--- title: "Privacy policy" description: "How Scratcher ApS collects and uses personal data on scratcher.io, which rights you have and how to contact us." url: https://scratcher.io/privacy-policy language: en --- Legal # Privacy policy [Download as PDF](https://scratcher.io/privacy-policy.pdf) *Last updated: October 30, 2026* This privacy policy explains how Scratcher ApS collects and uses personal data when you visit **scratcher.io**, sign up for our newsletter, contact us or book a meeting. It also explains the rights you have. How we use cookies and similar technologies is described in our [cookie policy](https://scratcher.io/cookie-policy). If you use the Scratcher platform as a customer, or play a game made with Scratcher, please also read the section [Data in campaigns made with Scratcher](https://scratcher.io/privacy-policy#data-in-campaigns-made-with-scratcher) below. ## Who we are Scratcher ApS is the data controller for the personal data described in this policy. - **Scratcher ApS** - Fruebjergvej 3, 2100 København Ø, Denmark - CVR: 38552864 - Email: ## What data we collect and why | What | Why | Legal basis | How long we keep it | | --- | --- | --- | --- | | **Newsletter:** your email address, your language and the time you signed up | To send you our newsletter with campaign ideas and product news (about once a month), and to document your consent | Your consent (GDPR art. 6(1)(a)) | Until you unsubscribe. We then delete your sign-up within 30 days | | **Contact and meeting requests:** name, work email, company, phone, your message and, for meetings, the time you choose | To answer you, send a calendar invitation and prepare the meeting | Our legitimate interest in answering enquiries (art. 6(1)(f)) and steps before a contract (art. 6(1)(b)) | Up to 24 months after your request or meeting, unless you become a customer | | **Customer accounts:** name, work email, phone number, company, country, job role and the answers you give when you sign up (such as industry, goals and how you heard about us); billing details (address, VAT or EAN number, payment card type and the last four digits); and usage data such as logins and activity in the platform | To create and run your Scratcher account, give support and send invoices, and to improve the platform and follow up on your trial | Contract (art. 6(1)(b)), legal obligations such as bookkeeping (art. 6(1)(c)) and our legitimate interest in improving the platform and following up on trials (art. 6(1)(f)) | As long as you are a customer, and as required by the Danish Bookkeeping Act afterwards | | **Statistics and marketing** (only if you accept the cookies): online identifiers in cookies, IP address, device and browser data, pages visited, how you arrived at the site and ads you clicked | To understand how the website is used, to improve it, and to show and measure relevant ads on Google, Meta (Facebook and Instagram) and LinkedIn | Your consent (art. 6(1)(a) and the Danish cookie rules) | See our [cookie policy](https://scratcher.io/cookie-policy) | | **Technical data:** IP address, browser type and pages visited, in server logs | To keep the website secure and working | Our legitimate interest in security (art. 6(1)(f)) | Up to 30 days | You don't have to give us any personal data. Without your email address, however, we cannot send you the newsletter or answer your enquiry. We never sell your personal data, and we do not use data from customer accounts to build advertising profiles. We do not use automated decision-making or profiling that has legal or similarly significant effects for you (GDPR art. 22). We also make aggregated or anonymised statistics from how the platform and campaigns are used, such as how often features are used, error rates and the number of visits and sign-ups. These statistics cannot identify you, our customers or any player. We use them to run, fix and develop our services, and we only share them in this form. For data in campaigns, we make the statistics on behalf of the business behind the campaign, under our data processing agreement with them. To find and fix errors in the platform, our error monitoring (Sentry) can record what happens on the screen when an error occurs, and in a small share of other sessions. Text in these recordings is masked, and they are only linked to your user ID and account ID. When you sign up for the newsletter in the form at the bottom of our pages, you are subscribed straight away. You can unsubscribe at any time via the link at the bottom of every newsletter. If someone adds you as a guest when they book a meeting with us, we get your email address from them. We only use it to send you the calendar invitation for that meeting. ## Who we share data with **Data processors.