Privacy Policy

This policy explains what information Scroll Fuel collects when you use scrollfuel.io and the Scroll Fuel application, why we collect it, who we share it with, and what control you have over it. It covers the website and the logged-in product together.

Information we collect

We collect the following categories of information:

• Account information. Your email address, your name if you provide one, and a cryptographically hashed password. We never store your password in readable form.
• Store and product information. If you connect an e-commerce store, we receive the store domain, an access credential issued by that platform, and product data such as titles, descriptions, prices, and images. We use this to generate ad creative for your products and to attribute sales to the ads that produced them.
• Content you create and we generate. Prompts, briefs, product references, and the images, videos, and ad copy produced on your behalf.
• Billing information. Subscription status, plan, and payment history. Card numbers are handled entirely by Stripe and never reach our servers or our database.
• Technical and usage information. Log data, IP address, browser and device type, pages requested, and error diagnostics generated when something breaks.
• Correspondence. Messages you send us for support, and our replies.

How we use it

• To provide the service: generating creative, storing your assets, and running your account.
• To process payments, manage subscriptions, and send billing notices.
• To send transactional email such as sign-in, account, and support messages.
• To diagnose errors, monitor reliability, prevent abuse, and keep the service secure.
• To comply with legal obligations.

We do not sell your personal information, and we do not share it with advertising networks or data brokers.

Service providers

We use a small set of third-party providers to run the service. Each receives only the data needed for its function:

• Vercel — application hosting and content delivery.
• Neon — managed Postgres database where your account and project data lives.
• Stripe — payment processing and subscription billing.
• Resend — transactional and account email delivery.
• Sentry — error monitoring and diagnostics.
• AI model providers — including Replicate, WaveSpeed, and ElevenLabs, which process the prompts, product references, and briefs needed to generate your creative.
• Object storage providers — including Vercel Blob, Cloudflare R2, and Amazon S3, which store the media files we generate for you.

We may also disclose information where required by law, to enforce our Terms of Service, or in connection with a merger, acquisition, or sale of assets — in which case we will give notice before your information becomes subject to a different policy.

Cookies

We use cookies that are strictly necessary to operate the product: a session cookie that keeps you signed in, and security cookies that protect sign-in forms. We do not run advertising pixels, third-party analytics trackers, or cross-site behavioural tracking on this site.

Retention

We keep account and project data for as long as your account is active. If you close your account, we delete or anonymise your personal information within 90 days, except where we are required to retain records — for example, billing and tax records, which we keep for the period required by law. Backups are purged on their own rotation, normally within 35 days.

Security

Data is encrypted in transit using TLS and encrypted at rest by our hosting and database providers. Passwords are stored as salted hashes. Access to production systems is limited to people who need it to operate the service. No system is perfectly secure, and we cannot guarantee absolute security, but we will notify affected users without undue delay if we become aware of a breach affecting their personal information.

Your rights

You can request access to the personal information we hold about you, ask us to correct it, ask us to delete it, or ask for a copy in a portable format. Depending on where you live, you may also have the right to object to or restrict certain processing, and to withdraw consent where processing relies on it. To make a request, email hello@scrollfuel.io. We respond within 30 days. We will not discriminate against you for exercising these rights.

International transfers

Our providers operate in the United States and other countries. If you access the service from outside those countries, your information will be transferred to and processed there, under appropriate safeguards for such transfers.

Children

The service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy as the product changes. We will revise the date at the top of this page, and for material changes we will notify account holders by email before the change takes effect.

Contact

Questions or privacy requests: hello@scrollfuel.io, or by post at ScrollFuel, 3340 Sollers Point Rd, Dundalk, MD 21222.