Privacy Policy

1. Controller

Skriva is a registered trade name of Webwakers, a sole proprietorship (eenmanszaak) established in the Netherlands, KvK 91473381. Webwakers is the controller for the personal data described in this policy. Contact: support@skriva.io.

2. Data we process

• Account data — name, email address, hashed password, two-factor-authentication settings, and your marketing-email preference.
• Content data — websites you connect, pages we crawl on your instruction, brand-voice profiles, topics, and generated articles.
• Connection data — encrypted credentials/tokens for services you link (Google Search Console, WordPress, Payload, Statamic, Magento).
• Usage data — metering of plan usage (generations, scans, discovery runs), technical logs needed to run and secure the Service, and for each sign-in session the IP address and browser it was started from, kept until that session expires.
• Origin data — when you sign up: the campaign tags in the link you first arrived through (such as utm_source), the domain of the site that referred you, the first page you saw and the date. If you accepted analytics cookies, also the random Google Analytics identifier of your browser. Then, as you go: when you signed up, started a trial, published your first article, paid or cancelled.
• Billing status — your plan and subscription state. Payment details, billing address, and VAT numbers are collected and stored by Polar (Merchant of Record), not by us.

3. Purposes and legal bases

• Providing the Service you signed up for — performance of a contract (art. 6(1)(b) GDPR).
• Transactional email such as verification, password reset, and important account notices — performance of a contract.
• Security, abuse prevention, and service improvement — legitimate interest (art. 6(1)(f)).
• Knowing which channels bring us customers (origin data, counted in our own database) — legitimate interest.
• Website statistics with Google Analytics, and reporting sign-ups, trials and payments to it — only with your consent (art. 6(1)(a)), given in the cookie banner and withdrawable at any time.
• Product news and tips by email — only with your consent (art. 6(1)(a)), given at sign-up or in settings, withdrawable at any time.

4. Subprocessors

We share data with the following processors, only as needed to run the Service:

• Polar Software Inc. — payments and invoicing as Merchant of Record.
• Anthropic — AI text generation; receives site content and prompts needed to generate your drafts.
• Firecrawl — crawling/scraping of websites you connect.
• Google — only if you link a Google account, to read Search Console data for the properties you select.
• Brevo — delivery of transactional email.
• DataForSEO — search-volume and AI-visibility lookups for the topics and brand names you track; receives keywords and domain names, no account data.
• Sentry — error reporting; receives technical error details and, where an error is tied to a signed-in session, your account id (never your email or content).
• Google Ireland Limited — website statistics (Google Analytics 4), only if you accept analytics cookies. Receives the pages you visit on our public site (never the app), a random browser identifier, your account id, and the moments you sign up, start a trial or pay. No name, email or content. Collected in the EU; IP addresses are not stored.
• Hetzner Online GmbH — application hosting and data storage (EU data centres).

5. Retention

We keep your data for as long as your account exists. Deleting a site removes its content data. You can delete your account yourself under Account settings → Your data: your subscription is stopped immediately and your account, sites, articles, brand voices and connections are removed right away. Invoices are kept for seven years as Dutch bookkeeping law requires, holding only what an invoice must; encrypted backups roll over within 30 days. You can also download a copy of your data from the same place, or ask us at support@skriva.io.

Some records are cleared on a fixed term while your account is still open. A daily job removes them automatically:

• Email-verification and password-reset links — until it expires.
• Sign-in sessions — until it expires.
• The record of which automated email we already sent you — 90 days.
• Plan-usage metering — generations, scans and discovery runs, and the activity history behind them — 13 months.
• What each external AI or search call cost us — 13 months.
• A payment event we could not match to an account, once it has been matched — 30 days after it is resolved.
• A payment event we could never match to an account — after that it is a bookkeeping matter for Polar, not a customer waiting for access — 13 months.

6. Cookies

Google Analytics only runs after you accept it in the cookie banner. If you reject it, nothing is sent to Google. You can change your choice at any time via Cookie settings in the footer of our public pages; withdrawing removes Google's cookies. The signed-in app never loads Google Analytics.

• Sign-in session, two-factor verification, Google-connect CSRF token (Skriva) — needed to sign in and keep the account secure. No consent needed.
• skriva_consent (Skriva, 6 months) — remembers your cookie choice. No consent needed.
• skriva_src (Skriva, 90 days) — remembers the campaign, referring site and first page of your first visit, so we can see what brought you if you sign up. Stays on skriva.io; never shared. No consent needed.
• _ga, _ga_* (Google, up to 2 years) — Google Analytics statistics. Only with your consent.

7. Marketing email

We only send product news if you opted in — via the optional checkbox at sign-up or the toggle in Account settings. Every marketing email contains an unsubscribe link; transactional email (verification, password reset, billing notices) is sent regardless because the Service cannot function without it.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, and receive a portable copy of your personal data, to restrict or object to processing, and to withdraw consent at any time. Contact us at support@skriva.io to exercise these rights. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

9. Changes

We will announce material changes to this policy in the app or by email before they take effect. See also our Terms of Service.