Privacy Policy

Last updated: 28 August 2026

Your photos are the whole point of Scrappic, so it matters that you know exactly where they go. Here's the honest version.

The short version

We ask for as little as possible: an email address, a display name, and whatever you choose to upload.
We don't track you. No analytics, no advertising pixels, no third-party cookies.
Your photos are sent to Google's AI to be processed, and Google does not use them to train its models - we're on the paid API tier, where that is contractually excluded.
We never see your card details. Stripe handles payment.
Delete your account and your creations go with it.

Who is responsible for your data

The data controller is Jon Van Zandt, trading as Scrappic, of 31 Gatekeeper Close, Newcastle upon Tyne, NE13 9EH, United Kingdom, registered with the Information Commissioner's Office under number ZC218943.

For anything privacy-related, email support@scrappic.co.uk.

What we collect, and why

What	Why we need it	Our lawful basis
Email address and display name	To create your account, sign you in and email you about orders	Performance of our contract with you
Photos you upload, and the creations made from them	To provide the service you asked for - restyling, printing, scrapbooking	Performance of our contract
Delivery name and address	To get your printed order to you	Performance of our contract
Payment records (amount, date, last four digits, Stripe's reference)	To take payment, give refunds and keep our books	Contract, and legal obligation (tax records)
Credit history - what you bought and spent	So we can answer "where did my credits go?"	Performance of our contract
Basic technical data (IP address, error logs)	Security, rate limiting and fixing faults	Our legitimate interest in keeping the service up and unabused

We do not collect special category data deliberately. Photographs can reveal things like ethnicity, religion or health, so where that applies we rely on the fact that you chose to upload them for this purpose.

Children

Scrappic is for adults. You must be 18 to buy anything, and you shouldn't create an account if you're under 13.

Family photos often include children, and that's expected - but only upload photos of your own children, or children whose parent or guardian has agreed. Google's safety rules separately refuse to make video from photos containing children, and we don't override that.

Who your data is shared with

We use a small number of established suppliers to run Scrappic. They act on our instructions and can't use your data for their own purposes.

Supplier	What they handle	Where
Google (Gemini API)	Processes photos to create AI restyles, stickers and videos	Global / US
Supabase	Accounts database and file storage, and the emails that confirm your address or reset your password	United Kingdom (London)
Netlify	Hosts the website and our server functions	Global CDN / US
Stripe	Takes payments. Card details go straight to Stripe and never reach us	UK / EU / US
Prodigi	Prints and posts your orders - receives the artwork and delivery address	UK
Gandi	Hosts our support@scrappic.co.uk mailbox, so holds any email you send us	France (EU)

On AI training: Scrappic uses Google's paid Gemini API. Under Google's terms for paid API use, your prompts and uploads are not used to train Google's models. This is different from the free consumer Gemini app, where they may be.

We will also disclose data where the law requires it, or to protect someone's safety.

We never sell your data, and we don't share it with advertisers.

Sending data outside the UK

Some of the suppliers above process data in the United States. Where that happens, transfers are covered by the UK's International Data Transfer Addendum or by an adequacy decision, and by the suppliers' own standard contractual clauses.

How long we keep things

Photos and creations: until you delete them, or until you delete your account.
Account details: until you delete your account, then removed within 30 days.
Order and payment records: six years after the order, because HMRC requires it.
Error and security logs: up to 90 days.

Your rights

Under UK GDPR you can ask us to:

give you a copy of your data, or a portable export of it
correct anything that's wrong
delete your data ("the right to be forgotten")
restrict or object to how we use it

Email support@scrappic.co.uk and we'll respond within one month, free of charge. You can delete your account and everything in it yourself, from the account screen.

If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office - though we'd appreciate the chance to fix it first.

Security

Accounts are protected by row-level security in our database, which means the database itself refuses to hand one person another person's rows. Payment card details never touch our servers. Our AI keys are held server-side and are never sent to your browser. Everything travels over HTTPS.

No service can promise perfect security, so please use a password you don't use anywhere else.

Changes

If we change this policy we'll update the date at the top, and email you if the change is significant.