1. Who We Are
This Privacy Policy explains how SKUA LABS SRL (a limited liability company registered in Romania, registered office at 85 Uverturii Boulevard, Building O14, Entrance A, Floor 4, Apartment 16, District 6, 060935 Bucharest, Romania, Trade Register number J2026049926004, sole registration code (CUI) 55428943) ("SKUASCOUT," "we," "us," or "our") collects and uses your personal data when you use the website at skuascout.com and the SKUASCOUT application and services (together, the "Service").
For the purposes of the EU General Data Protection Regulation ("GDPR"), we are the data controller of the personal data described in this Policy. Our contact details for privacy matters are in Section 12.
2. The Data We Collect
We collect the following categories of personal data:
- Account data. Your name (if provided), email address, password (stored in hashed form), and, if you sign in with a third-party provider such as Google, the basic profile information that provider shares with us.
- Payment data. When you subscribe or buy Credits, payment is processed by our payment processor. We receive limited billing information (such as your plan, transaction status, and partial card details), but we do not store your full payment card number ourselves.
- Content you submit. The inputs you provide to the Service, such as keywords, ASINs, niches, and the product rows taken from a CSV file you add, and the outputs generated from them.
- Your CSV file never leaves your browser. It is read and parsed on your own device, and only the columns we use are sent to us. The file itself is never uploaded, never stored, and never reaches our servers, so anything else it happened to contain never reaches us either. The rows we do extract are saved to your account in the normal way, and are deleted with it.
- Information about other people in the data we process. Generating your analyses can involve information about other people, for example the name of a seller or supplier who trades as an individual rather than through a company, or of an inventor named in a patent. It reaches us in four ways: in a CSV file you add, in the public Amazon listing and review data we retrieve when you ask for an analysis, in the public patent records we retrieve for a Deep Dive, and in the supplier listing data we collect when estimating what a product would cost to source. We process it only to produce your results. Where we analyze product reviews, we work with the text of the review only: the reviewer's name and profile arrive with the data our provider returns, and we delete them on receipt, before anything is stored or analyzed. See Section 4.
- Usage and technical data. Information about how you use the Service, such as features used, Credit activity, log data, device and browser type, IP address, and approximate location derived from it.
- Communications. Messages you send us (for example, support requests) and your preferences for marketing communications.
- Feedback you send from inside the app. When you use the in-app feedback button to report a problem or suggest an improvement, we receive the message you write, the type you chose, and, only if you attach one, a screenshot or image you choose to include (you see it before it is sent, and you can remove it). We also record the page you were on, your browser and app version, your screen size, language and time zone, your plan, and the last few error messages the app itself caught, so we can reproduce what you saw. The message and the image reach the two founders by email and are kept as described in Section 9.
- Referral data. If you participate in the referral program, the referral codes used and the link between referring and referred accounts, to apply discounts and rewards and prevent abuse.
- Account integrity data. Our joining Credits and our referral rewards are a one-time welcome for a first account, so we hold a small number of signals and check a new account against them. A keyed one-way hash of the email address of any account that was deleted. And, when a referral reward is claimed, a comparison of an identifier for the payment card used against the identifiers of the cards our payment processor holds for the account that referred you. That identifier is a reference our payment processor derives from the card, not the card number: we never receive the full number, and the reference cannot be turned back into one. We do not record or compare device or browser characteristics for this purpose. See Sections 4, 5 and 9.
3. How We Collect It
- Directly from you when you create an account, subscribe, upload content, or contact us.
- Automatically as you use the Service, through logs, cookies, and similar technologies (see Section 6).
- From third parties, such as your chosen sign-in provider and our payment processor.
4. Why We Use Your Data and Our Legal Basis
Under the GDPR we must have a legal basis for processing your personal data. We rely on the following:
- To provide the Service (create your account, run analyses, store your work), legal basis: performance of our contract with you.
- To process the information about other people described in Section 2, in order to produce the analysis you asked for, legal basis: our legitimate interests in providing that analysis. This information reaches us indirectly, not from the people it concerns, and contacting each of them would involve disproportionate effort, so we rely on the exemption in Article 14(5)(b) of the GDPR and describe the processing here instead.
- To process payments and manage subscriptions, Credits, and referrals, legal basis: performance of our contract and our legitimate interests.
- To keep invoices and accounting records, legal basis: compliance with a legal obligation (Romanian tax and accounting law).
- To secure, maintain, and improve the Service, including preventing fraud and abuse, legal basis: our legitimate interests.
- To keep our one-time free offers to one per person, by comparing the account integrity signals described in Section 2 and withholding the joining Credits where we identify a repeat sign-up, legal basis: our legitimate interests in protecting our pricing from systematic exploitation and keeping the Service fair to the customers who pay for it. We have carried out a balancing assessment for this, and we will send you a summary if you ask.
- To notice when the same person withdraws again within 12 months of an earlier withdrawal, by keeping the keyed hash of their email address described in Section 9 with each withdrawal and alerting our team for review, legal basis: our legitimate interests in preventing abuse of the 14-day right of withdrawal. The alert never blocks, limits or changes a withdrawal.
