Privacy Policy | Scrumagic

Who we are

Scrumagic is an AI-native Scrum training simulator, operated by Bepmpro, 3B1-2, Gulberg III, Lahore, Pakistan. We are the controller for the personal data we collect about users of Scrumagic: we decide how and why it is used.

Privacy questions: info@scrumagic.com, or by post at 3B1-2, Gulberg III, Lahore, Pakistan.

What we collect and why

For each kind of data, this is what we collect and what we use it for. Payment details are collected by Paddle, which acts as a controller of that data in its own right (see "Who we share it with").

Account details: your name and email address, a hashed version of your password (we never store the password itself), whether your email is verified, your role, and the date you confirmed you are 13 or older. If you use "Continue with Google", Google gives us your name, email address and a Google account ID. Used to create and secure your account, sign you in, and send emails you need such as verification and password reset.
Security settings (if you turn them on): your two-factor secret and recovery codes (stored encrypted) and the public key, name and device type of each passkey. Passkey private keys never leave your device. Used to protect your account.
Simulation content: the seat you play, your decisions and reasons, anything you type into a simulation, the conversation with your AI teammates, the documents (artifacts) you produce, your progress and your scores. Used to run your simulations, save your progress and show your results.
Billing details: if you buy a plan, we receive your Paddle customer ID, your plan and subscription status, and a record of transactions. We do not receive or store your card number. Used to give you the plan you bought and keep the records the law requires.
Usage and device data (analytics): pseudonymous identifiers from cookies, pages and screens viewed, events such as clicking a button or creating an account (for a new account we record only that one was made and whether it was with a password or with Google), how you reached us, and your browser, device, operating system, language and approximate location (derived from your IP address). We do not send your name, email address or account ID to Google Analytics. Used to understand how Scrumagic is used and improve it.
Where you came from: when you reach us through a link we have set up, such as a post, a listing or a campaign page, we keep the name of that link, the source it names and, if your browser tells us, the website you came from (the host only, never the full address) with your account until the account is deleted. Used to see which posts and pages bring people who find Scrumagic useful. We do not keep your IP address or browser details for this.
How you heard about us (optional): if you answer the optional question on your dashboard, we keep your choice and any short note you add with your account until the account is deleted. Used to see which posts and articles are useful. We do not send your answer to Google or to any other service.
Technical and security data: your IP address and browser type, and the requests that reach our servers, kept in session records and server logs. Used to keep the service secure, prevent fraud and abuse, and fix errors.
Support messages: if you email us, we keep the message and our reply. Used to answer you.
Messages through the contact form: the name and email address you type, the topic you choose and your message, and whether you were signed in at the time. We do not store your IP address with the message; it is used only to limit how many messages one address can send in an hour. The form does not use a third-party service, and it does not send you an automatic reply. Used to answer you, and to keep the form from being used to send spam.
News and announcements: if you turn on "News and tips" in your email preferences, we keep that choice and the date you made it, and we may email you about new scenarios and plans. When paid plans open we may also tell people who joined the list for paid plans, and, only where the law allows it, other account holders; we keep a record of who was sent that announcement so that each person gets it once. Every one of these emails has an unsubscribe link, and unsubscribing keeps you out of later announcements. We may also show a short note about something new in the notification bell inside Scrumagic, which does not depend on that choice. Used to tell you about the service you use.
Which getting-started emails we have sent you: we may send you up to six short emails after you sign up: one to remind you to verify your email address if you have not yet, and, once you have verified, the others about starting a run and what to do next. The reminder goes to the address given at sign-up, even before it is verified; if someone else signed up with your address, you can ignore it or use its unsubscribe link. We keep a record of which ones we sent so each goes out once. They are sent only between 8 AM and 8 PM in your own timezone, each has an unsubscribe link, and you can switch them off at any time in your email preferences. Used to help you get started with the service you signed up for.
Feedback you send from your account settings: your name and email address from your account, the topic you choose and your message, and our reply if we send one. Used to read your feedback, answer you and improve Scrumagic.
Problems on your runs, and reports you send: when something goes wrong on one of your runs, for example an error, a step that cannot move on or an AI answer that failed, we record what happened: the kind of problem, the step and sprint, where the run stood, the name of the error and when it happened. We do not record what you typed. If you use "Report a problem" on a step, we also keep the kind of problem you chose and the note you write (up to 500 characters, optional), and we email you a confirmation and tell you in the notification bell when we have dealt with it. Only our administrators can read these records. We also run automatic checks on the service itself, for example for background jobs that failed and for subscription records that look out of date; when one of these concerns your account, it is kept with your account in the same way. Used to find and fix problems, answer you and keep the service reliable.

