Privacy Policy

1. Who We Are and How to Reach Us

Scriplit LLC is a limited liability company registered with the Wyoming Secretary of State (Company ID 2024-001536050), with its registered office at 30 N Gould St Ste R, Sheridan, WY 82801, United States. We operate the website at scriplit.com and provide digital and business filing services.

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR, Scriplit LLC is the controller of the personal data described in this policy. For the purposes of the California Consumer Privacy Act as amended by the CPRA, we are a business.

You can reach our privacy contact at contact@scriplit.com or by telephone on (901) 401-0039. Because of our size we have not appointed a statutory Data Protection Officer, which is permitted under Article 37 GDPR as our processing is neither large-scale nor systematic monitoring. Privacy enquiries go directly to our founder.

2. Scope of This Policy

This policy covers personal information we handle when you visit scriplit.com, contact us by any channel, engage us for services, or are a representative of a client or supplier.

It does not cover: websites we build for clients, which are governed by that client's own privacy policy; third-party websites we link to; or personal data we process purely on a client's behalf as a processor, where the client is the controller and their own policy and our written processing agreement govern instead.

3. Personal Information We Collect

Below are the categories of personal information we have collected in the preceding 12 months, expressed using the category labels required by California law so that the same table serves both US and European disclosure requirements.

4. Where We Get It From

• Directly from you — when you call, email, message us on WhatsApp, use our live chat, or send us documents for a project or filing.
• Automatically from your device — server logs, cookies and analytics, as described in section 6.
• From our service providers — for example, our payment processor confirms that a payment succeeded.
• From public sources — occasionally a company register or a public business listing, where we need to verify a client's details for a filing.

We do not buy personal data from data brokers, and we do not scrape contact lists.

5. Why We Use It, and Our Legal Basis

Article 13(1)(c) GDPR requires us to tell you the purpose of each use and the legal basis we rely on. This table does that.

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interest does not override your rights. You may object to any such processing at any time under Article 21 GDPR, and we will stop unless we can demonstrate compelling grounds that override your interests.

Where we rely on consent, you may withdraw it at any time under Article 7(3) GDPR. Withdrawing consent is as easy as giving it, and does not affect the lawfulness of anything we did beforehand.

6. Cookies and Similar Technologies

Cookies that are strictly necessary for the website to function are set automatically, because without them the site cannot work. Everything else — analytics and our live chat widget — loads only after you agree, in line with Article 5(3) of the ePrivacy Directive 2002/58/EC and the GDPR consent standard.

If you are visiting from the EEA, the UK or Switzerland you will see a consent banner on your first visit. You can accept, reject, or choose which categories to allow, and rejecting is exactly as easy as accepting. You can change your mind at any time by clicking Cookie settings in the site footer.

We honour the Global Privacy Control signal. If your browser sends a GPC header we treat it as a valid opt-out of any sale or sharing and of non-essential cookies, automatically and without you needing to do anything else. This is required by California regulations and by several other state laws.

Our Cookie Policy lists every cookie we set, who provides it, what it does and how long it lasts.

7. Who We Share It With

We share personal information only with the categories of recipient below, only where necessary, and always under a written contract requiring them to protect it and use it solely on our instructions.

We will also disclose information where we are legally required to — in response to a valid court order, subpoena, lawful request from a public authority, or where disclosure is necessary to establish or defend legal claims, or to protect the rights and safety of any person. Where we are lawfully able to tell you about such a request, we will.

8. We Do Not Sell Your Personal Information

We disclose personal information for business purposes only, to the recipients listed in section 7, each of whom is contractually barred from using it for their own purposes.

9. How Long We Keep It

Article 13(2)(a) GDPR requires us to tell you our retention periods, not merely that we have some.

When a retention period ends we delete the data or irreversibly anonymise it. If you ask us to erase your data sooner we will do so, except where we are legally required to keep it — and if that happens we will tell you precisely which obligation prevents deletion.

10. International Data Transfers

Scriplit is based in the United States, so if you are outside the US your personal data will be transferred to and processed there. The United States does not have an adequacy decision covering all transfers, so we rely on the safeguards required by Chapter V GDPR:

• Standard Contractual Clauses. We enter into the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), and the UK International Data Transfer Addendum where the UK GDPR applies, with providers who process data on our behalf.
• Transfer risk assessment. We assess whether the law of the destination country undermines those clauses, and apply supplementary measures such as encryption in transit and at rest where appropriate.
• EU-US Data Privacy Framework. Where a provider is certified under the DPF, we may rely on that certification as an adequacy mechanism under Article 45 GDPR.
• Necessity for your contract. Where you engage us specifically to form a US company or make a US tax filing, transferring your data to the US is inherent in the service you asked for, and Article 49(1)(b) GDPR also applies.

You may request a copy of the safeguards we have in place by emailing contact@scriplit.com. We will provide them, redacted only for commercial terms.

11. How We Protect It

We apply technical and organisational measures appropriate to the risk, as required by Article 32 GDPR. In concrete terms: the whole site is served over HTTPS with HSTS; access to client files is restricted to those who need it and protected by multi-factor authentication; payment card data never touches our servers because it goes directly to PCI-DSS compliant processors; we keep software patched; and we review who has access on a regular basis.

12. Your Rights

Everyone who contacts us gets the following, regardless of where you live. We apply the strongest standard to all users rather than sorting people by jurisdiction.

13. Additional Rights: EU, EEA, UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, the rights in section 12 correspond to Articles 15 to 22 GDPR and you additionally have:

• The right to lodge a complaint with a supervisory authority under Article 77 GDPR. You may complain to the authority in your country of residence, place of work, or where you think an infringement occurred. In the UK this is the Information Commissioner's Office (ico.org.uk); in Ireland, the Data Protection Commission (dataprotection.ie). You do not have to contact us first, though we would appreciate the chance to help.
• The right to an effective judicial remedy under Articles 78 and 79, independently of any complaint.

