Privacy Policy

• Study data. Your organization is the controller of the study data it puts into Scrivica. We are its processor and handle that data only on your organization's instructions, under our Data Processing Agreement with it.
• Account and website data. Star River Partners LLC is the controller of account data (name, work email, sign-in and security records) and of data from the request-access form.

• Account data. Email address, full name, organization, role and invitations. Sign-in is handled by our authentication provider; we never store your password ourselves.
• Study documents your organization uploads. Source files, the text and every table, figure and listing cell parsed from them, the documents and sections your team writes, comments, suggestions, review rounds and sign-offs. Listings can hold participant-level rows, which must be coded.
• Audit trail. Who did what and when: actor, action, record, old and new values, and a database timestamp.
• Security records. Sign-in attempts (email and a hash of the IP address, never the IP itself), and a log of platform staff access to your organization.
• AI settings. If your organization brings its own AI key, we store it encrypted. We keep the prompt a writer typed with each AI suggestion. We do not keep the full prompt we send to the AI provider.
• Access requests. Name, work email, company and a free-text use case from the request-access form.
• Plan, license and billing records. Plan, seats, term, license events, billing contact and invoices.

We use no analytics or advertising tools.

Upload participant data only in coded form, with no direct identifiers such as names, contact details or dates of birth, unless your organization's contract expressly allows otherwise. We do not check this, and text sent to the AI provider is not redacted first.

• To provide the Service: host, parse, draft with AI, check, review, sign and export your study documents (performance of our contract with your organization).
• To run accounts: sign you in, apply roles, and send invitations, mentions, review and sign-off emails (contract and our legitimate interest in operating the Service).
• To keep the Service secure: enforce access rules, limit abuse and keep the audit trail (legitimate interest and legal obligation).
• To decide on access requests, and to run licenses and billing (legitimate interest, contract and legal obligation).

We do not sell or share personal data for advertising, and we do not train AI models on your content.

A small set of providers process data for us: database, authentication and file storage; application hosting; an AI provider; transactional email; error monitoring; payments; and bot protection. The subprocessors page names each provider, what it receives and where. We give customers 30 days' notice before a new subprocessor processes their content. We may also disclose data when the law requires it, or to a successor in a merger or acquisition under equivalent protections. A summary of our processor role is on the data processing page.

• All AI calls run on our server. Your browser never calls a model.
• A call sends the text it needs: source text, table values, or the current draft or paragraphs of a document. Scanned pages may be sent for text recognition automatically on upload when AI is enabled.
• We do not remove personal data from these inputs first.
• Real study data goes in only after we confirm in writing that our AI provider processes it under zero data retention terms and does not train on it. Until then, use only public or synthetic data. The current status is shown on the subprocessors page.
• If your organization uses its own AI key, calls run under your account with that provider and its terms.

• During the contract we keep your organization's data until you delete it or the term ends. The audit trail, sign-in records, support records and signed records are not deleted automatically while your organization is active.
• After the term, your organization is read-only for a 30-day export period, then locked, then deleted 90 days after the term ends, unless your contract says otherwise.
• If an admin requests deletion, it runs after a 30-day grace period during which it can be cancelled. Deletion removes the organization's records, stored files and whole audit trail. Export the audit trail first if you need it.
• What survives deletion: a record of the deletion request (organization identifier and name), license events, one platform event with counts only, and user accounts, because a person may belong to other organizations.
• Backups expire within 35 days after deletion.
• We delete an individual's account data within 30 days of a request, unless they still belong to an active organization or the law requires us to keep it.
• Access requests are kept as long as needed to decide on them and to record who was admitted.
• Billing records are kept as tax and accounting law requires.
• Short-lived technical records, such as rate-limit counters, are deleted automatically.

• Every record belongs to an organization, and database row-level access controls keep organizations apart.
• Sign-up is by invitation. Roles limit what each person can do. A second factor can be required by an organization admin and is enforced in the database.
• Signing needs password re-entry and records the signer, meaning, time and content hash.
• The audit trail is append-only. Signed documents are frozen by database guards.
• File storage is private. Customer AI keys are encrypted at rest and never sent to the browser.
• Connections are encrypted. Rate limits and sign-in lockout limit abuse.
• Platform staff use a second factor. Support access shows metadata only, needs a recorded reason, is time-limited, logged and shown to your admins. Seeing content needs a time-limited grant from your admin.

No system is perfectly secure. If a personal data breach affects your organization's content, we notify your organization without undue delay and within 48 hours of becoming aware of it.

We host data in the United States. If you are outside the United States, your data is transferred there. Where the law requires a transfer mechanism, we use the European Commission's standard contractual clauses and the UK and Swiss equivalents, as set out in our Data Processing Agreement.

• Export. An organization admin can download everything as one export from Settings at any time, including after the organization is locked.
• Deletion. An organization admin can request deletion in Settings, with a 30-day cancellable grace period.
• Your own requests. Depending on where you live, you may have rights to access, correct, delete or port your personal data, and to object to or restrict its use. For study data, ask your organization first, since it controls that data; we forward such requests to it. For account data, write to legal@scrivica.com. We respond within 30 days. You may also complain to your data protection authority.
• AI key. Your organization can use its own AI key and see in Settings which key is in use.

We use only strictly necessary cookies and one local storage item. They keep you signed in and remember your organization and theme. There are no analytics, advertising or tracking cookies, so there is no cookie banner. The full list is on the cookies page.

The Service is for businesses and is not directed to children. We do not knowingly collect children's personal data.

We will post changes here with a new effective date, and notify customers' admins by email of material changes at least 30 days before they apply.

• Privacy and legal questions: legal@scrivica.com
• Security reports: security@scrivica.com

Use of the Service is also governed by the Terms of Service.