Privacy Policy

Scriply Privacy Policy

This Privacy Policy explains how Chiron Labs ("Scriply", "we", "us" or "our") collects, uses, shares and protects personal information when you use the Scriply web app, back office, APIs and related services (the "Services"), and the choices and rights you have.

Scriply is built for businesses. Most of what we process is business information that an organization ("Organization") puts into the Services. Where that information is about people, such as an Organization's team members, owners, customers or vendors, this policy covers it too.

Information we collect

Information you give us

• Account details: your name, email address and sign-in credentials, or the account you sign in with (such as Google).
• Organization details: your Organization's legal name, address, registration and tax details, and the roles of its members.
• Business verification: the people who own or control your Organization, their names, roles and ownership, and answers you give during verification.
• Your records: accounts, customers, vendors, invoices, bills, transactions, documents and notes you enter or upload, which may include names and contact details of your customers and vendors.
• Wallet addresses you add for your Organization, your customers or your vendors.
• Messages you send us, such as support requests.

Information from services you connect

When an Organization connects a third-party service, we receive what it shares with us on the Organization's behalf:

• QuickBooks Online: accounting records such as accounts, customers, vendors, invoices and bills.
• Plaid: bank account details such as account names, masked numbers, balances and transactions.
• Gmail: messages and attachments in the connected inbox that look like bills or invoices, which we read to find them.
• Public blockchains: balances and transactions of the wallet addresses you add.

Information from identity verification and screening

• Persona verifies the identity of the people behind an Organization. Persona collects identity documents, dates of birth, ID numbers and selfies directly. We do not receive or store these. We receive the outcome of the check and the verified name.
• We screen Organizations and their owners against U.S. and other sanctions lists, such as OFAC's, and keep the result and any review of a possible match.

Information collected automatically

• Usage and device data: IP address, browser and device type, pages and actions, and the time of each request, kept in our service logs.
• Bot protection: Google reCAPTCHA checks some forms, such as sign-up, and collects device and interaction data to tell people from bots, under Google's Privacy Policy and Terms of Service.
• Cookies and local storage: we use only what the Services need to work, such as keeping you signed in and remembering a filter or an unsaved draft. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics.

How we use information

• To provide the Services: keep your books, sync connected services, read documents and inboxes you connect, show balances and prices, and prepare payments and tokenized invoices for you to approve.
• To verify Organizations and the people behind them, screen against sanctions lists, and prevent fraud, abuse and money laundering.
• To secure the Services, find and fix problems, and keep a reliable history of changes to your records.
• To communicate with you about your account, security, changes to our terms and support requests.
• To improve the Services, using aggregated and de-identified data.
• To comply with the law, enforce our Terms of Service, and protect the rights and safety of Scriply, our users and others.

We use automated tools, including large language models from Anthropic (Claude) and Google (Gemini), to read documents and messages and pull out details such as amounts, dates and parties. You can check and correct what they extract.

• Anthropic processes what we send only to provide its service to us, and does not train its models on it.
• Google may use what we send to Gemini, including the documents and messages it reads, to provide, improve and develop its products and machine learning technologies, and human reviewers at Google may read it. It is handled under Google's Privacy Policy and the Gemini API terms.

We do not make decisions that have legal or similarly significant effects on you solely by automated means.

How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows.

• Within your Organization: other members of your Organization can see its records, according to the roles its administrators give them.
• Service providers that process information for us under contracts that limit their use of it:
• Google Cloud and Firebase for hosting, databases, file storage and sign-in;
• Persona for identity verification;
• Anthropic and Google (Gemini) for reading documents and messages (see above for how Google may use what Gemini reads);
• Mailgun and Resend for sending email;
• Google reCAPTCHA for bot protection.
• Services you connect: QuickBooks Online, Plaid and Gmail exchange information with us when you connect them, under their own privacy policies.
• Price data providers: CoinMarketCap and Frankfurter provide prices and exchange rates. We send them only which assets and currencies we need prices for, never your personal information.
• Public blockchains: when you sign a payment or tokenize an invoice, the transaction, the wallet addresses involved and the token are recorded on a public blockchain. This is visible to anyone and cannot be deleted. We do not put the names of Organizations, customers or invoices on-chain.
• Legal and safety: when we believe it is required by law, regulation, legal process or a government request, or needed to protect the rights, property or safety of Scriply, our users or others.
• Business transfers: in a merger, acquisition, financing or sale of assets, subject to this policy.
• With your consent or at your direction.

How long we keep information

• Your records are kept as a permanent history of changes, so that books can be audited and rebuilt. When you delete a record in the Services, it is marked deleted and no longer shown, but its history is kept.
• We keep this history, and your account and Organization information, with no fixed end date, including after an account closes, until you ask us to delete it.
• When you ask, we delete your personal information, except what we must keep to meet legal, tax, anti-money-laundering or sanctions obligations, or to resolve disputes and enforce our agreements. We keep that only for as long as those reasons last.
• Service logs are kept for a limited period, typically up to 30 days unless needed for security investigations.
• Anything recorded on a public blockchain stays there permanently.

How we protect information

We use administrative, technical and physical safeguards, including encryption in transit and at rest, access controls limited to staff who need access, and cloud hardware security modules for the keys we use to sign transactions. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as the law requires.

Your choices and rights

• Access, correction and export: you can see and correct most of your information in the Services, and export reports from it. You can also ask us for a copy of the personal information we hold about you.
• Deletion: you can ask us to delete your personal information. We will do so unless we must keep it for the reasons described above. Information on public blockchains cannot be deleted.
• Connected services: you can disconnect QuickBooks Online, Plaid or Gmail at any time, which stops further access. You can also revoke our access from those services' own settings.
• Email: you can opt out of non-essential emails. We will still send messages about your account and security.

U.S. state privacy rights. Depending on where you live, including California, Colorado, Connecticut, Virginia and other states, you may have the right to know what personal information we collect and how we use it, to access, correct and delete it, to get a portable copy, and to opt out of its sale, sharing for targeted advertising, or profiling. We do not sell or share personal information or use it for targeted advertising. We will not discriminate against you for exercising these rights. You may use an authorized agent, and we may need to verify your identity, or the agent's authority, before we act on a request.

People in the EEA, the UK and Switzerland. Where these laws apply, we process personal information to perform our contract with you, to meet legal obligations, for our legitimate interests in running and securing the Services and preventing fraud, or with your consent. You may access, correct, delete, restrict or object to the processing of your personal information, get a portable copy, withdraw consent at any time, and complain to your local data protection authority. Our services are operated from the United States, and we transfer information there using safeguards the law recognizes, such as Standard Contractual Clauses.

Information about your customers and vendors. Where we process personal information on an Organization's behalf, such as its customers' and vendors' contact details, the Organization decides how it is used. People who want to exercise their rights over that information should contact the Organization, and we will help it respond.

To make a request, email [PRIVACY EMAIL]. We will respond within the time the law requires, usually 30 to 45 days.

Children

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy. When we make a change, we will publish the new version and ask you to accept it before you continue using the Services. Earlier versions are kept, and we can tell you which one you accepted.

Contact

• Chiron Labs
• Privacy requests: support@scriply.io
• Everything else: spport@scriply.io