1. Controller and contact
Scope Cloud is the service name. The operator identified in your account, order form or enterprise agreement is the controller for personal data it determines how and why to process. During public testing, all controller enquiries and rights requests are handled through privacy@scope.cloud.
A customer organisation is usually the controller for personal data it places in a workspace, while Scope Cloud processes that data on the customer's instructions. The parties may have different roles for account administration, billing, security and service analytics.
2. Account and profile data
This includes name, email address, authentication identifiers, profile details, role, account status, plan selection and consent records. It is used to create and secure accounts, verify identity, provide the service and record agreements.
Lawful bases are performance of a contract or steps requested before a contract, legitimate interests in operating secure accounts, legal obligations, and consent for optional marketing.
3. Workspace and team data
This includes workspace name, membership, invitations, owners, administrators, permissions, seat allocation and activity associated with collaborative work. It is processed to provide workspace functions, administer access and protect organisational information.
The usual bases are contract and legitimate interests in collaboration, account administration, audit and security. The workspace customer may provide further privacy information to its members.
4. Projects, content and uploaded files
Project briefs, specifications, drawings, images, documents, tasks, comments, decisions and other uploaded or generated content may contain personal, confidential or commercially sensitive information. Scope Cloud processes this content to store, organise, search, display, share and support the features selected by authorised users.
The basis is contract. Customers are responsible for establishing a lawful basis and permissions for personal data they upload. Do not upload special-category, criminal-offence or highly confidential data unless authorised and the service is appropriate for it.
5. Payment and subscription information
When paid checkout is enabled, Scope Cloud may process plan, billing interval, subscription status, customer and subscription identifiers, invoice metadata, payment status, tax and billing contact details. Payment-card information should be collected directly by the payment provider and not stored in ordinary Scope Cloud records.
Stripe is referenced in the subscription data model but is not active on the current public checkout. If Stripe or another provider is enabled, it will be identified at checkout. Processing is based on contract, legal accounting and tax obligations, and legitimate interests in preventing fraud and managing debt.
6. Support and communications
Contact, support, access, sales and feedback forms collect name, email, topic, subject, message, destination and status. Support correspondence may include diagnostic or account information you provide.
Data is used to respond, route enquiries, maintain service records and improve support. Bases are requested pre-contract steps, contract, legitimate interests in customer service and product improvement, and legal obligations where relevant.
7. Usage, device, logs and security
The platform may process IP address, browser and device information, timestamps, request and error logs, authentication events, record identifiers and security signals generated by the service infrastructure. These support delivery, troubleshooting, abuse prevention, authentication and incident response.
Bases are contract and legitimate interests in reliable, secure service. Security logs may be retained where needed to investigate incidents, prevent fraud or establish legal claims.
8. AI prompts and generated content
AI features may process prompts, files, selected project context, instructions, generated outputs and feedback. Only submit content you are entitled to process. Outputs may be stored with the relevant project or conversation where the feature provides history.
Processing is based on contract and legitimate interests in providing, securing and improving requested features. Scope Cloud does not use AI output as the sole basis for legal or similarly significant decisions about users.
10. Public forms
Public enquiry, support, feedback and access-request forms collect the fields shown before submission and route them to the relevant Scope Cloud inbox. Access requests may be checked for duplicate email addresses.
The bases are steps requested before a contract, legitimate interests in responding and managing demand, and consent where a separate optional marketing choice is offered.
11. Purposes and lawful bases
- Provide accounts, workspaces, projects, products and requested integrations — contract.
- Authenticate users, prevent abuse and protect platform integrity — contract and legitimate interests.
- Administer subscriptions, invoices and tax records — contract and legal obligation.
- Respond to enquiries, support and feedback — requested pre-contract steps, contract or legitimate interests.
- Maintain legal acceptance, consent and compliance records — legal obligation and legitimate interests.
- Send transactional service communications — contract and legitimate interests.
- Send marketing — consent, which may be withdrawn at any time.
- Improve products using proportionate service feedback and operational data — legitimate interests, balanced against user rights.
13. Stripe and payment providers
No payment provider is connected to the current public checkout. If Stripe is enabled, it will process payment and customer-portal activity under its own privacy information and as a processor or independent controller depending on the activity. Scope Cloud will update operational notices before payment details are collected.
14. Analytics and marketing providers
No Google Analytics, Meta Pixel, advertising network or dedicated marketing tracker was detected in the application. Analytics and marketing preferences default to off. A provider must not be activated through the public site unless the consent controls and this policy are updated first.
15. International transfers
Platform, email, identity and font providers may process data outside the United Kingdom. Where UK data-protection law requires safeguards, the operator will use an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another lawful mechanism, together with risk and security measures where appropriate.
16. Retention
Data is kept only while needed for the purpose collected, the account or contract, security, dispute handling and legal obligations. Retention is assessed by data type, workspace instructions, sensitivity, available deletion controls and statutory requirements.
Account and project data is handled through the account lifecycle and deletion process; consent and contract records may be kept to evidence choices; billing records may be retained for statutory accounting periods; security records may be retained while relevant to investigation or claims. Backup copies are removed through controlled rotation rather than immediate live deletion.
17. Account deletion and export
Use available account controls or contact privacy@scope.cloud to request account deletion or a personal-data export. Workspace content may be controlled by the workspace owner, and Scope Cloud may refer a request to that organisation where it is the controller.
Identity and authority may be verified. Data may be retained where required by law, to resolve disputes, prevent fraud or protect legal rights.
18. Your UK data-protection rights
- Access: ask for a copy of your personal data and related information.
- Correction: ask to correct inaccurate or incomplete data.
- Erasure: ask for deletion where there is no overriding lawful reason to retain data.
- Restriction: ask to limit processing in applicable circumstances.
- Objection: object to legitimate-interest processing and always object to direct marketing.
- Portability: receive qualifying data you provided in a structured, commonly used, machine-readable format.
- Withdraw consent: withdraw consent at any time without affecting earlier lawful processing.
19. Exercising rights
Send requests to privacy@scope.cloud. Provide enough information to identify the account and request. Scope Cloud may ask for proportionate identity evidence and normally responds within one month, subject to lawful extensions for complex or multiple requests.
20. Automated decisions
The current service does not use solely automated processing to make decisions that produce legal or similarly significant effects about account users. AI features provide assistive outputs for human review. This policy will be updated before materially different automated decision-making is introduced.
21. Children and student users
Scope Cloud is not directed to children under 13. Student users aged 13 to 17 should use the service only through an authorised parent, guardian or educational arrangement. Organisations arranging student access are responsible for appropriate privacy information, authority and safeguards.
22. Security
Confirmed controls include authenticated accounts, email verification, optional Google sign-in, protected application routes, role-aware platform access, backend authentication checks and private handling of secrets. Users must protect credentials and configure workspace access carefully.
No method is completely secure. Report suspected compromise to support and vulnerabilities to the security contact. See the Security Overview for honest limitations and reporting instructions.
23. Complaints
Please raise concerns first with privacy@scope.cloud. You may also complain to the UK Information Commissioner's Office at ico.org.uk or through its published contact channels. You may seek a remedy through the courts where applicable.
24. Policy updates
This policy may change as services, processors or law change. Material updates will be highlighted through the website, account or email where appropriate. The updated date identifies the current version.
25. Privacy contact
Privacy questions and rights requests: privacy@scope.cloud. Security reports: security@scope.cloud. Legal correspondence: legal@scope.cloud.