Privacy policy – Scorilo

Controller

beyond Agentur UG (haftungsbeschränkt)
represented by its Managing Director Kersten Burkhardt
Corveyer Ring 16
31535 Neustadt am Rübenberge
Germany

Email: info@beyond-agentur.com

The essentials

This privacy policy applies to the website scorilo.de and to Scorilo’s licensing service, through which you buy Scorilo, sign in to the app and activate your devices. The website sets no cookies and uses no analytics, tracking or advertising services. Fonts, images and videos are loaded from scorilo.de itself. Personal data is only processed as far as necessary to deliver the website, the download, the purchase, the license, the cancellation and support requests, or when you write to us.

Only Stripe processes addresses and payment details. We only receive a name if you enter it in the cancellation form. We do not collect phone numbers, serial numbers or characteristics of your hardware. Scorilo does not transmit usage statistics or the contents of your Scorilo files; it sends diagnostic data only when you attach it to a support request.

Hosting on GitHub Pages

The website is served via GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. With every request, GitHub processes the data your browser transmits for technical reasons:

IP address
date and time of the request
requested address and amount of data transferred
address of the page you came from (referrer)
browser and operating system (user agent)

According to GitHub, the IP addresses of visitors to GitHub Pages sites are logged and stored for security reasons. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is providing the website securely and reliably.

Data may be transferred to the USA in the process. GitHub is certified under the EU-U.S. Data Privacy Framework; the transfer is therefore covered by the European Commission’s adequacy decision (Art. 45 GDPR). You can find more information in GitHub’s privacy statement.

Downloads

The Scorilo versions on offer and the release notes are part of the website and are loaded with it from scorilo.de. To suggest the right download, the page reads in your browser which operating system and processor architecture you use. This information is evaluated only in your browser and not transmitted to us.

The installation files are delivered by GitHub, Inc. Only when you start a download does your browser load the file from GitHub; GitHub then receives the data your browser transmits for technical reasons, such as your IP address, date and time, your user agent and the address of this website as the origin. GitHub processes this data under its own responsibility; GitHub’s privacy statement applies.

Buying on the pricing page

When you choose a subscription on the “Pricing” page, your browser sends a request to our licensing service (license.scorilo.de). It contains the selected offer (monthly or yearly) and the language. For technical reasons, the licensing service receives your IP address, date and time, your user agent and the address of this website as the origin. The licensing service creates a payment page at Stripe and returns its address; your browser then switches to Stripe. No cookies are transmitted. This request only happens when you click a buy button.

The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into a contract). The server logs with IP addresses are kept for 30 days to protect against abuse and for secure operation (Art. 6 (1) (f) GDPR).

Cancellation form

Via the link “Cancel contracts here” you cancel your contract on the cancellation page. With “Cancel now”, your browser sends your name, the email address of the contract, the contract, the type of cancellation (ordinary or extraordinary) and, for an extraordinary cancellation, the reason to our licensing service (license.scorilo.de). For technical reasons, the licensing service receives your IP address, date and time, your user agent and the address of this website as the origin. No cookies are transmitted.

The licensing service stores the cancellation with the time of receipt, assigns it to your account via the email address if there is one, ends a subscription at the end of the term via Stripe for an ordinary cancellation and sends you the confirmation to the email address you entered. We process the data to handle the cancellation and to be able to prove that and when it was received.

The legal basis is Art. 6 (1) (b) GDPR (performance of the contract) and Art. 6 (1) (c) GDPR in conjunction with § 312k BGB (confirmation of the cancellation), and for keeping it as proof Art. 6 (1) (f) GDPR; our legitimate interest is proving the cancellation and its time.

Support requests

On the support page and in Scorilo under “Help → Contact Support…” you report a bug, ask a question or send a suggestion. The following is sent to our licensing service (license.scorilo.de):

the type of request (bug, question or suggestion), subject and description
your email address for the answer
up to three images, if you attach them
the language we write to you in
for technical reasons, your IP address, date and time, your user agent and, for the website, its address as the origin

The firewall of the licensing service (Google Cloud Armor) limits requests per IP address; the IP address is not stored in the database for this. The licensing service counts requests per email address only via a check value (hash) that expires after one day at the latest. No cookies are transmitted, and the page stores nothing in your browser. The licensing service stores the request on Google Cloud in Frankfurt am Main (region europe-west3, see below), the images without metadata such as location or camera data.

We only process a request from the website once you have confirmed your email address with the six-digit code we send you by email. The code is valid for 15 minutes; the licensing service stores it only as a check value. A request that is not confirmed or sent within 24 hours is deleted together with its images.

In Scorilo, the email address of your account is filled in. The app sends the request with the session of your activated device; the licensing service assigns it to your account, your license and the device. As long as “Attach diagnostics” is selected, Scorilo also sends this technical information, which you can view with “Show” before sending:

the version of Scorilo and of Electron
the operating system, its version and the processor architecture
the language of the user interface
the plan and status of your license
the number, size and scaling of the screens and which one shows the display
whether a match is open and whether the remote control is switched on
the free space on the drive of your workspace in whole gigabytes
which graphics features (GPU) Scorilo can use

When you open the dialog, Scorilo takes screenshots of the Scorilo windows and offers them to you. Only the images you select are sent.

For every request sent, we create a task in our task management at GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). It contains the reference of the request, type, subject and description, the language, whether the request comes from the app or the website, for requests from the app the diagnostic data, and for each image only its file type and size. GitHub does not receive your email address, the images, your IP address or identifiers of your account, license or device. GitHub receives what you write in the subject and description exactly as you write it, so only enter what we need to handle your request. GitHub is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is based on the European Commission’s adequacy decision (Art. 45 GDPR).

