067 Dresden, Germany.
7. Automated decision making
We do not use automated decision making or profiling within the meaning of Art. 22 GDPR.
8. Changes
We update this policy when the service or the law changes. The date of the last update is shown at the top of this page.