- To communicate with you about your account, changes, and support, legal basis: performance of our contract and our legitimate interests.
- To send marketing (where applicable), legal basis: your consent, which you can withdraw at any time.
5. Automated Processing and AI
To generate your niche and product analyses, the inputs you submit (such as search terms and product details) are processed by our AI provider, Anthropic PBC (United States), acting as our processor. Under our commercial terms with Anthropic, your inputs are not used to train Anthropic's models.
These analyses are decision-support outputs about products and markets. They do not produce legal or similarly significant effects on you within the meaning of Article 22 of the GDPR, and we do not use them to make decisions about you.
Account integrity checks. Separately, we run automated checks to identify whether a new sign-up is connected to an existing or former account. Where a check indicates a connection, your account is still created and you can use the Service normally: what we withhold is the one-time free trial Credits, and the friend bonus where the sign-up came through a referral. We do not refuse the sign-up itself, and no subscription or Top-up is refused on this basis.
You can ask a person to review this. If we withhold a one-time grant on this basis, contact us at hello@skuascout.com and a member of our team will review the decision, consider any explanation you give, and tell you the outcome.
8. International Transfers
We store our database, your account and sign-in data, and any image you attach to feedback in the European Union, in Frankfurt, Germany. System logs, backups and the execution of our server functions may be processed in other locations by our providers, and are not covered by that region.
Apart from Apify and Zoho, which are established in the European Union, the providers listed in Section 7 are established in the United States and may access data from there, so your personal data may be transferred outside the European Economic Area (EEA) regardless of where it is stored. Apify runs the supplier searches in the United States and keeps the search terms and the listings they return there, so that data is transferred outside the EEA as well. Our database provider also has an affiliate in Singapore, so a transfer there is possible.
Where we make such a transfer, we ensure an appropriate level of protection using the European Commission's Standard Contractual Clauses (SCCs) incorporated into our agreements with these providers, and, where the provider is certified, the EU-US Data Privacy Framework. Supabase is not certified under that framework; transfers to Supabase rely on the Standard Contractual Clauses together with the transfer impact assessment Supabase makes available to us. Apify makes its transfer itself, on our behalf, under its data processing agreement with us, which requires it to have a lawful transfer mechanism in place first. You can request a copy of the safeguards we rely on by contacting us at hello@skuascout.com.
9. How Long We Keep Your Data
We keep your personal data only as long as necessary for the purposes described in this Policy.
- Account and content data are kept while your account is active, and for 30 days after you ask us to delete your account, or after we terminate it. Where you asked us to delete it yourself, those 30 days are your window to change your mind. We then erase them, normally within 24 hours of that 30-day mark. If you would rather not wait, ask us at hello@skuascout.com and we erase them sooner.
- If you cancel your subscription, nothing is deleted: your account stays open, and you can still sign in and view your past work.
- Billing and tax records (invoices and accounting records) are kept for as long as Romanian accounting law requires: 5 years, counted from 1 July of the year after the financial year in which they were issued, so an invoice issued in March 2026 is kept until 1 July 2032. Where a longer period applies because of an investigation or a legal claim, we keep the records for that period instead. We keep only the records the law requires, under restricted access, and delete them once the period ends.
- Log data is kept for up to 90 days, then deleted or anonymized.
- Public data we retrieve for an analysis, such as Amazon listing and review data, is also kept in a cache that all users share and that is linked to no account, for at most 3 days after we retrieve it (at most 92 days for an answer our AI worked out for a product, such as its tariff classification), and then deleted.
- Messages you send us (support requests and other correspondence) are kept for 24 months after the last message in that conversation, then deleted.
- Feedback you send from inside the app is kept for 24 months so that we can act on it; a screenshot or image you attached is deleted after 180 days. If your account is deleted, any attached image is deleted within 24 hours of the erasure and the message is kept without anything that identifies you. The copy that reaches the founders by email (your message, your email address, the details recorded with it and any image you attached) is kept with our correspondence, for the period above.
- Marketing emails: if you subscribe, we keep your address and preferences until you unsubscribe. After that we keep a suppression record, so that we never send you marketing email again.
- Analytics events, collected only if you allow them, are kept by PostHog for 1 year, a period PostHog sets on the plan we use.
- Referral data is kept while either account in the referral exists, and for 3 years after the last of them is permanently deleted, so a question about a reward can be settled. It is then deleted.
- A one-way hash of your email address is kept for 24 months after your account is permanently deleted. The 24 months run from that permanent deletion, not from the day you ask. This record has one purpose: our free credit offers are a one-time welcome for a first account, and without it the same person could delete and register again indefinitely to claim them over and over. That covers the signup credits and the referral bonuses, including the reward someone else would earn for introducing you a second time. It is a keyed hash, not your address, and it cannot be turned back into one. We hold it on the legitimate-interests basis, to prevent abuse of a promotional offer (GDPR Article 6(1)(f), Recital 47). Nothing else about the deleted account is stored with it, and it is never shared with anyone, including a person whose referral link you used.