We respond to requests within one month as required by Article 12(3) GDPR, extendable by two further months for genuinely complex requests, in which case we will tell you within the first month and explain why.

We do not currently have an establishment in the EU or UK and have assessed that we are not required to designate a representative under Article 27 GDPR, because our processing of EU residents' data is occasional, does not involve large-scale processing of special categories, and is unlikely to result in a risk to rights and freedoms. If that changes we will appoint a representative and name them here.

14. Additional Rights: California and Other US States

14.1 California

Under the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended by the CPRA, California residents have the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against for exercising any of these.

The categories we collect, our purposes, and the recipients we disclose to are set out in sections 3, 5 and 7 respectively, which together satisfy the notice-at-collection requirement. As stated in section 8, we do not sell or share personal information, so the "Do Not Sell or Share My Personal Information" right has nothing to act upon — but the mechanism is available at contact@scriplit.com and through the Global Privacy Control signal, which we honour automatically.

Limiting sensitive personal information. We use the government identifiers described in section 3 solely to perform the filing you engaged us for, which is a permitted purpose under § 1798.121(a) that does not trigger the right to limit. You may still ask us to restrict their use, and we will comply to the extent it does not make the filing impossible.

Authorised agents. You may use an authorised agent to make a request. We will ask for written proof of authorisation signed by you, and may ask you to verify your own identity directly.

Financial incentives. We do not operate any financial incentive or loyalty programme involving personal information.

Shine the Light. Under Cal. Civ. Code § 1798.83, California residents may request details of personal information shared with third parties for their direct marketing purposes. We do not share personal information for that purpose.

14.2 Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland and other states with comprehensive privacy laws in force have substantially similar rights: to confirm processing and access data, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling.

We recognise universal opt-out mechanisms including Global Privacy Control, as required by Colorado, Connecticut, Texas, Montana, Oregon and others.

Right to appeal. If we refuse your request, you may appeal by replying to our decision with the word "Appeal". We will review and respond in writing within 45 days, explaining our reasoning. If we deny the appeal we will give you a link to lodge a complaint with your state Attorney General. This appeal right is required by Virginia, Colorado, Connecticut, Texas and several other states, and we extend it to every US resident.

Nevada. Nevada residents may direct us not to sell covered information under NRS 603A. We do not sell it, but requests may be sent to contact@scriplit.com.

15. How to Exercise Your Rights

Email contact@scriplit.com with "Privacy Request" in the subject line, or call (901) 401-0039. Tell us what you want and enough detail for us to find your records.

• Verification. We will ask you to confirm details we already hold, so that we do not hand your data to someone impersonating you. For sensitive requests we may ask for more. We never ask you to create an account to make a request.
• Timing. US state requests: acknowledged within 10 business days, answered within 45 calendar days, extendable once by a further 45 days with notice. EU and UK requests: answered within one month, extendable by two months for complex requests.
• Cost. Free. We may charge a reasonable fee only for requests that are manifestly unfounded or excessive, particularly repetitive ones, and we will tell you before charging anything.
• Refusal. If we cannot comply we will explain why and tell you how to challenge the decision or complain to a regulator.

16. Children's Privacy

Our website and services are aimed at businesses and are not directed at children. We do not knowingly collect personal information from anyone under 16.

Under the US Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, verifiable parental consent is required before collecting personal information from a child under 13. Under Article 8 GDPR, information society services offered directly to a child require parental consent below an age set by each member state between 13 and 16. We apply the higher threshold of 16 everywhere rather than tracking the varying national ages.

If you believe a child has provided us with personal information, contact us and we will delete it promptly. If we discover it ourselves, we will delete it without waiting to be asked.

17. Data Breach Notification

If a personal data breach occurs we will act quickly and tell you honestly.

• Regulators. Where the GDPR or UK GDPR applies and the breach poses a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as required by Article 33 GDPR.
• You. Where a breach is likely to result in a high risk to you, we will tell you directly and without undue delay under Article 34 GDPR, in plain language, describing what happened, the likely consequences and what we are doing about it.
• US state law. All 50 states, the District of Columbia and US territories have breach notification statutes. We will comply with each applicable one, including any requirement to notify a state Attorney General or consumer reporting agencies, within the timeframes those laws require.

We will not delay notification to protect our reputation.

18. Automated Decision-Making

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR. We do not profile you for advertising and we do not use automated systems to accept or reject clients — a human being makes every decision about your work.

We use AI tools internally to assist with drafting and development. Where any client personal data is involved, it is handled under agreements that prohibit the provider from training models on it. We will never make a decision about you that has a significant effect without a human reviewing it.

19. Third-Party Links and Services

Our site links to other websites, including social media profiles, payment providers and government resources. Once you follow a link, that site's own privacy policy governs. We have no control over them and are not responsible for their practices, so it is worth reading their policies before giving them anything.

Where we build a website for a client, that finished site is operated by the client under their own privacy policy. Scriplit is not the controller for data collected through a client's site once it has been handed over.

20. Changes to This Policy

We may update this policy to reflect changes in what we do or in the law. The "Last updated" date at the top always shows the current version.

For material changes — a new purpose, a new category of recipient, or a change in legal basis — we will give prominent notice on the site and, where we hold your contact details and the change affects you, email you at least 14 days before it takes effect. Where a change requires your consent under applicable law, we will ask for it rather than assume it.

21. Contact and Complaints

For any privacy question, request or complaint:

We aim to answer every privacy enquiry within one business day and to resolve complaints ourselves. If we cannot, you always have the right to go to your data protection authority or state Attorney General, and we will never discourage you from doing so.