** We use carefully selected suppliers to run our website and services: hosting (Amazon Web Services), email delivery (Mailgun), Google Workspace (email and the calendar we use for meeting bookings), customer support tools, payments (Stripe), accounting and invoicing (e-conomic), error monitoring (Sentry) and AI features (Google Gemini). The full list of sub-processors for the Scratcher platform is in Appendix B of our [data processing agreement](https://scratcher.io/data-processing-agreement). They may only use the data on our instructions and under a data processing agreement. **Statistics and marketing.** Only if you accept the cookies, data is shared with: - **Google Ireland Limited** (Google Analytics and Google Ads). [Google's privacy policy](https://policies.google.com/privacy) - **Meta Platforms Ireland Limited** (Meta Pixel for Facebook and Instagram). [Meta's privacy policy](https://www.facebook.com/privacy/policy/) - **LinkedIn Ireland Unlimited Company** (LinkedIn Insight Tag). [LinkedIn's privacy policy](https://www.linkedin.com/legal/privacy-policy) For the Meta Pixel and the LinkedIn Insight Tag, we and Meta or LinkedIn are joint controllers for collecting the data on our website and sending it to them. Meta and LinkedIn are each responsible on their own for how they use the data afterwards. You can use your rights with us or with them. You can read the main points of our arrangement with Meta in [Meta's controller addendum](https://www.facebook.com/legal/controller_addendum). Write to us if you would like the main points of the arrangement with LinkedIn. **Transfers outside the EU/EEA.** Some of these providers or their sub-suppliers may process data outside the EU/EEA, for example in the USA. In that case, the transfer is protected by the EU–US Data Privacy Framework or the EU Commission's standard contractual clauses. You can get a copy of the safeguards we use by writing to us. **Videos.** Videos from YouTube (in privacy-enhanced mode) or Vimeo only load when you press play. From that moment, the video provider receives your IP address and technical data about your browser. **Authorities.** We may share data with authorities if the law requires us to. ## Data in campaigns made with Scratcher When a business uses Scratcher to run a game, quiz or other campaign, **that business is the data controller** for the data its players enter (for example name, email or answers). Scratcher ApS processes the data on the business' behalf as a **data processor**, under a data processing agreement. If you have played a campaign and want to know how your data is used, or want it deleted, please contact the business behind the campaign. You can also write to us, and we will help you get in touch with them. ## Security Scratcher ApS is **ISO 27001 certified**. We protect personal data with technical and organisational measures such as encryption, access control, two-factor login and regular reviews. Only employees who need the data for their work have access to it. ## Your rights Under the GDPR you have the right to: - **access** the personal data we hold about you - have incorrect data **corrected** - have your data **deleted** ("the right to be forgotten") - **restrict** how we use your data - **object** to processing based on our legitimate interest - receive your data in a portable format (**data portability**) - **withdraw your consent** at any time, without affecting processing that happened before **Your right to object.** When we process your data based on our legitimate interest, you can object at any time on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims. To use your rights, write to . We answer within one month. You can withdraw your cookie consent at any time via **Cookie settings** at the bottom of every page, and unsubscribe from our newsletter via the link at the bottom of every newsletter. ## Complaints If you are unhappy with how we handle your personal data, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, [www.datatilsynet.dk](https://www.datatilsynet.dk). We would appreciate the chance to help you first, so please contact us. You can also complain to the data protection authority in the EU/EEA country where you live or work, or where you think the infringement took place. ## Use of the website and copyright All content on scratcher.io is protected by copyright. You may make copies for your own personal use. Any other use requires our prior written permission. You may not use the website for illegal purposes, try to disrupt or hack it, send spam or try to access accounts that belong to others. Doing so can lead to your access being limited, and criminal acts will be reported to the authorities. ## Changes to this policy We may update this policy when our services or the law change. The date at the top shows when it was last updated. If we make important changes, we will tell you on the website or by email.