- A one-way hash of your email address, kept with each withdrawal, for 14 months from that withdrawal. When you withdraw from a subscription, a Top-up or a plan change under the 14-day right of withdrawal, we store the same keyed hash of your address with that withdrawal, so that we notice when the same person withdraws again within 12 months. The alert goes to our team for review. It never blocks, limits or changes a withdrawal, which remains your right. We hold it on the legitimate-interests basis, to prevent abuse of the 14-day right of withdrawal (GDPR Article 6(1)(f)). It stays for its 14 months even if your account is deleted, and it is never shared with anyone.
- The payment card identifier described in Section 2 is held on the referral record, and is erased together with the referred account. It serves only that one check, it is never used to build a profile of you, and it is never shared with anyone, including a person whose referral link you used.
- Aggregated statistics that can no longer identify anyone are not personal data, and we may keep them indefinitely.
When you ask us to delete your account, nothing is erased on the day you ask. Your access ends immediately: you are signed out, and the content you submitted and the results generated from it stop being reachable through the Service. If you have credits left, that balance stays visible when you sign in, so you can see what is being held for you. We then hold the account for 30 days, so that a deletion you regret can be undone. Sign in again inside those 30 days and confirm the restore, and everything comes back as it was, including your credits and your subscription. We keep it so you can undo the deletion, and so we can still serve the rights that survive it, such as a refund claim under the 14-day right of withdrawal in our Terms. We do not use it for anything else while the window runs.
If you do not come back, an automated job erases the account. That job runs once a day, so erasure normally happens within 24 hours of the 30-day mark rather than at the exact moment it passes. A run that is delayed, or that has a backlog of accounts to work through, can push it to one of the following days. Once it has run, the deletion is final and we cannot reverse it. You do not have to wait for the window: email us at hello@skuascout.com and we erase the account sooner.
If you ask us to erase your personal data under Article 17 of the GDPR, we act without undue delay: the 30-day recovery window does not apply, because you have asked us to erase your data rather than to close your account. Before erasing, we will tell you about any unused Credits you have paid for so these can be settled.
If you stop using the Service, we may close your account after 24 months without a sign-in. We will email you at least 30 days beforehand, and signing in during that time keeps it open. An account closed this way is then handled as a deletion, as described above.
Until it is erased, the account and everything in it is still stored, which is what makes those 30 days recoverable. After erasure, what stays is limited to the following: the invoices and accounting records we are legally required to keep, on the legal-obligation basis (GDPR Article 17(3)(b)); the records that show what you agreed to and what we have already refunded, which we keep with your account identifier removed so that a claim by either side remains provable (Article 17(3)(e)); the one-way email hashes described above, each for its own period; the messages you sent us, including the email copies of any in-app feedback, until the correspondence period above ends; the record of any referral you took part in, without your account identifier, for 3 years after the later of the two account deletions, so that a question about a reward can still be settled; and a log of the notices we are required to send you, which keeps the address each one went to, because proving we sent it means proving where. That log holds no message content. We keep it for three years after the account is erased, and it is not used to contact you.
One thing sits outside that list. We take routine backups of our database so we can recover the Service after a failure, and a backup taken before your erasure still contains what was in your account at the time. We do not read those backups, and we do not use them to restore an individual account, so an erased account does not come back from one. The copy goes when the backup it sits in is overwritten on our normal rotation, which is a matter of days rather than months.
10. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Access, to obtain a copy of the data we hold about you.
- Rectification, to correct inaccurate or incomplete data.
- Erasure, to ask us to delete your data in certain circumstances.
- Restriction, to ask us to limit how we use your data.
- Portability, to receive your data in a portable format, or have it sent to another provider where technically feasible.
- Objection, to object to processing based on our legitimate interests, and to direct marketing at any time. Where you object to processing based on our legitimate interests, we stop unless we have compelling grounds that override your interests. For our account integrity checks, we consider preventing systematic abuse to be such a ground, but we will consider your particular circumstances and tell you the outcome.
- Withdraw consent, where we rely on consent, to withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact us using the details in Section 12. We respond within one month. For complex or numerous requests we may extend this by up to two further months, and we will tell you within the first month if we do. You also have the right to lodge a complaint with a supervisory authority, in the country where you live or work or where you believe an infringement occurred; in Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. G-ral Gh. Magheru 28-30, Sector 1, Bucuresti 010336, anspdcp@dataprotection.ro.
11. Security and Children
We use reasonable technical and organizational measures to protect your personal data, such as encryption in transit, hashed passwords, access controls and daily backups. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
The Service is not directed to children, and you must be at least 18 (or the age of majority in your jurisdiction) to use it. We do not knowingly collect data from children.
12. Changes and Contact
We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (for example, by email or an in-app notice). The "Last updated" date at the top shows when it was last revised.
For any privacy questions or to exercise your rights, contact us at hello@skuascout.com, or by post to SKUA LABS SRL, 85 Uverturii Boulevard, Building O14, Entrance A, Floor 4, Apartment 16, District 6, 060935 Bucharest, Romania.