Legal

Privacy Policy

Last updated: 2026-09-25 · Effective from the same date
Plain English summary

We collect what we need to run the platform — your account, your tenant data, and basic usage telemetry. We never sell data. We never train models on your content. Sub-processors are listed at /trust. You can export everything or delete your account at any time. If you connect Facebook or Instagram, section 11 explains what we receive from Meta and how to delete it. Questions: [email protected].

Privacy PolicyData DeletionTerms of ServiceData Processing AgreementCookie PolicyRefund & Install Guarantees

1. Who we are

Scarif One is the trading name of Thomas Joseph Conway, a United Kingdom sole trader providing AI marketing software (“Scarif One”, “we”, “us”, “our”). We are the data controller for personal data submitted through our website (scarifone.com) and accounts. For tenant-uploaded customer data (e.g. Shopify customer lists, brand profile content), we act as a data processor; the customer (you) remains the data controller. See our Data Processing Agreement for the controller/processor split.

Registered office: Hailsham, East Sussex, United Kingdom. UK ICO registration number forthcoming pre-launch.

2. What personal data we collect

2.1 Account data

Email address, hashed password (Argon2id), display name, time zone, account creation timestamp, login IP address, two-factor secret (if enabled), session tokens.

2.2 Billing data (hosted plan only)

Stripe Customer ID, subscription tier, billing email, country, last-4 of payment method (full card details never reach our servers — they live with Stripe). Invoices are stored for the legally-required retention period (currently 6 years for UK tax compliance).

2.3 Usage telemetry

API call counts, feature usage events, error logs, response timings. Used to operate the service, debug issues, and bill against per-plan quotas. We do not log content of generations.

2.4 Tenant content

Brand profile JSON, uploaded brand assets, generated ad / email / review content, integration tokens (encrypted at rest). Treated as your customer data — we are the processor, you are the controller.

2.5 Support correspondence

Email content of support tickets, screenshots / attachments you send us, transcripts of any video calls. Retained for 24 months unless you ask us to delete sooner.

3. Lawful bases (UK GDPR Article 6)

  • Contract (Art 6(1)(b)) — most account and billing processing is necessary to provide the service you signed up for.
  • Legitimate interests (Art 6(1)(f)) — usage telemetry for security, fraud detection, and service operation. We balance this against your privacy interests; opt-out via [email protected].
  • Consent (Art 6(1)(a)) — for non-essential cookies and any marketing emails (you can opt out at any time).
  • Legal obligation (Art 6(1)(c)) — invoice and tax record retention for HMRC compliance.

4. Sub-processors

We share specific personal data with third-party sub-processors who help us operate the service. The full list, with purpose and location, is at /trust. Sub-processor changes are announced 30 days before they take effect via email.

5. International transfers

Some sub-processors (Google Cloud / Gemini, Stripe) may transfer data to countries outside the UK / EEA, including the United States. These transfers rely on UK International Data Transfer Agreements and / or the EU-US Data Privacy Framework adequacy decision (where applicable), with Standard Contractual Clauses as a fallback. Contact us for documentation.

6. Retention

  • Account data: while your account is active. When you delete your workspace from the Security page it is removed from our live systems straight away; any subscription is cancelled and the owner’s login with our sign-in provider is deleted at the same time.
  • Billing data: 6 years after the relevant tax year, per HMRC requirements.
  • Usage telemetry: 90 days raw; aggregated indefinitely (no longer attributable to you).
  • Tenant content: deleted from our live systems straight away when you delete your workspace from the Security page, or within 30 days of a deletion request emailed to us.
  • Backups: encrypted backups expire after 30 days, so deleted data is gone from them within 30 days.
  • Deletion records: when a workspace is deleted we keep a short record (the time, the workspace, who asked and the IP address they asked from) as proof that the deletion happened.
  • Support correspondence: 24 months from the last interaction.

7. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you (one-click JSON export from your dashboard).
  • Rectification of inaccurate data.
  • Erasure (one-click tenant deletion from /security in the dashboard, or by emailing [email protected]).
  • Restriction of processing in certain circumstances.
  • Data portability (the JSON export covers this).
  • Object to processing based on legitimate interests.
  • Withdraw consent at any time where we rely on consent.
  • Lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.

We respond to data subject requests within 30 days.

8. Security

We implement technical and organisational measures including TLS 1.3 transport encryption, Argon2id password hashing, encrypted-at-rest databases, per-tenant data isolation, audit logging, role-based access control, and rate limiting. Full breakdown at /trust. No system is perfectly secure; we will notify affected users and the ICO within 72 hours of becoming aware of a personal data breach.

9. Children

Scarif One is a B2B product. We do not knowingly collect data from anyone under 16. If we discover otherwise, we will delete the data and close the account.

