# Privacy statement

> Which personal data Scratchfair processes, why, how long we keep it and which rights you have.


## Who is responsible

Nafite B.V., Spoorstraat 30a, 6511 AH Nijmegen, the Netherlands (Chamber of Commerce 76060217) is the controller for the personal data processed through Scratchfair. Questions about privacy: hallo@scratchfair.com.

## Which data we process

| Data | Why | Legal basis |
| --- | --- | --- |
| Documents you upload: claim, contract, photos, replies | To read your claim, run the checks and draft your letters | Performance of the contract |
| Details read from them: name, booking number, rental dates, amounts, rental office | Same | Performance of the contract |
| Email address and name, if you give them | To send you the link to your case and reminders about deadlines | Performance of the contract |
| Payment details: amount, status, payment method (not your card number) | To process the payment and for our accounts | Contract and legal obligation |
| Outcome you report, without name | Anonymous statistics for the strength estimate and the damage index | Legitimate interest |
| Usage data with consent: pages, clicks, device type | To improve the site (Google Analytics 4) | Consent |
| Anonymous usage data without cookies | Counting visits (Vercel Web Analytics) | Legitimate interest |

## Evidence mode

The free evidence mode stamps date, time and place on photos ==on your own device==. Those photos are not uploaded to us unless you add them to a case yourself.

## Who processes data for us

We use these processors, with a data processing agreement:

- **Vercel** (hosting of the website)
- **Supabase** (database and file storage, in the EU)
- **Anthropic** (AI that reads your documents; your data is not used to train models)
- **Mollie** (payments, the Netherlands)
- **Twilio SendGrid** (sending emails)
- **Google** (Google Tag Manager and Google Analytics 4, only with your consent)
- **Cloudflare** (Turnstile, a bot check when you start a case)

Some of these companies are based in the United States. Transfers take place under the EU-US Data Privacy Framework or the EU standard contractual clauses.

## How long we keep data

- Documents and photos of a case: until 12 months after the case is closed or last used, then they are deleted automatically.
- You can delete your documents yourself at any time from your case file.
- Payment records: 7 years, because Dutch tax law requires it.
- Analytics data in Google Analytics: 14 months.

## Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to receive your data in a portable format. Where we rely on consent, you can withdraw it at any time, for cookies via the cookie settings. Email hallo@scratchfair.com; we reply within one month.

You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the supervisory authority in your own country.

## Security

Files are stored in a private storage bucket and are only accessible through the app. Access to a case uses a personal link or a login link sent to your email address.