Privacy Policy

1. Who we are

Luminous Emporium Ltd, registered in England and Wales, registered office at 124-128 City Road, London, United Kingdom, EC1V 2NX, company number 16201976, is the controller of personal data processed through scatterpost for the purposes of UK GDPR.

2. What we collect and why

Account details (name, email address) to create and secure your account, under the lawful basis of performance of a contract. Workspace content (articles, scheduling data, analytics) to provide the service, under performance of a contract. Platform connection details, including access tokens for the platforms you connect, encrypted at rest, under performance of a contract. Billing details, handled by Stripe, under performance of a contract and our legitimate interest in being paid. Usage data from Sentry, PostHog and, once you accept analytics cookies, Google Analytics, under our legitimate interest in keeping the service working and improving it, where those tools are enabled. We process IP addresses for security and to limit abuse, for example rate limiting sign-in emails and sign-ups, under our legitimate interest in keeping the service secure. One check holds the IP address itself in server memory for up to an hour before discarding it; a second stores a keyed cryptographic hash of it, which cannot practically be reversed, for up to 24 hours. We never use IP addresses for marketing. Vercel and Supabase, as our hosting and database processors, also log IP addresses in their own infrastructure logs; see the subprocessors page.

3. Retention

We keep account and workspace data for as long as your workspace exists. Deleting a workspace deletes its content and deletes its platform tokens from our systems. We keep billing records for as long as required by tax law. Error and analytics data is kept for a limited period set by Sentry and PostHog's own retention settings, and for Google Analytics, as configured in Google Analytics.

4. Your rights

Under UK GDPR you can ask us to confirm what personal data we hold about you, correct it, delete it, restrict or object to our processing of it, or receive a copy of it in a portable format. Contact us at hello@scatterpost.io to exercise any of these rights. If you are not satisfied with our response, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

5. Subprocessors

We use other companies to help provide scatterpost. The full list, with what each one does and where it operates, is on the subprocessors page. It includes Supabase (database and authentication, London, no international transfer), Vercel (hosting), Stripe (payments), Resend (transactional email), Anthropic via the Vercel AI Gateway (in-dashboard AI generation), Sentry (error tracking), PostHog (product analytics, EU cloud) and Google Analytics (website analytics, only after you accept analytics cookies, EU with transfers to the USA under the EU-US Data Privacy Framework and Standard Contractual Clauses). Where a subprocessor is outside the UK and the EEA, the subprocessors page names the specific safeguard we rely on for that transfer.

6. Security

Platform access tokens and webhook secrets are encrypted at rest. Access to your workspace data is controlled by row-level security tied to your workspace, and API keys are hashed and revocable.

Internal admin access: authorised scatterpost staff can view account and workspace details, such as your plan, members, channel names and statuses, posts and publication history, and any bug reports you send, to provide support, investigate problems and prevent abuse. Staff access requires a second sign-in factor, never shows your platform credentials, API keys or access tokens, and every view and change is recorded in an internal audit log.

7. Cookies

On our public pages we ask before any non-essential cookie is set. A first-party cookie called scatterpost_consent records your choice, "granted" or "denied", for 12 months. Product analytics through PostHog and Google Analytics only starts on those pages once you choose "Accept analytics"; if you choose "Decline", or take no action, neither is ever loaded. This also respects a browser's Do Not Track signal and any existing analytics opt-out, whichever is stricter. If you later withdraw consent, we also clear any Google Analytics cookies already set. You can change your choice at any time using the "Cookie choices" link in the footer. The dashboard and the OAuth sign-in screens do not use this cookie and do not show this banner.

8. Contact

Questions about this policy can be sent to hello@scatterpost.io.