AI teammates and your data

Your AI teammates are generated by large language models run by third-party AI providers, not by us. To write a teammate's reply, we send our AI provider the information needed for the current moment of your simulation: the scenario text, a summary of what has happened, your decisions, and any text you have typed in that simulation.

We do not send your name, email address or account ID to the AI provider.
We use OpenRouter, a service that routes each request to an AI model provider. The request is therefore processed by OpenRouter and by the model provider it is routed to, each under its own terms and privacy policy.
We do not use your content to train AI models ourselves, and we do not sell it.
We keep an operational record of each AI request (which model was used, how long it took, how much text was processed and whether it succeeded) to keep the service reliable and to control costs.
Scores and scorecards are calculated automatically from your decisions using fixed rules. They are learning feedback only and have no legal or similarly significant effect on you.

Please do not type personal information about real people, or confidential information about your employer or clients, into a simulation. You never need to: everything in Scrumagic is fictional.

Legal bases

Where the law (such as the UK or EU GDPR) requires a legal basis, we rely on:

Performance of a contract: to create your account, run your simulations, and provide the plan you bought.
Legitimate interests: to keep Scrumagic secure, prevent fraud and abuse, fix bugs, control costs, answer your messages, send the short getting-started emails, and, where consent is not required, understand and improve how the service is used. These interests are balanced against your rights, and you can object (see "Your rights").
Consent: for analytics cookies and similar technologies where the law requires it, and for any optional email. You can withdraw consent at any time.
Legal obligation: to keep payment, tax and accounting records and to respond to lawful requests.

We do not sell your personal data. We share it only with the following, and only what they need:

Paddle, our merchant of record, for the sale of Scrumagic, subscription management and payments, and tax compliance and invoicing. Paddle collects your payment details and other checkout information itself and is a controller of that data under Paddle's privacy policy.
Service providers (processors): our hosting provider; an email delivery provider (Amazon Simple Email Service); OpenRouter and the AI model providers it routes to (see above); and Google for Google Tag Manager, Google Analytics and, if you choose it, Google sign-in.
Professional advisers such as lawyers, accountants and auditors, where needed.
Authorities and others where the law requires it, or to protect the rights, safety or security of people or the service; and a buyer or successor if the business is sold or reorganised (this policy would continue to apply to your data unless we tell you otherwise).

Cookies

Cookies are small files a website stores in your browser. Here is what we use, by purpose.

Essential cookies (always on)

These make Scrumagic work and cannot be switched off in our settings:

Session cookie: keeps you signed in and holds your place while you use the app.
Security (CSRF) cookie: protects forms and actions from being triggered by other websites.
"Remember me" cookie: set only if you tick that box when signing in.
Cookie choice: a small record of the cookie choice you make, so we do not keep asking.

Analytics cookies (only with your consent where required)

We use Google Analytics to see how Scrumagic is used, for example which pages are visited and where people get stuck, so we can improve it. We load it through Google Tag Manager, a tool that loads our analytics only after your consent choice is known; it does not collect extra information about you for us. Google Analytics sets cookies named _ga and _ga_<ID>, which typically last up to two years, and sends usage data to Google. Where the law requires consent, such as in the UK and the European Economic Area, we only set these cookies after you agree. We do not send your name, email address or account ID to Google Analytics.

