Privacy Policy

1. Introduction

Scapelens ("we," "us," or "our") operates the Scapelens website (the "Service"). This Privacy Policy explains what personal data we collect, how we use it, and the choices and rights available to you.

We are committed to protecting your privacy and to the principle of data minimization. We collect and process only the personal data that is reasonably necessary for the purposes described in this Privacy Policy.

We process personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), where applicable.

2. Data Controller

The data controller responsible for your personal data is:

Scapelens
[Legal entity name]
[Registered address]
[Country]
Email: [email protected]

If you have questions about this Privacy Policy or wish to exercise your data protection rights, you may contact us using the details above.

3. Personal Data We Collect

3.1 Information You Provide

We may collect the following personal data that you provide directly to us:

• Account information — If you create an account, we collect your email address and certain account authentication information. Depending on the authentication method used, login credentials may be processed directly by our authentication provider rather than stored by us.
• Communications — If you contact us, we collect the content of your message and your contact details.

3.2 Information Collected Automatically

We may automatically collect limited technical information necessary to operate, secure, and measure the Service, including:

• Usage data — Pages visited, session activity, interactions, referral sources, and general navigation patterns. Analytics data is collected only if you consent where consent is required by law.
• Device and browser information — Such as browser type, operating system, language preferences, approximate device characteristics, and similar technical metadata.
• IP address and request metadata — Your IP address is processed by our web server as a technical necessity of delivering the Service. When analytics is enabled, Google Analytics may process your IP address and apply IP anonymization or truncation in accordance with its configured settings.
• Approximate location — IP addresses may indicate approximate geographic location at country or region level. We do not collect precise geolocation data such as GPS coordinates.
• Cookies and similar technologies — See our Cookie Policy for details.

3.3 Information We Do Not Intentionally Collect

We do not intentionally collect:

• Payment card or banking information
• Precise geolocation data such as GPS coordinates
• Sensitive personal data such as data revealing racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data, except where you choose to provide it to us in a communication
• Personal data from children under the age of 16

If you voluntarily provide sensitive personal data to us, we will process it only as necessary to address your communication, comply with law, protect rights, or otherwise as permitted by applicable law.

4. How We Use Personal Data

We use personal data for the following purposes:

• To provide, operate, maintain, and improve the Service
• To authenticate users and manage account access
• To understand how the Service is used, where analytics is enabled
• To protect the security, integrity, and availability of the Service
• To communicate with you and respond to inquiries
• To comply with legal obligations and enforce our legal terms

5. Legal Bases for Processing (EEA/UK)

If you are located in the EEA or the UK, we process personal data under one or more of the following legal bases:

• Consent — For analytics cookies and associated analytics processing where consent is required by law. You may withdraw consent at any time through our Cookie Settings.
• Legitimate interests — For limited technical and operational processing, including server logs, request metadata, abuse prevention, service security, debugging, and maintaining availability, where such interests are not overridden by your rights and freedoms.
• Contract — Where processing is necessary to provide account-related functionality or otherwise perform a service you request from us.
• Legal obligation — Where processing is necessary to comply with applicable law, lawful requests, or regulatory obligations.

6. Recipients of Personal Data

We may disclose personal data to the following categories of recipients where necessary for the purposes described in this Privacy Policy:

• Service providers that support hosting, infrastructure, security, analytics, authentication, communications, and technical operations
• Professional advisers, auditors, insurers, and legal representatives where reasonably necessary
• Regulators, courts, law enforcement, or public authorities where required by law or where necessary to protect rights, safety, and legal interests
• Successors, acquirers, investors, or counterparties in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality and legal safeguards

7. Third-Party Services

7.1 Google Analytics 4

If you provide consent where required by law, we use analytics tools to understand how visitors interact with the Service.

These tools may collect usage and device-related data (such as pages visited, interactions, and approximate location derived from IP address) and may process such data on servers located outside your country of residence.

Analytics is only enabled after consent where required. You can withdraw your consent at any time through the Cookie Settings.

7.2 Authentication Provider

We use a third-party authentication provider to support user sign-in and account authentication. This provider processes authentication data on our behalf in accordance with contractual obligations and applicable data protection law. We receive only the data reasonably necessary to identify and manage your account, such as your email address.

7.3 Hosting and Infrastructure Providers

We use third-party hosting and infrastructure providers to operate the Service. These providers may process limited technical and account-related data on our behalf subject to contractual and security obligations.

8. International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence, including the United States.

Where required by applicable law, we rely on appropriate safeguards for such transfers, which may include:

• Standard Contractual Clauses approved by the European Commission or UK authorities, as applicable
• Participation in the EU-U.S. Data Privacy Framework or UK extension, where applicable
• Other lawful transfer mechanisms recognized under applicable law

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to satisfy legal, operational, security, and record-keeping needs.

In general:

• Account data — Retained while your account is active and for up to 12 months after account deletion, unless a longer retention period is required or justified by law, dispute resolution, fraud prevention, or security needs.
• Communications — Retained for as long as necessary to address the inquiry and for up to 12 months thereafter for record-keeping, quality, or legal purposes.
• Server logs and related security records — Typically retained for up to 30 days unless a longer period is necessary for investigation, security, or legal reasons.
• Analytics data — Retained according to the applicable analytics configuration and retention settings in place at the relevant time.
• Cookie consent records — Retained for as long as reasonably necessary to demonstrate consent choices and compliance.

10. Automated Decision-Making and Profiling

We do not use personal data to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

The Service may generate analytical outputs using computational methods, but these outputs are informational only and are not decisions about you as an individual.

11. Your Privacy Rights

11.1 EEA/UK Rights

If you are located in the EEA or the UK, and subject to applicable law, you may have the right to:

• Access your personal data
• Request correction of inaccurate or incomplete personal data
• Request deletion of personal data
• Request restriction of processing
• Object to processing based on legitimate interests
• Request data portability
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your local supervisory authority

11.2 California Rights

If you are a California resident, and subject to applicable law, you may have the right to:

• Know what categories of personal information we collect, use, disclose, sell, or share
• Request deletion of personal information
• Request correction of inaccurate personal information
• Access specific pieces of personal information, subject to applicable exceptions
• Opt out of the sale or sharing of personal information
• Limit the use and disclosure of sensitive personal information, where applicable
• Receive non-discriminatory treatment for exercising your privacy rights

We do not sell personal information, share personal information for cross-context behavioral advertising, or use personal information for targeted advertising.

12. Data Security

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include encrypted transport, access controls, monitoring, abuse protections, security reviews, and related safeguards appropriate to the nature of the data and the Service.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children's Privacy

The Service is not directed to children under the age of 16, and we do not knowingly collect personal data from children under 16. If you believe that a child has provided us with personal data, please contact us and we will take appropriate steps consistent with applicable law.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and take any additional steps required by applicable law.

Your continued use of the Service after the effective date of the updated Privacy Policy will be subject to the updated Privacy Policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

Scapelens
Email: [email protected]

We will respond within the time required by applicable law.