Privacy Policy

ScriptLix ("we", "us", or "our") gives screenwriters coverage, writing tools, and screenplays to read. This Privacy Policy explains what we collect, why, who we share it with, how long we keep it, and how you can get it deleted.

It applies to everyone who uses ScriptLix, with or without an account. By using ScriptLix, you acknowledge that you have read this policy.

ScriptLix is the data controller for the personal data described here. We decide why and how it is processed, in line with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, contact us at [email protected]. We aim to respond to all legitimate requests within 30 days.

Account Data: When you register, we collect your name, email address, and sign-in details. Sign-in is handled by Firebase Authentication (a Google service). We never see or store your password.

Profile Data: You may choose to provide additional information such as a display name, avatar image, biography, and links to external portfolios.

Your Screenplays and Writing: When you upload a screenplay for coverage or a deep dive, or write in Studio, we store the text of your script, the notes and reports we generate from it, and the prompts and replies exchanged with our AI providers. Studio also keeps saved versions of your documents.

Transaction Data: When you buy something, we record what you bought, the amount, and the order status. Payments are handled by Paddle, and we never receive or store your full card number.

Email Without an Account: If you give us your email before paying for a deep dive, join our newsletter or waitlist, or contact support, we store that email address.

Visitor Data: With free coverage requests, newsletter sign-ups, waitlist entries, and support tickets, we store your IP address and browser user agent. For coverage requests we also store your country.

Usage Data: We record how you use the site, such as pages viewed, scripts browsed, reading progress, searches, and which features you use, through the analytics tools described below.

Server Logs: Our servers log each API request, including your IP address, country, browser user agent, and, if you are signed in, your user ID and email. These logs are deleted automatically after 30 days.

We use your data to run ScriptLix: to create and manage your account, process purchases, deliver what you bought, generate the coverage and Studio results you ask for, and recommend scripts.

We do not use your screenplays to train our own AI models.

We email you about your account, such as purchase confirmations, reports that are ready, security alerts, password resets, and policy updates. We also send lifecycle and reminder emails. For example, if you give us your email for a deep dive and do not finish checkout, we may send you a reminder. If a screenplay you upload has contact details printed on its title page, such as an email address, we may use them to follow up with you about your coverage.

If you signed up for an account or joined a list, we may also send you marketing email about new tools and screenplays. Every marketing email carries a one-click unsubscribe link, and once you use it we stop sending marketing email to that address permanently. Service email about your account continues, because you need it.

We use data to detect and prevent fraud, abuse, and security threats, including suspicious account activity, unauthorized access attempts, and violations of our Terms of Service.

Contract Performance: We process your account, screenplay, and transaction data because we need it to give you the service you signed up for or paid for, including sending your screenplay to our AI providers when you ask for coverage or use Studio.

Legitimate Interest: We rely on our legitimate interests for analytics, service improvement, fraud prevention, reminder emails, and marketing email to people who signed up, which you can always stop with the unsubscribe link.

Consent: When you join our newsletter or waitlist, you ask us to email you. You can withdraw that at any time with the unsubscribe link or by emailing us, without affecting anything we did before.

Payments: Paddle is our payment processor and merchant of record. Paddle collects your payment details, charges you, handles refunds, and calculates and collects tax. Paddle.js may also load Paddle's ProfitWell (Retain) script, which Paddle uses for billing, subscription and payment recovery. Paddle operates under its own privacy policy.

AI Processing: When you upload a screenplay for coverage or a deep dive, or use Studio's AI features, the text of your screenplay and your prompts are sent to DeepSeek (based in China) and OpenAI (based in the United States) so their models can analyze it and return results. Each provider handles the data under its own API terms and privacy policy. ScriptLix does not train AI models on your screenplays, but DeepSeek's terms allow it to use the inputs it receives to improve its own models.

Authentication: Firebase Authentication (Google) handles sign-in and processes your login details and sign-in tokens.

Analytics: We use Mixpanel for product analytics. Mixpanel receives the events described above, the page that referred you, campaign tags, and any Google ad click ID, and, if you are signed in, a profile with your user ID, email, name, sign-in details, and purchase totals. Mixpanel also records about 10% of sessions as session replays, with form inputs and script text masked. We also use Google Analytics 4 and the Google Ads tag, which receive page views and, when you arrive from a Google ad, the ad click ID.

Email: Brevo sends our email and receives your email address and the content of the emails we send you.

Error Reporting: Sentry receives technical error reports from our website and servers. It is set not to collect personal information by default, and we remove email and IP address from error reports before they are sent.

