Privacy notice

1. Who we are

ScriptPreflight is operated by UrbanNerd Consulting (Pty) Ltd, South Africa, which is responsible for your personal information: the “responsible party” under South Africa’s Protection of Personal Information Act (POPIA) and the “controller” under the EU and UK GDPR.

For privacy questions and data requests, email privacy@scriptpreflight.com. This is also the contact for our Information Officer.

Paddle (Paddle.com Market Ltd and its group) is the merchant of record and reseller for all purchases. Paddle handles payment, tax, invoicing and refunds under its own buyer terms and privacy notice.

2. What we collect

Your account

• Your name and email address, and the sign-in method you used. If you sign in with Microsoft, Microsoft Entra ID confirms who you are and sends us your name and email; we never receive your password. If you use an email link, we send a one-time link to your address.
• Workspace details: workspace name, country, report timezone, members, their roles, and invitations you send (the invitee’s email address).
• Your settings, including whether you opted in to product emails.

Scripts

• Temporary preflights: common secret patterns are redacted in your browser before upload and again on our server. The redacted text is held only while the preflight runs and is then deleted. We keep the script’s title, size and line count, and a keyed one-way fingerprint of it.
• Saved scripts (paid plans only): redacted again on our server, then encrypted per version before they are stored. See our security page.

Reports

• Findings, with short evidence snippets of the flagged lines, line numbers, rule and catalogue versions, and what could not be analysed. Reports keep the flagged lines, not the whole script.

Usage and billing

• A usage ledger: an append-only record of each preflight reserved, completed or released, by user and workspace, so allowances and the 3-preflight trial limit hold across workspaces.
• A record of actions in a workspace (who did what, and whether it worked).
• Engine usage data, so we can measure and improve the analysis: for each preflight, which rules fired and how severe they were, the verdict and coverage, the language, timings, and the engine and ruleset versions. It is linked to your workspace only by a keyed hash, never by your name or email. Names of commands the engine didn’t recognise are also counted by a keyed hash; a command’s name itself is kept only once the same command has been seen in at least three different workspaces. No script content is kept for this.
• Billing details from Paddle: your plan, billing interval, subscription status and dates, and Paddle’s customer and subscription IDs. We never receive card details.

Emails and waitlists

• Records of the emails we send you (address, type of email, delivery status), and a list of addresses that bounced or complained so we stop sending to them.
• If you join a waitlist: your email address and which list you joined.

Website visits and cookies

• Cookieless visit counting on marketing pages: page address, referring site, campaign tags, screen size group, browser language and country. Only if you allow Analytics, a one-way daily fingerprint so we can count unique visitors. Your IP address is used for a moment to find your country and make that fingerprint, and is never stored. Full details are in our cookie policy.
• Your cookie choice: an anonymous consent ID, your choice per category, the policy version and the time. No IP address and no browser details.
• If you allow Analytics and sign up, the campaign tags of the visit that brought you here, stored with your account.

Abuse prevention

• Rate-limit counters and abuse events keyed to your user ID or to a keyed hash of your IP address (never the raw IP address), and the Cloudflare Turnstile check on the free checker and waitlist.

When you contact us

• The emails you send us and our replies.

3. What we never log

Our server logs never contain script content, reports, findings, rewrites, email addresses or secrets. Server functions can only log a fixed list of fields: record IDs, processing states, timings, error codes and attempt counts.

4. Why we use it, and our lawful bases

• To provide the service you signed up for: sign-in, workspaces, preflights, reports, saved scripts and service emails. Basis: performing our contract with you (POPIA s11(1)(b); GDPR Art. 6(1)(b)).
• To bill you through Paddle and keep the records tax law requires. Basis: contract and legal obligation (POPIA s11(1)(b) and (c); GDPR Art. 6(1)(b) and (c)).
• To enforce allowances and the trial limit, prevent abuse and keep the service secure. Basis: our legitimate interest in a working, fair and secure service (POPIA s11(1)(f); GDPR Art. 6(1)(f)).
• To count visits without a fingerprint. Basis: legitimate interest in knowing how the site is used (POPIA s11(1)(f); GDPR Art. 6(1)(f)). The daily fingerprint and campaign attribution only with your consent (POPIA s11(1)(a); GDPR Art. 6(1)(a)).
• To send product emails, only if you opt in. You can unsubscribe from any of them. Basis: consent (POPIA s11(1)(a) and s69; GDPR Art. 6(1)(a)).
• To keep a record of your cookie choice, so we can show what you agreed to. Basis: legal obligation and legitimate interest (GDPR Art. 7(1); POPIA s11(1)(c) and (f)).

