Legal
Service Providers
Version 1.0. Last updated: 15 November 2026
1. Who processes personal data for us
These providers help us run Scrupling. Each acts on our instructions under data-processing terms (Article 28 GDPR) and keeps data secure. We never sell personal data. More detail is in the Privacy Policy.
| Provider | What for | What it receives | Where |
|---|---|---|---|
| Supabase | Sign-in and the database that holds your account and workspace | Email, account ids, everything you save in Scrupling | EU (Frankfurt, Germany) |
| Microsoft Azure | Runs the application; technical logs (30 days); encrypted daily backups (30 days) | Request data, logs without personal content, database backups | EU (Germany) |
| Cloudflare | DNS, the encrypted connection and protection against abuse | IP address, browser details, the pages you request | Global network; EU Standard Contractual Clauses |
| Resend | Sends our emails: sign-in, invitations, alerts by email and optional reports | Email address and the content of the email | EU sending region; company in the US, EU Standard Contractual Clauses |
| Google (Gemini API, paid tier) | Answers your Scrupling AI questions | Your question and the parts of your own data needed to answer it | Google infrastructure; EU Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Sentry | Error reports, so we can fix faults | Error type, code location and page path, with emails, tokens and ids removed | EU (Germany) when configured |
| Plausible Analytics | Counts page visits, only if you choose “Accept all” | Page address without ids, referring site, browser type; IP used for a daily count, never stored | EU |
| Telegram, Discord, push services (Google, Apple, Mozilla, Microsoft) | Deliver alerts, only if you connect them | The alert text (your decision name and what changed) and the chat or device you connected | Their own infrastructure, under their own terms |
| Stripe (when payments open) | Payments and invoices; not used during the free beta | Email, billing details; card details go to Stripe only | EU and US; EU Standard Contractual Clauses |
2. Data sources that receive nothing about you
Our servers read public market and token data from CoinMarketCap, Hyperliquid, DefiLlama, FRED, Deribit, DexScreener, RugCheck, GoPlus and a Solana RPC provider. They receive only what any public request contains: a coin, a token contract address or, if you connect one, your public Hyperliquid address. They receive nothing that identifies you.
3. Changes
We update this list before a new provider starts processing personal data. Account holders can ask to be told of changes, or object to one, at [email protected].