Privacy Notice

• Study data. Your organization is the controller of the study data it puts into Scrivica. Star River Capital LLC is the processor and handles that data only on your organization's instructions.
• Account and website data. Star River Capital LLC is the controller of account data (name, work email, sign-in and security records) and of the data from the request-access form.

• Account data. Email address, full name, organization, role, invitations. Sign-in is handled by Supabase. We never store your password ourselves.
• Study documents your organization uploads. Source files (such as RTF, PDF, DOCX, XPT, ZIP, CSV), the text and every table, figure and listing cell parsed from them, the documents and sections your team writes, comments, suggestions, review rounds and sign-offs. Listings can hold participant-level rows.
• Audit trail. Who did what and when: actor, action, record, a small payload of old and new values, and a database timestamp.
• Security records. Failed and successful sign-in attempts (email and a hash of the IP address, never the IP itself), and a log of platform staff access to your organization.
• AI settings. If your organization brings its own AI key, we store it encrypted. We keep the AI prompt a writer typed with each AI suggestion. We do not keep the full prompt we send to the AI provider.
• Access requests. Name, work email, company and a free-text use case from the request-access form.
• Plan and license records. Plan, seats, term and license events.

We use no analytics or advertising tools.

Upload coded study data only, for example participant IDs such as LDG-101-0007. Do not upload direct identifiers of participants. Scrivica does not check this, and text sent to the AI provider is not redacted first.

• To provide the Service: host, parse, draft with AI, check, review, sign and export your study documents.
• To run accounts: sign you in, apply roles, send invitations, mentions, review and sign-off emails.
• To keep the Service secure: enforce access rules, limit abuse and keep the audit trail.
• To decide on access requests, and to run licenses and billing.

We do not sell personal data and we do not train models on your content.

These vendors may process data for us. The subprocessors page lists what each one receives and is the current list.

• Supabase. Database, sign-in and file storage. Holds all the data above.
• Vercel. Hosting. Handles every request in transit.
• Anthropic. AI drafting, checking, text recognition of scanned pages and redaction suggestions.
• Resend. Transactional email, when switched on. Gets recipient details and document titles, never document or comment text.
• Sentry. Error monitoring, when switched on. Gets scrubbed error events only.
• Stripe. Invoicing and payments, once billing goes live.
• Cloudflare Turnstile. Bot check on sign-in, when switched on. Gets the visitor's IP address and browser signals, never document data.

Vendor regions are still to be confirmed. We assume one US project. An EU or UK region is not available.

• All AI calls run on our server. Your browser never calls a model.
• A call sends the text it needs: source text, table cell values, the current draft or paragraphs of a document. Scanned PDF pages are sent for text recognition automatically when a PDF is uploaded and an AI key is configured.
• We do not remove personal data from these inputs first.
• Zero data retention at Anthropic is not yet in place. Anthropic's standard API retention applies. Until it is confirmed, use only public, synthetic or non-sensitive data.
• If your organization uses its own Anthropic key, calls run under your Anthropic account and its terms. You arrange retention there.

• During the contract we keep your data until you delete it or the term ends. Nothing deletes the audit trail, login attempts, support log, source files or snapshots automatically while your organization is active.
• After the term you have an export period (30 days by default), then your organization is locked, then it is eligible for deletion about 90 days after the term ended, unless your contract says otherwise.
• If an admin requests deletion, there is a 30-day grace period in which it can be cancelled. After that the organization is eligible for deletion. When it is deleted, its rows, its stored files and its whole audit trail are deleted. Export the audit trail first if you need it.
• What survives deletion: a record of the deletion request (organization id, slug, name), license events, one platform event with counts only, and user accounts and profiles, because a person may belong to other organizations.
• Backups roll off on our providers' schedules.
• Access requests that were not approved are deleted 180 days after they were made. When one is approved, the use case text is removed and the name, email and company stay as the record of who was admitted.
• AI rate-limit counters are deleted after one hour. Section check-out rows are removed on check-in.
• Sentry, Resend and Vercel logs follow each vendor's own schedule, which we have not yet confirmed.

• Every record belongs to an organization, and database row level security keeps organizations apart. Tests fail if a table has no such rule.
• Sign-up is invite-only. Roles limit what each person can do. An optional second factor can be required by an organization admin and is enforced in the database.
• Signing needs password re-entry and records the signer, meaning, time and content hash.
• The audit trail is append-only. Signed documents are frozen by database guards.
• The file bucket is private. Customer AI keys are encrypted at rest (AES-256-GCM) and never sent to the browser.
• HTTPS only, with security headers. Rate limits and sign-in lockout limit abuse.
• Platform staff are on an allow-list and use a second factor. Support view shows metadata only, needs a reason, lasts 60 minutes, is logged and is shown to your admins. Seeing content needs a grant from your admin of up to 72 hours. There is no impersonation.

We do not have a SOC 2 report, an ISO 27001 certification or an external penetration test today. We do not have single sign-on yet. No system is perfectly secure.

• Export. An organization admin can download everything as one ZIP from Settings, Export Data, at any time, including after the organization is locked. It holds one JSON file per record type, the audit trail as CSV, the original source files if they total under 150 MB, and a checksum manifest.
• Deletion. An organization admin can request deletion in Settings, with a 30-day grace period you can cancel.
• Your own requests. If you are a user, ask your organization first, since it controls the study data. For account data, or if you want help, write to legal@scrivica.com. We handle requests from individuals by hand, and we forward requests about study data to the organization that controls it.
• AI key. Your organization can use its own AI key and see in Settings which key is in use.

We use only strictly necessary cookies and one local storage item. They keep you signed in and remember your organization and theme. There are no analytics, advertising or tracking cookies, so there is no cookie banner. The full list is on the cookies page.

• Privacy and legal questions: legal@scrivica.com
• Security reports: security@scrivica.com

Use of the Service is also governed by the Terms of Service.