The short version
- We only access the accounts you connect, and use their data only to run Scrollbase for you.
- We never sell your data or your customers' data, and we don't use it to advertise to anyone.
- The keys and tokens you give us are encrypted, and you can disconnect any account at any time.
- Data from Google Ads follows Google's API Services User Data Policy, including its Limited Use requirements.
- You can ask for a copy of your data, or for it to be deleted, whenever you like.
A summary for convenience. The full text below is what applies.
On this page
1.Who we are
Scrollbase (scrollbase.io) is a platform for ecommerce brands. It makes and launches ads, builds store pages, tracks profit and attribution and writes emails, using the stores and ad accounts a brand connects to it. Scrollbase is run by INNOBRANDS LLC (“Scrollbase”, “we”, “us”).
This policy covers two kinds of data:
- Data about you, the people who use Scrollbase or join its early-access list. We decide how this data is used (we're its “controller”).
- Data in the accounts you connect, including data about your own customers, your store's visitors and the people who comment on your posts. We handle it for you and only on your instructions (as your “processor” or “service provider”). Your own privacy policy covers it toward your customers.
2.What we collect
From you
- Account details: your name, email address and password (stored only as a salted hash), your role, and the invite you joined with.
- The early-access list: your email address, the form you used, the campaign tags (UTM parameters) of the link you came from, and the page that referred you.
- What you upload and make: footage, photos, audio, product details, scripts, ad copy, pages, emails, notes and settings, other brands' ads you save for inspiration, and the requests you send to Scrollbase's AI assistants. Footage can show the creators and other people in it and carry their voices; Scrollbase keeps a creator's name when your folders use it.
- How you edit: the changes you make in the editors and the suggestions you take or turn down. Scrollbase logs them to learn your brand's preferences.
- Finance and tax details, if you use those features: the entries you add, such as payees and amounts, and your tax profile, which can include owners' names, your business's address and EIN, wages and other income (yours and your spouse's), your children's names and ages, and amounts such as mortgage interest, childcare and health insurance. We never ask for a Social Security number, and these details are never sent to AI providers.
From the accounts you connect
Only from the accounts you choose to connect, and only while they're connected:
- Shopify: your orders (amounts, items, refunds, the names of the payment methods used, the customer's state or province and country, Shopify's customer ID, whether it was the customer's first order, and the visits that led to it: landing pages, referrers and campaign tags), your products, variants, prices and costs, store reports such as sessions and email results, your store's plan and billing address, and your theme, pages, menus, files and policies. We don't store your customers' names, email addresses, phone numbers or street addresses from orders. When you use Support, a customer's orders (with their name, email and shipping address) are read from Shopify when you open their conversation, shown to you, and not stored.
- Meta: your ad account's campaigns, ad sets, ads and their results, and your Facebook Page's and Instagram account's posts. The comments on them, with the commenter's name or username, are read when you open them and aren't stored. When you study one of your ads in Ad lessons, we download its video.
- Google Ads: see Google user data below.
From your store's visitors and customers
If you turn these features on for your store, Scrollbase collects this for you:
- The Scrollbase pixel (a Shopify custom pixel you add): store events such as page views, product views, add-to-carts and purchases, with the page address, the referrer, campaign tags and ad click IDs, Shopify's anonymous browser ID, and the order ID and checkout token for purchases. It doesn't collect names, email addresses or phone numbers. The visitor's IP address is used only for a moment, to block abuse, and is never stored.
- Heatmaps and page tests: how visitors scroll, click and move on your store's pages (with email addresses and phone numbers in clicked text masked), how fast pages load and which errors they hit, a random visitor ID kept in the visitor's browser for up to a year, and a session ID kept for 30 minutes. Keystrokes and form entries are never recorded, and the copies of pages behind the heatmaps leave out form values and signed-in customers. Page tests set a cookie for up to 90 days, so each visitor keeps seeing the same version.
