Privacy Policy

This Privacy Policy explains what personal data the SCRIPE marketing website ("this Site" — the pages under scripe.org you are reading right now) collects, why, how it is handled, and what choices you have. It covers this Site only. The SCRIPE product application used by onboarded organizations is governed by its own agreement, issued directly to your organization during onboarding — not by this document.

We wrote this policy in-house, in plain language, so this Site would not go live collecting information with no policy at all. As the notice at the top of this page says, it is scheduled for review by outside counsel before commercial launch, and may change as a result.

We collect personal data in exactly two ways, both described below. We do not buy data about you from anyone else, and we never combine what you give us with data purchased from a third party.

• Contact form — when you submit the demo-request form on our Contact page, we collect your name, email address, organization name, organization type, an optional phone number, and the message you write. Every field except phone is required.
• Anti-spam signals — the same form quietly carries two anti-abuse mechanics: a hidden field a genuine visitor never sees or fills in, and a minimum-time check. Both exist only to tell a human submission from an automated one; neither is sent to our backend or stored anywhere.
• Device-local preferences — your color-theme choice, and, on the Pricing page, a currency override if you pick one, are saved only in your own browser's local storage. See "Local Storage, Not Cookies" below.
• Standard hosting logs — like almost every website, our hosting provider (Vercel) automatically records basic request information (IP address, browser identifier, requested page, timestamp) for security and reliability. We do not query these logs for marketing or profiling.

We use contact-form information for exactly one purpose: to respond to your enquiry and, if you are interested, to arrange a sales-assisted onboarding conversation. We do not add you to a marketing list from a form submission, we do not sell or rent your information, and we do not use it to build an advertising profile.

As of the effective date below, this Site's contact form is not yet connected to a live inbox. Submitted details reach our website's own server to be validated, but are not forwarded to any CRM or lead-management system and are not written to a database — nothing is retained once that request completes. The form tells you this honestly ("not yet connected") rather than pretending your message reached a team. We intend to connect a live backend before commercial launch; this section will be updated the moment that happens.

We never log the contents of a submission, including when delivery fails — at most a non-personal status code, never your name, email, organization, phone number, or message.

We rely on two lawful bases, in the framing most data-protection laws use:

• Consent — submitting the contact form is a deliberate, informed action: you choose to give us your details in order to be contacted. You can withdraw that consent at any time by asking us to delete what you sent (see "Your Rights" below).
• Legitimate interest — standard hosting logs are processed under our legitimate interest in keeping this Site secure, reliable, and free of abuse, an interest we believe does not override your own privacy interests given how limited and short-lived that data is.

We do not rely on any other legal basis for this Site — it does not perform a contract with individual visitors, and it does not process data under a specific law that requires it to.

This Site sets no cookies. We built it that way deliberately — even the language you are reading this in is resolved from the page's URL and your browser's language settings, never stored in a cookie.

One small preference lives in your browser's own local storage instead, and never leaves your device:

• scripe-currency — remembers a currency you manually chose on the Pricing page, if any.

Local storage is not a cookie: it is never sent to our server, or anyone else's, with a page request; it is not visible to us in any log; and it is entirely under your control — clearing your browser's site data removes it instantly.

This Site loads no analytics package, no advertising pixel, no chat widget, and no third-party font or script of any kind. Every font is hosted on our own server; the only two inline scripts on the page are ours, and both exist purely to set the page's colour scheme before it paints and to detect whether JavaScript is enabled — neither one contacts any server.

We think this is worth stating plainly rather than in boilerplate: most marketing websites quietly load a dozen third-party trackers before a visitor makes a single click. This one does not, today — and it will not without this policy being updated first.

We keep the little personal data this Site handles for only as long as the purpose above requires:

• Contact-form data, once a live backend is connected, will be retained only for as long as needed to respond to your enquiry and complete a resulting sales conversation, then deleted or anonymized.
• Device-local preferences persist only in your own browser, under your control, until you clear them.
• Standard hosting logs are retained on Vercel's own standard schedule, which we have not overridden with a longer retention period.

We use security measures appropriate to the small amount of data involved: this Site is served entirely over HTTPS, the contact form is protected against automated abuse (see "Information We Collect" above), and no personal data is ever written to our error-tracking output.

This Site is hosted on Vercel's global infrastructure, which may process a request through servers located in a different country from where you are browsing. Separately, our Pricing page may call the SCRIPE backend to suggest a currency for your region; that backend detects your country from a network-level header supplied by our infrastructure provider, not from anything this Site sends it — this Site itself does not store your IP address.

Wherever you are located, and whichever specific data-protection law applies to you, we will honor reasonable requests to:

• Access the personal data we hold about you.
• Correct any of it that is inaccurate or out of date.
• Delete it, including a contact-form submission you no longer want us to have.
• Object to, or ask us to restrict, how we use it.

To exercise any of these rights, use the route described in "Contact Us" below. We will respond as quickly as we reasonably can.

This Site is a business-to-business marketing website addressed to owners, directors and operations leaders of sports organizations. It is not directed at children, and we do not knowingly collect personal data from anyone submitting the contact form on behalf of a child. If you believe a child has submitted personal data to us, contact us using the route below and we will delete it.

We may update this policy as this Site, our data practices, or the law change — most immediately once outside counsel reviews it before commercial launch (see the notice at the top of this page). We will update the effective date below whenever we do, and for any change we consider material, we will make it clearly visible on this page rather than editing it quietly.

The most reliable way to reach us about this policy, or to exercise any of the rights above, is the form on our Contact page. As of the effective date, this Site does not yet have a published, monitored email address for privacy requests specifically — see "How We Use Your Information" above for why the form itself is not yet connected to a live inbox. Until both of those are in place: if you already have a SCRIPE contact from an onboarding conversation, reach them directly; otherwise, please check back, as this section will name a monitored inbox the moment one exists.