5. How long we keep it

• Script text for a preflight (redacted): Deleted as soon as the preflight finishes, and in any case within about 30 minutes.
• Trial reports: 7 days.
• Individual plan reports: 180 days.
• Team plan reports: 365 days.
• Account, workspace and saved scripts: While your account and workspace exist. Account deletion requests are due for completion within 30 days.
• Raw visit records (analytics): 13 months, then reduced to daily totals with no visitor fingerprint.
• Daily analytics salt: Replaced and deleted every 24 hours.
• Abuse-prevention events: 30 days.
• Rate-limit counters: 1 day.
• Daily AI usage counts (no personal information): 90 days.
• Engine usage records (no script content): 13 months, then reduced to daily totals.
• Team invitation links: Expire after 7 days.

A report’s retention is set by the plan the workspace had when the preflight ran. When a paid plan ends, the workspace becomes read-only and its history is kept for its retention period.

6. Who processes it for us

We don’t sell your personal information. These providers process it on our behalf, only to run the service:

• Supabase

  Purpose

  Database, sign-in and the server functions that run the service.

  Hosting region

  Ireland (eu-west-1)

• Microsoft Azure

  Purpose

  The parse-only analysis engine (Container Apps) and the key that protects saved scripts (Key Vault).

  Hosting region

  West Europe / Germany West Central

• Paddle

  Purpose

  Merchant of record: checkout, payments, tax, invoices and refunds.

  Hosting region

  As set by the provider

• Resend

  Purpose

  Sending account and service emails, and product emails you opt in to.

  Hosting region

  As set by the provider

• Cloudflare

  Purpose

  Website hosting network and the Turnstile bot check on the free checker and the waitlist.

  Hosting region

  As set by the provider

• Lovable

  Purpose

  Hosts the website and counts visits for the hosting dashboard (through its analytics service, Tinybird).

  Hosting region

  As set by the provider

No AI provider receives your data: AI features are switched off, and reports are built from deterministic rules only. We will add any new provider to this list before it receives personal information.

We may also disclose information where the law requires it.

7. Transfers outside South Africa

Our providers process information outside South Africa, so using ScriptPreflight transfers your personal information out of South Africa. These transfers are covered by each provider’s data processing terms.

To ask about these transfers, email privacy@scriptpreflight.com.

8. Security

Scripts are never executed, secrets are redacted in your browser and on our server, saved scripts are encrypted per version, and every workspace’s data is isolated in the database. The details are on our security page.

9. Your rights

Under POPIA and, where it applies, the EU or UK GDPR, you can ask us to:

• tell you what personal information we hold about you and give you a copy (access);
• correct it (correction);
• delete it (deletion);
• stop or limit using it, including for direct marketing (objection and restriction);
• give it to you in a commonly used, machine-readable format (portability).

Email privacy@scriptpreflight.com from the address on your account. You can also request account deletion in Settings, change product email preferences in Settings or with the unsubscribe link in any product email, and change your cookie choice with “Cookie settings” at the foot of every page of this website. Where we rely on consent, you can withdraw it at any time; that doesn’t affect what happened before.

If you are unhappy with how we handle your information, you can complain to the Information Regulator (South Africa) or, in the EU or UK, to your local data protection supervisory authority. We would like the chance to put things right first.

10. Children

ScriptPreflight is for people aged 18 and over. We don’t knowingly collect information about children; if we learn that we have, we delete it.

11. Changes to this notice

Each version of this notice has a version number and date at the top of this page. If a change materially affects you, we will tell you by email or in the app before it takes effect.