- Reviews: what customers enter on your review link: their rating, review, name and photos, and, if they choose, their order number and email address. The email address is used only to confirm the order and is never shown, and a salted hash of the IP address helps stop spam. The name, review and photos are published on your store.
- Support email: when you forward your support address to Scrollbase, the emails your customers send to it: the sender's name and email address, the subject, the message, its attachments and the email's technical headers, kept with the replies you send and notes you add. The AI's drafts and how it sorted each email are kept with them.
It's up to you to tell your store's visitors about these features in your own privacy policy and, where the law requires it, to ask for their consent. When your store collects consent through Shopify, the heatmaps follow each visitor's choice.
Automatically
- Sign-in sessions: while you're signed in, your session keeps your IP address and browser type, to keep your account secure.
- Cookies and browser storage: see Cookies and browser storage. scrollbase.io has no analytics or advertising trackers.
3.How we use it
We use data to:
- run Scrollbase for you: show your numbers, credit orders to the ads and channels that brought them, make and edit your ads, pages and emails, and do what you ask in your connected accounts;
- learn your brand's preferences from your edits, choices and results, so Scrollbase's drafts and suggestions fit your brand;
- keep Scrollbase secure, prevent abuse and fix problems;
- write to you about your account, the service and your early-access invite;
- meet our legal obligations.
We don't sell personal data, and we don't use your data or your customers' data to advertise to anyone, or share it for advertising (what California law calls “cross-context behavioral advertising”).
Where the GDPR or a similar law applies, we rely on our contract with you (to provide Scrollbase), our legitimate interests (to keep it secure and make it better), your consent (where we ask for it) and our legal obligations.
4.How Scrollbase uses AI
Scrollbase uses AI models from other companies to do much of its work. When you use a feature, the content it needs is sent to the provider that does that job, and the result comes back to Scrollbase:
- Anthropic (Claude) reviews footage (frames and transcripts), writes scripts, ad copy, emails, pages and store policies, answers your requests in the assistants, and reads your results to suggest changes. For Support, it reads each customer email with the conversation before it, the customer's orders (without street addresses) and your store's policies and products, to sort it and draft a reply that you approve.
- OpenAI makes and edits pictures from your product photos and footage frames, including AI people drawn for your ads.
- ElevenLabs records voiceovers and transcribes the audio in your footage.
- fal.ai makes AI video clips from your footage frames and stills, and finds the AI people in AI scenes (pictures and video) so the rest of the room can be kept as it is.
Each request carries only what that job needs. We don't use your data, or your customers' data, to train AI models.
5.Google user data
Scrollbase connects to Google Ads through a Google Cloud service account that belongs to Scrollbase. You give it access by adding its email address as a user in your Google Ads account, and you can remove it there at any time (Admin, then Access and security). Scrollbase doesn't use Google sign-in and doesn't ask for any other Google data.
What we access
Through the Google Ads API, for each Google Ads account you add Scrollbase to: the account's name, ID, currency, time zone and tracking settings (such as auto-tagging); its campaigns, budgets, ad groups, ads, keywords, negative keywords and assets; the search terms that showed your ads; your conversion actions; and results such as impressions, clicks, cost and conversions.
How we use it
- to show your Google Ads results and reports in Scrollbase;
- to draft and create the campaigns you approve (they're created paused, so nothing runs until you switch it on), and to make the changes you click, such as pausing a campaign or adding a keyword;
- to check your account's tracking settings, and to set up Scrollbase's tracking when you ask.
How we store it
Reports are kept in memory for about 10 minutes, so pages load quickly, and aren't saved. We save the account's ID, name, currency and time zone, the campaigns you plan and create in Scrollbase, and the AI drafts behind them. The service account's key is encrypted at rest.
How we share it
We don't sell Google user data or transfer it to anyone, except: to our AI provider, when you ask Scrollbase to draft or check a Google campaign, with only what that request needs and only to produce it; to comply with the law; or as part of a merger, acquisition or sale of assets, and then only after asking for your explicit consent.
