Privacy Policy

1. Who we are

ScrapDesk ("we", "us", "our") is a product of Lumin Creative Pty Ltd, providing a business management application for scrap metal recyclers, available at scrapdesk.app and as a mobile application. This policy explains what personal data we collect, why we collect it, and your rights over it.

For questions or requests, contact us at support@scrapdesk.app.

2. What data we collect

• ▸Account data: Email address, password (hashed — we never store it in plain text), and optional business name provided at signup.
• ▸Business records: Acquisition, sale, inventory, processing, and contact records you create inside the app. This data belongs to you.
• ▸Photos: Images you attach to acquisition or sale records, stored in encrypted cloud storage under your account.
• ▸Usage data: Standard server logs (IP address, browser/device type, pages visited, timestamps). Used for security monitoring and diagnosing errors.
• ▸Payment data: Billing is handled by Stripe. We never see or store your full card number — Stripe processes and stores payment details under their own privacy policy.

3. How we use your data

• ▸To provide, operate, and improve the ScrapDesk service
• ▸To authenticate your account and keep it secure
• ▸To process subscription payments via Stripe
• ▸To send transactional emails (e.g. email confirmation, password reset) — no marketing emails without your consent
• ▸To investigate security incidents and comply with legal obligations

We do not sell your personal data. We do not use your business records for advertising. We do not share your data with third parties except as described in Section 4.

4. Who we share data with

• ▸Supabase: Our database and authentication provider. Your data is stored in Supabase's infrastructure (AWS). Supabase is SOC 2 Type II certified.
• ▸Stripe: Payment processing. Stripe handles all card data and is PCI DSS Level 1 certified.
• ▸Vercel: Web hosting. Serves the scrapdesk.app web application.
• ▸Apple / Google: Mobile app distribution and in-app purchase processing for iOS and Android subscribers.
• ▸Law enforcement: Only if required by a valid legal order, court order, or to protect the safety of our users.

5. Cookies and tracking

We use cookies solely to maintain your authenticated session (set by Supabase Auth). We do not use advertising cookies, tracking pixels, or third-party analytics. If you sign out, session cookies are cleared.

6. Data retention

We retain your account and business records for as long as your account is active. If you delete your account, your personal data and business records are permanently deleted within 30 days, except where we are required to retain them for legal or financial compliance purposes.

7. Your rights

Depending on your location, you may have the right to:

• ▸Access a copy of the personal data we hold about you
• ▸Correct inaccurate data
• ▸Delete your account and associated data
• ▸Export your business records (CSV export is available in-app)
• ▸Object to or restrict certain processing
• ▸Lodge a complaint with your local data protection authority (UK: ICO; EU: your national DPA)

To exercise any of these rights, email us at support@scrapdesk.app. We will respond within 30 days.

8. Security

All data is encrypted in transit (TLS) and at rest. Passwords are hashed using bcrypt. Access to production data is restricted to essential personnel. Despite these measures, no system is completely secure — please use a strong, unique password for your account.

9. Children

ScrapDesk is a business tool intended for adults. We do not knowingly collect data from anyone under the age of 16. If you believe a minor has created an account, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or with a notice inside the app at least 14 days before the change takes effect. Continued use of ScrapDesk after that date constitutes acceptance of the updated policy.

11. Contact

For any privacy questions or requests: support@scrapdesk.app