Marketing cookies

We do not use marketing or advertising cookies, and we do not use Google Analytics for advertising.

Managing your preferences

Use the cookie settings in Scrumagic to accept or decline analytics cookies, and change your mind at any time.
Your browser lets you block or delete cookies; blocking essential cookies will stop sign-in from working.
You can also install Google's Analytics opt-out browser add-on.

If you open the Paddle checkout or sign in with Google, those companies may set their own cookies on their own pages, under their own policies.

How long we keep it

We keep your account and simulation data for as long as your account exists. When you delete your account, we delete your profile, your simulation runs, transcripts and artifacts, and your AI request records. More generally, we delete or anonymise personal data when we no longer need it for the purposes above. Copies in routine backups are removed as those backups are overwritten. Records we must keep by law, such as payment and tax records, are kept for as long as the law requires (Paddle keeps these as merchant of record). Messages sent through the contact form are kept for 12 months and then deleted, and the copy emailed to our inbox is deleted on the same schedule. Feedback you send from your account, and contact-form messages you send while signed in or from your account's email address, are deleted when you delete your account. Deleting your account also cancels any subscription you have, straight away; Paddle keeps its own payment and tax records, as above. Problem records and reports from your runs are kept until we have dealt with them and for 90 days after that, and are deleted sooner if you delete your account or the run they belong to. Server logs are kept for 90 days and then deleted. Google Analytics data is kept for the retention period we set in Google Analytics, after which it is deleted.

Your rights and choices

You can view and update your name and email, change your password, and manage two-factor authentication and passkeys in your account settings, and you can delete your account from your account settings at any time.
Depending on where you live, including under the UK and EU GDPR, you have the right to access your data, have it corrected or erased, restrict or object to how we use it, receive a portable copy, and withdraw consent at any time.
Download your data yourself: in your account settings, under Profile, "Download my data" gives you one file you can read or take elsewhere. It holds your account details, your runs with what you said, decided and wrote, your scorecards, the messages and feedback you sent, your plan, promo and billing records, and your sign-in history. It leaves out what would let someone sign in as you, such as your password, two-factor secrets, passkey keys and session contents.
To use any of these rights, email info@scrumagic.com. We reply within one month; where the law allows, we may extend that for complex requests, and we will tell you if we do.
If you live in a US state with its own privacy law, you may have similar rights, for example to know what we hold, to have it deleted and to opt out of its sale. We do not sell personal data. Email us to use them.
You can complain to your local data protection authority, for example the Information Commissioner's Office in the UK. We would like the chance to put things right first, so please contact us.

Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), hashed passwords, encrypted two-factor secrets, and access controls that mean only you can open your own simulations and only authorised people can reach our systems. No online service can promise perfect security, so please use a strong, unique password or a passkey, and turn on two-factor authentication.

International transfers

Our providers, and we, may process data outside the country where you live, including in the United States (for example Google, OpenRouter and its model providers, and Amazon) and in Pakistan, where we operate from and may access your data. Where personal data leaves the UK or the European Economic Area, we rely on safeguards such as an adequacy decision, standard contractual clauses or the UK international data transfer agreement or addendum, put in place with or by those providers. You can contact us for more information.

Children

Scrumagic is not for children under 13, and you must confirm you are 13 or older to register. If we learn that we hold data from a child under 13, we will delete it. If you believe this has happened, please contact us.

Changes to this policy

We may update this policy as Scrumagic changes, for example when we add a service provider or a feature. The "last updated" date above shows the current version, and we will tell you about significant changes, for example by email or a notice in the app, before they take effect.

Contact

Questions about privacy? Email info@scrumagic.com.

Bepmpro, 3B1-2, Gulberg III, Lahore, Pakistan