10. Marketing communications

We send transactional emails (sign-up, billing, security notifications) on the basis of contract — these can’t be opted out of without closing your account. Marketing emails (product updates, blog posts) are opt-in only. Unsubscribe at any time via the link in every marketing email.

11. Facebook, Instagram and Meta advertising

This section applies when you connect a Facebook Page, an Instagram business account or a Meta ad account to Scarif One. Meta Platforms is the company behind Facebook and Instagram. It explains what we receive from Meta, what we send to Meta on your instructions, and how to have it deleted. For this data you, the business connecting the account, are the controller and we are your processor, as described in section 1 and our Data Processing Agreement. Meta’s own handling of data is covered by Meta’s privacy policy.

11.1 What we receive from Meta

  • The accounts you connect: the IDs, names, usernames, category, status and currency of the Pages, Instagram accounts and ad accounts you choose, and the list of permissions you granted.
  • Posts you have already published on those accounts (captions, image and video links, dates and links), which we import into your content library.
  • Your advertising data: campaigns, ad sets (including their targeting settings), ads, creatives and saved audiences, with performance figures such as spend, reach, impressions, clicks, conversions and conversion value, including age, gender and placement breakdowns. Meta gives us these figures in aggregate — we do not receive the identities of the people who saw or clicked your ads.
  • Catalogue and pixel details: the IDs of the product catalogues you connect and event counts from your Meta pixel.
  • Access tokens that let us act for you.

We do not read your private messages, or comments people leave on your posts.

11.2 What we send to Meta on your instructions

  • Posts, reels, images, videos and captions you publish or schedule from Scarif One.
  • Ads you build: campaigns, ad sets and ads, created paused so nothing spends until you switch them on.
  • Product details from your store, if you turn on catalogue sync.
  • Purchase, add-to-cart and checkout events from your store to your Meta pixel through Meta’s Conversions API, if you turn it on. Shoppers’ email addresses, phone numbers, names and addresses are hashed (SHA-256) before they leave our servers; their IP address and browser details are sent as Meta requires.
  • Customer lists for Custom and Lookalike Audiences, if you choose to create one. Each entry is hashed (SHA-256) before it is uploaded.

For your shoppers’ data you remain the controller; we process it only to carry out these instructions.

11.3 How we use it

Only to run Scarif One for you: your dashboards and reports, recommendations, the posts and ads you ask us to create, and checking that changes took effect. Some of that work uses AI. The Marketing Engine’s daily summary, recommendations, creative analysis and weekly strategy memo send the figures and ad details they need to Google Gemini. Ask the Engine does the same, and can include the ad images you are discussing; it uses Anthropic’s Claude instead when you connect your own Anthropic key. If you connect your own AI app to Scarif One (for example with Connect Claude), the figures you ask it about are sent to that app. How an AI provider handles what it receives is governed by its own terms — for a key you connect, the terms of your account with that provider. We never sell this data, never use one customer’s data for another customer, and never use it to train AI models ourselves.

11.4 Where it is kept and how it is protected

It is stored with the rest of your workspace on our servers in the UK (Fly.io, London). Traffic between your browser and our servers is encrypted in transit (TLS) and passes through Cloudflare, which protects and delivers our site. Encrypted off-site backups are held by our backup storage provider (named, with its location, at /trust). When your weekly summary email includes your advertising figures, it is delivered by our email provider, Resend. Access tokens are encrypted at rest (AES-256-GCM), kept separately for each workspace, used only on our servers, never sent to your browser and not written to our logs. Connections, disconnections and changes applied to your ad accounts are recorded in your workspace’s audit log.

11.5 How long we keep it

  • Access tokens: until you disconnect or delete your workspace. Disconnecting deletes them straight away.
  • Reports, imported posts and ad history: kept in your workspace so your history stays available, until you ask us to delete them or you delete your workspace.
  • Backups: encrypted backups expire after 30 days.

11.6 Deleting it

Our data deletion instructions explain, step by step, how to stop Scarif One accessing your Meta accounts and how to have everything we received from Meta deleted. In short: disconnect Meta in Integrations, remove Scarif One from Facebook’s business integrations, and email [email protected] — we confirm by email and finish within 30 days. Deleting your whole workspace from the Security page removes it all at once.

12. Changes to this policy

Material changes are announced 30 days before they take effect via email to your notification address. Non-material changes (typo fixes, link updates) are silent. The “Last updated” date at the top of this page reflects the most recent change.

13. Contact

Privacy questions, DSAR requests, complaints: [email protected].
General correspondence: [email protected].
Postal address available on request.

Questions about this document? Email [email protected] for privacy / DPA questions, [email protected] for everything else. Tom replies within a few hours during UK office hours.