Infrastructure: Our servers and database are hosted by Hetzner in Germany. All traffic to scriptlix.com passes through Cloudflare, which provides our CDN, proxy, and security. Files such as images and uploads, and our backups, are stored with Backblaze B2.

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

We may disclose your personal data if required to do so by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of ScriptLix, our users, or the public.

Account data, screenplays you upload, coverage reports, and Studio documents are kept while your account exists, or until you ask us to delete them. Screenplays uploaded without an account are kept until you ask us to delete them.

Transaction records are kept for as long as tax and accounting law requires.

Server request logs are deleted automatically after 30 days. Analytics data held by Mixpanel and Google is kept under those services' retention settings.

We keep database backups for up to about 6 months. Data you delete, or that we erase at your request, may remain in those backups until they roll off.

You can download a copy of your account data at any time from your Settings page.

Deleting your account in Settings disables your login and hides your profile. If you have an active subscription, cancel it first. Deleting your account this way does not erase your screenplays, coverage, or other records.

For full erasure of all your data, including screenplays, coverage reports, Studio documents, your analytics profile, and your place on our email lists, email [email protected] with "Data Request" in the subject line. We complete erasure within 30 days, except for records the law requires us to keep and copies in backups, which roll off within about 6 months.

Under the GDPR, you have the right to: access your personal data and receive a copy in a structured, machine-readable format (data portability); request correction of inaccurate or incomplete personal data; request deletion of your personal data (right to be forgotten), subject to legal retention obligations; object to processing based on legitimate interests; restrict processing in certain circumstances; and withdraw consent at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority.

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information. Under the CCPA, "personal information" includes identifiers (name, email, IP address), commercial information (purchase history), internet activity (browsing, search history), and inferences drawn from this data.

Your CCPA rights include: the right to know what personal information we collect and how we use it; the right to request deletion of your personal information; the right to opt out of the sale or sharing of your personal information; and the right to non-discrimination for exercising your privacy rights.

We do not sell your personal information for money. We use Google Analytics and the Google Ads tag, which may count as "sharing" for advertising under California law. You can block them with your browser's cookie or tracker settings, or ask us to stop by contacting [email protected].

To exercise your CCPA rights, contact us at [email protected] with the subject line "CCPA Request." We will verify your identity before processing your request and respond within 45 days.

Sign-in: We do not use a cookie to keep you signed in. Your sign-in token is stored in your browser's local storage, or session storage if you choose not to stay signed in.

Local Storage: We also use your browser's local storage for your preferences, Mixpanel's analytics identifiers, and, if you arrive from a Google ad, the ad click ID, which we keep for up to 90 days.

Third-Party Cookies: Google Analytics and the Google Ads tag set cookies, Paddle sets cookies during checkout, and Cloudflare may set cookies for security. Google Analytics and the Google Ads tag load for every visitor to scriptlix.com. We do not currently ask for consent before loading them.

Your Choices: You can block or delete cookies and local storage in your browser settings, though parts of the site, such as staying signed in, may stop working. Mixpanel is set to respect your browser's Do Not Track setting. To turn Mixpanel off in a browser, visit scriptlix.com/?mp_optout=1 once. Our Google tags do not respond to Do Not Track.

Your data is processed in several countries: Germany (Hetzner hosting), the United States (OpenAI, Google, Firebase, Mixpanel, Sentry, and Cloudflare), China (DeepSeek), and other countries where our providers operate.

China does not have an adequacy decision from the European Commission, so screenplay text sent to DeepSeek does not have the same legal protection it has in the EU. If you do not want your screenplay to leave the EU, do not upload it for AI coverage and do not use Studio's AI features.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and, where required by applicable law (including GDPR Article 33), notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

Our notification will include the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.

ScriptLix is not intended for use by individuals under the age of 18. We do not knowingly collect, store, or process personal data from children or minors.

If we become aware that we have inadvertently collected personal data from a person under 18, we will take immediate steps to delete that information from our systems. If you believe that a minor has provided us with personal data, please contact us at [email protected].

Data between your browser and ScriptLix is encrypted in transit with TLS. Passwords are managed by Firebase and are never stored on our servers.

Access to personal data is limited to people who need it to run the service. No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. When we make material changes, we will provide prominent notice through the ScriptLix platform or by email. The effective date will be updated at the top of this policy.

We encourage you to review this policy periodically. Your continued use of ScriptLix after changes take effect constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or our data processing practices, contact us at [email protected]. For GDPR data subject requests, include "Data Request" in the subject line. For CCPA requests, include "CCPA Request" in the subject line.