By email you receive the confirmation code, an acknowledgement with the reference, our answers and a message when we close the request. Replies to these emails go to support@scorilo.de.

For customers, the legal basis is Art. 6 (1) (b) GDPR (performance of the contract); for prospective customers, Art. 6 (1) (f) GDPR; our legitimate interest is answering your request and improving Scorilo. For limiting requests, the legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protection against abuse.

We delete the request and its images 180 days after we have closed the task, but no later than two years after it was sent. The task at GitHub remains; on request, we also remove the description there.

Payment with Stripe

Payments are handled by Stripe: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. On Stripe’s payment page you enter your email address, your billing address, your payment details and, if you wish, a VAT identification number. Stripe processes this data for payment, invoicing and taxes and creates the invoices. From Stripe we receive your email address, the state of your subscription (plan, status, term) and Stripe identifiers, but no complete payment details.

The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and, for keeping invoices, Art. 6 (1) (c) GDPR (statutory retention obligations). Stripe acts as our processor and is an independent controller for some purposes, such as fraud prevention and its own legal obligations. Stripe also processes data outside the EU; transfers are based on standard contractual clauses and the EU-U.S. Data Privacy Framework. Stripe stores payment and invoice data according to its own retention periods and statutory retention obligations. On Stripe’s pages, Stripe’s privacy policy applies.

Licensing service: sign-in, activation and license check

Scorilo only works with a valid license. For this, the app connects to our licensing service: when you sign in, start the trial, activate a device, manage devices and during the regular license check (usually once a day when an internet connection is available). The app sends:

your email address when you sign in
a random installation ID that Scorilo creates on installation (not a characteristic of your hardware)
the device name you set on activation; a name such as “Mac (macOS)” is suggested, not the name of your computer
operating system, processor architecture and Scorilo version
for technical reasons, your IP address

To sign in, we send you a six-digit code by email that is valid for 15 minutes. The licensing service stores sessions and codes only as check values (hashes). The license the licensing service issues to the app contains no email address, no name and no payment details.

The legal basis is Art. 6 (1) (b) GDPR: without an email address and activation we cannot provide you with a license. For security logs, limiting the trial per installation and tracing license changes, the legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is secure operation, protection against abuse and resolving disputes and support requests.

What the licensing service stores and for how long

Email address of your account: as long as the account exists, deleted three years after the end of your last license
License and billing state (plan, status, dates, Stripe identifiers): as long as the email address
Sign-in requests (hash of the email address, email address encrypted until use, check value of the code, installation ID): 24 hours
Sessions (only as a hash): account sessions 24 hours, device sessions until the device is signed out
Devices (device name, operating system, processor architecture, Scorilo version, day of activation and of the last connection, installation ID): as long as the device is active, 90 days after it is signed out
Log of license and device changes (identifiers, status changes, initiating party): three years
Cancellations from the cancellation form (name, encrypted email address and its hash, contract, type of cancellation, reason, time of receipt, result of processing): three years from receipt
Support requests (type, subject, description, language, encrypted email address and its hash, images, check values of the confirmation code and the request’s access key, number of the task at GitHub, times of receipt, answers and closing; from the app also diagnostic data and identifiers of account, license and device): 180 days after the request is closed, no later than two years after it was sent; unconfirmed requests 24 hours
Marker against repeated trials (hash of the installation ID and start of the trial, without reference to the account): 365 days
Identifiers of processed Stripe events: 90 days
Server logs (IP address, user agent, requested address, status): 30 days

No IP addresses are stored in the licensing service’s database.

Data on your computer

Scorilo stores on your computer the installation ID, the signed license, the device session (encrypted with the operating system’s key management where available) and the email address you are signed in with. This data remains until you sign out in Scorilo (which removes the email address) or uninstall it. The legal basis is Art. 6 (1) (b) GDPR and, for storage on your device, § 25 (2) no. 2 TDDDG.

Hosting of the licensing service on Google Cloud

The licensing service runs on Google Cloud Platform (Cloud Run, Firestore, Cloud Storage, Cloud Armor, Cloud Key Management Service, Cloud Logging) in the europe-west3 region in Frankfurt am Main. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data as a processor on the basis of the Cloud Data Processing Addendum. The data is stored in the EU. For support and operational access by Google, a transfer to third countries, in particular the USA, cannot be ruled out; it is based on standard contractual clauses and the EU-U.S. Data Privacy Framework. You can find more information in the Google Cloud Privacy Notice.

Sending emails with Brevo

We send the emails with the sign-in code, the cancellation confirmations and the emails about support requests via Brevo, a service of Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France. For this, Brevo processes your email address and the content of the email as a processor in the EU. The legal basis is Art. 6 (1) (b) GDPR, for support requests from prospective customers Art. 6 (1) (f) GDPR. You can find more information in Brevo’s privacy policy.

Contact by email

When you write us an email, we process your address and your message to answer your request. The legal basis is Art. 6 (1) (b) GDPR if it concerns a contract or steps prior to one, otherwise Art. 6 (1) (f) GDPR; our legitimate interest is answering your request. We delete the data when it is no longer needed for this and no statutory retention obligations apply.

Your rights

You have the right to access the data we process about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Contact us at the email address above. On request, we delete your account with the licensing service together with your support requests; a running subscription must be cancelled first. We delete individual support requests at any time on request. Data that we or Stripe are required by law to keep is only deleted after the retention period has expired.

Right to object: Where we process data on the basis of Art. 6 (1) (f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz Niedersachsen (Data Protection Commissioner of Lower Saxony)
Prinzenstraße 5
30159 Hannover, Germany
www.lfd.niedersachsen.de

Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.