What we never do with it
- use it for anything other than the features above;
- use it to target, retarget or personalize ads, or to build profiles of people;
- sell it, or give it to advertising platforms, data brokers or other information resellers;
- use it to decide creditworthiness or for lending;
- let people read it, except with your permission (for example, when you ask us for help with something specific), for security (such as investigating a bug or abuse), to comply with the law, or once it's aggregated and anonymized for our internal operations;
- use it to develop, improve or train generalized AI or machine-learning models.
Scrollbase's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Removing access
Remove Scrollbase's service account from your Google Ads account, or disconnect Google Ads in Scrollbase's settings, and Scrollbase can no longer reach it. To have the Google Ads data we've saved deleted too, follow Deleting your data.
7.How we protect it
- Data travels encrypted (HTTPS).
- The API keys, access tokens and service account keys you give us are encrypted at rest with AES-256-GCM, using a key kept apart from the database.
- Passwords are stored only as salted hashes.
- Only the people who run Scrollbase can reach its servers, and the database is backed up every day.
No system is perfectly secure, but we work hard to protect your data, and we'll tell you without undue delay if a breach affects it.
8.How long we keep it
- Your account and what you upload and make: while your account is open. We delete it within 30 days after you close your account or ask us to.
- Data from connected accounts: while your account is open. Disconnecting an account stops Scrollbase from reading it; what's already stored stays until you ask us to delete it or close your account.
- Google Ads reports: about 10 minutes, in memory only.
- Comments on your posts: not stored. They're read when you open them.
- Heatmaps: page views for 180 days, clicks for 90 days, and the raw events behind them for 7 days.
- Support email: conversations stay while your account is open, until you delete them. The raw copy Amazon SES saves of each incoming email is deleted after 7 days.
- The early-access list: until you're invited or ask to be taken off it.
- Backups: deleted data is gone from them within 60 days.
9.Deleting your data
You can delete your data in any of these ways:
- Delete items in Scrollbase. Footage, ads, products, reviews and other items you delete are removed along with their files.
- Disconnect an account. Remove Scrollbase's access in the platform itself (in Shopify, the app you set up for Scrollbase; in Meta's Business Settings, Scrollbase's app or system user; in Google Ads, Scrollbase's service account under Access and security), or disconnect it in Scrollbase's settings. Scrollbase then stops reading it.
- Ask us to delete everything. Write to support@scrollbase.io from your account's email address and say what you'd like deleted: one brand, or your whole account. We'll confirm, then delete it, including the data from your connected accounts, within 30 days.
If you're a customer or store visitor of a brand that uses Scrollbase, please contact that brand first, since it decides what happens to your data. You can also write to us at support@scrollbase.io with the store's name, and we'll pass your request on and help the brand handle it. The same goes for a review you left on a store.
To leave the early-access list, write to support@scrollbase.io.
10.Your rights and choices
Depending on where you live, you may have the right to see the personal data we hold about you and get a copy of it, to correct it, to delete it, to object to or restrict how we use it, to take it to another service, to withdraw consent you gave, and to complain to a data protection authority. California residents also have the right to know what we collect and why, and to opt out of the sale or sharing of their personal information (we don't sell or share it). Using these rights never changes how we treat you.
To use them, write to support@scrollbase.io. We may need to confirm it's you, and we'll answer within the time the law allows. If your data reached us through a brand that uses Scrollbase, the brand decides how to handle your request, and we help it.
11.Where data is processed
Scrollbase's servers are in Toronto, Canada. Our AI and other service providers process data in the United States and other countries. When data leaves your country, we rely on the safeguards the law requires, such as standard contractual clauses where they apply.
13.Children
Scrollbase is a tool for businesses and isn't meant for children. We don't knowingly collect personal data from anyone under 16. If you think we have, write to us and we'll delete it.
14.Changes to this policy
When we change this policy, we'll update the date at the top. For important changes, we'll tell you by email or in the app before they take effect.
15.Contact us
Questions or requests about privacy? Write to us:
- INNOBRANDS LLC
- support@scrollbase.io