Privacy notice

This notice explains which personal data we process when you use this website and the app, why we process it and which rights you have.

Who we are

Scrooge GbR is the controller responsible for the processing of your personal data described in this notice. The Impressum names its partners.

You can reach us by email at hi@scrg.io.

The contact form

The contact form on our landing page asks for your name, your work email address, your company, which markets you want us to connect first and, optionally, what your team still does by hand. Before you send it, you confirm that you have read this notice.

When you send the form, it goes to our form service provider, which is based in Sweden and stores submissions in the EU. The provider keeps a record of your confirmation and forwards your message to us by email at hi@scrg.io.

Your enquiry reaches our mailbox, which our email provider hosts.

We use your details to read and answer your enquiry. The legal basis is Article 6(1)(b) GDPR, as answering is a step you ask us to take before a possible contract.

After the exchange ends, we keep the correspondence as a record of our business communication. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is keeping a record of our business correspondence.

You are not obliged to use the contact form. If you do, it cannot be sent without your name, work email address, company, the markets answer and your confirmation.

Cookies and local storage

When you visit this website, we ask whether it may store information on your device. You can answer Decline, Essential only or Accept all.

We store the choices you make on this website:

• your language and your currency, each in a cookie that expires one year after it is set
• your colour theme, in your browser's local storage
• in the app, your markets view, your markets table columns and your minimum TVL, in your browser's local storage

On the landing page, the documentation and the legal pages, none of these choices is stored if you answer Decline or have not answered yet; a choice then applies only to the page you are reading and is gone when you reload it. In the app, your choices are stored whenever you make them, because the app needs them to show you the view you chose.

We store your answer to this question in your browser's local storage, whichever answer you gave, so that we do not ask again. You can change your answer at any time with Cookie settings, in the footer of this website and in the app's settings.

Entries in local storage stay until you delete them in your browser.

The legal basis for storing your choices and your answer is Article 6(1)(f) GDPR; our legitimate interest is showing you this website the way you set it and not asking you the same question again.

The answer Accept all also allows our sign-in provider and our analytics provider to store information on your device, as the next two sections describe.

Sign-in and wallets

Signing in and connecting a wallet are provided by our sign-in provider. On the landing page, the documentation and the legal pages, the sign-in provider is loaded only if you answer Accept all. In the app, it is always loaded, because the app needs it to know whether you are signed in.

Depending on how you sign in, the sign-in provider processes the email address you sign in with; the name, email address and identifier of an account you hold at another service, if you sign in with that account; or the public address of the wallet you sign in with. It also processes the public address of each wallet you connect. If you sign in without a wallet of your own, it creates one for you.

When it is loaded, the sign-in provider stores in your browser's local storage an identifier for your browser, a list of your connected wallets and a record of the usage information it has sent. Your browser then contacts the sign-in provider and the services it uses to protect sign-in against automated abuse and to list available wallets. These services receive your IP address and may set their own cookies; those services decide how long their cookies last.

When you sign in, the sign-in provider also stores the information that keeps you signed in, both in your browser's local storage and in cookies on this website. These cookies last for up to 30 days and are renewed while you stay signed in. The sign-in provider deletes this information when you sign out.

On the landing page, the documentation and the legal pages, the legal basis is your consent under Article 6(1)(a) GDPR, which you can withdraw at any time. In the app, the legal basis is Article 6(1)(b) GDPR, as the sign-in provider is necessary to provide the app you use.

Analytics

If you answer Accept all, we use an analytics provider to understand how this website and the app are used. It records when you sign in and with which method, when you open the markets page, when a page fails to load and when you click certain buttons and links, together with the page and the name of the button or link. For a page that fails to load, it also records a description of the error. Each record also contains the address of the page you are on, the page you came from, your browser and its language, your operating system, your device type, screen size and time zone, and your IP address. Each record also contains the first page of your visit and the page that led you there, the version of your browser, the size of your browser window, a random identifier for your browser, one for your visit and one for the browser tab, the time of the record and a random identifier for it, and the key of our account with the analytics provider together with the name, version, settings and state of the software that sends the record.

The analytics provider stores an identifier for your browser in local storage and keeps the records on servers in Germany. In local storage it also keeps an identifier for your current visit, whether you allowed analytics, and how you reached this website: the first page it recorded, the page you came from and any campaign details in the address of the link you followed. In your browser's session storage, which is cleared when you close the tab, it keeps an identifier for the tab and how you reached this website in that tab. To check that each storage works, it writes a test entry to local storage and to session storage and removes it at once. The legal basis is your consent under Article 6(1)(a) GDPR, which you can withdraw at any time.

Your account

The beta is closed: only people we have admitted can sign in, and our sign-in provider keeps the list of admitted people for us. When you sign in for the first time, we create an account for you. It holds an identifier we assign, the identifier your sign-in provider gives you and the time we created it. When you join the beta, we record which version of the Terms of Use and of the beta's special characteristics you agreed to, and when.

Each time you sign in, we read the email addresses your sign-in provider has confirmed for you and check whether someone has invited you to their team under one of them. We use these addresses only for this check and do not store them.

In the app, we store what you set up and receive there: your alerts and their conditions, the markets you bookmark, the notifications triggered for you and when you last opened them, and the drafts of incident reports you create from a notification, with the time you marked a draft as reviewed. A report you download is put together when you request it and is not stored.

If you add a Telegram chat to receive notifications, you confirm it by sending a one-time code from that chat to our Telegram bot. Telegram passes the code to us with the identifier of the chat and the language of your Telegram app. We store the identifier of the chat with your account and use the language only to reply to you in it. We then send your notifications to that chat and, if you are on call in a team's on-call schedule, the team's on-call messages. When you acknowledge an on-call message, Telegram tells us which chat acknowledged it. Telegram processes these messages under its own terms and privacy policy.

If you invite someone to your team, we store the email address you invite them under and the role you give them, and any name and title you enter for a member. We do not send them an email. When that person signs in with this email address, we link their account to your team. If you remove a member or revoke an invitation, we keep the entry, marked as removed. If someone invites you to their team, we receive your email address, and any name and title they enter for you, from that person.

If you set up an on-call schedule, we store its time zone and its shifts and, for each shift, the primary and the secondary team member and how many minutes a message may wait before it goes to the secondary. When a notification falls into a shift, we send it to the Telegram chat of the primary and, if no one acknowledges it in time, to the secondary. We record each such message, the chats we sent it to, and whether and when it was acknowledged or passed to the secondary.

The legal basis for this processing is Article 6(1)(b) GDPR, as it is necessary to admit you to the beta and to provide the app to you under the Terms of Use. For a Telegram chat you add, the legal basis is your consent under Article 6(1)(a) GDPR, which you can withdraw at any time by switching the chat off in the settings. For the data of team members and of people invited to a team, the legal basis is Article 6(1)(f) GDPR; our legitimate interest, and that of the person who runs the team, is letting a team work together in the app.

We store this data with our hosting and content delivery provider, on servers in the EU.

Delivering this website

Our hosting and content delivery provider delivers this website from servers in Europe. It receives the IP address of every request and keeps a log of each request. We also use the IP address to limit how many requests can come from one address in a short time. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is delivering this website to you and protecting it against misuse.

Transfers outside the EU

Our hosting and content delivery provider is based in the United States. It states that it relies on the European Commission's standard contractual clauses or, for transfers to the United States, on its certification under the EU-U.S. Data Privacy Framework.

Our sign-in provider is based in the United States and processes data there. It states that it transfers data to the United States under a data processing agreement that incorporates standard data protection clauses.

The services our sign-in provider uses to protect sign-in and to list available wallets are based in the United States. The service that protects sign-in states that it relies on the European Commission's standard contractual clauses or, for transfers to the United States, on its certification under the EU-U.S. Data Privacy Framework. The service that lists available wallets states that it may rely on the European Commission's standard contractual clauses for transfers to the United States.

Our analytics provider is based in the United States and states that it also processes data outside the EU, including in the United States. It states that it relies on its certification under the EU-U.S. Data Privacy Framework and, in addition, on the European Commission's standard contractual clauses.

Our email provider is based in Switzerland and has its servers in Switzerland, Germany and Norway. The European Commission has decided that Switzerland offers an adequate level of data protection.

You can ask us for a copy of these safeguards at hi@scrg.io.

If you add a Telegram chat, we send your notifications and on-call messages to Telegram, which is based in the British Virgin Islands. The European Commission has not decided that the British Virgin Islands offer an adequate level of data protection. Telegram states that it stores the data of users who signed up from the EEA on servers in the Netherlands.

How long we keep your data

We delete enquiry correspondence from our mailbox 24 months after the last message in the exchange. Our email provider keeps backups of the mailbox for up to 30 days.

Our form service provider deletes each submission 30 days after it arrives. The email it sends us is a separate copy and is kept for the 24 months stated above.

Our hosting and content delivery provider keeps request logs for up to seven days.

Our analytics provider keeps the records for the period our plan with it sets, and no longer than seven years.

Our sign-in provider keeps the data it processes for us until we ask it to delete the data, and at the latest until we stop using its service.

We keep the data of your account, and what you set up in the app, for as long as your account exists. When the contract ends, or when the beta ends if you have not joined it, we delete your account and this data. Our hosting and content delivery provider keeps backups of this data for up to 30 days.

The data of a team member or of a person invited to a team stays in the account of the person who runs the team for as long as that account exists.

How long cookies and the entries in your browser's storage last is described under Cookies and local storage, under Sign-in and wallets and under Analytics above.

Your rights

You have the following rights under the GDPR:

• access to the personal data we hold about you (Article 15 GDPR)
• rectification of inaccurate data (Article 16 GDPR)
• erasure of your data (Article 17 GDPR)
• restriction of processing (Article 18 GDPR)
• data portability, that is receiving the data you gave us in a structured, commonly used and machine-readable format and having it transmitted to another controller (Article 20 GDPR)
• objection, on grounds relating to your particular situation, to processing we base on Article 6(1)(f) GDPR: keeping your correspondence, delivering this website and protecting it against misuse, storing your choices on your device, and holding the data of team members and of people invited to a team (Article 21 GDPR)
• withdrawal of your consent at any time, with effect for the future, by changing your answer with Cookie settings or, for a Telegram chat, by switching the chat off; the withdrawal does not affect the lawfulness of processing before it (Article 7(3) GDPR)

To exercise any of these rights, write to us at hi@scrg.io.

You also have the right to lodge a complaint with a data protection supervisory authority.

Automated decisions

We do not make decisions about you based solely on automated processing, including profiling (Article 22 GDPR).

Whether you have to provide data

You are not obliged by law or by contract to provide personal data. Without your IP address, which your browser sends with every request, we cannot deliver this website to you, and without signing in you cannot use the functions of the app that need an account.