Privacy Policy

Noclip OÜ (registry code 17342561), registered at Lehe tn 38, Kristiine linnaosa, 13426 Tallinn, Harju maakond, Estonia, operates the service scrub.ee. Noclip OÜ is the data controller under the EU General Data Protection Regulation (GDPR).

This policy describes the personal data we process when (a) you create an account on scrub.ee, (b) you connect a Telegram group, (c) members of your connected groups interact with the bot, and (d) you subscribe to a paid plan.

Email address, hashed password (or OAuth provider identifier), workspace name, IP address and user agent for security logging, and timestamps of account events.

When you connect a Telegram group, the scrub.ee bot accesses metadata visible to any group administrator: Telegram user IDs, usernames, display names, join/leave timestamps, message timestamps (not message content beyond what is required for fraud signal computation), and group membership lists. We compute fraud signals from this metadata and store the computed scores and signal flags. We do not store private message content. We do not access private chats between users.

When you subscribe to a paid plan, our payment processor Stripe collects payment method details directly. Noclip OÜ receives from Stripe only the information required to identify your subscription: customer ID, subscription ID, plan tier, billing interval, billing email, and country for tax purposes. We do not see or store full payment card numbers.

Account data and connected-group data: performance of the contract between you and Noclip OÜ (GDPR Art. 6(1)(b)). Billing data: contractual necessity and legal obligation (Art. 6(1)(b) and (c)). Security logs and fraud signal computation: legitimate interest in operating a fraud detection service (Art. 6(1)(f)).

We use the following sub-processors to operate the service:

• Stripe, Inc. (United States) — payment processing
• Supabase, Inc. (United States) via Lovable Cloud — database hosting, authentication
• Lovable AB (Sweden) — application hosting and platform
• Telegram Messenger Inc. (United Arab Emirates) — Telegram Bot API access (this is the platform your groups are on)

International transfers to US-based sub-processors are governed by Standard Contractual Clauses where applicable.

Active workspaces: data is retained for the duration of your subscription. Frozen workspaces (subscription lapsed, no activity for 14+ days): data is retained for 30 days, then permanently deleted. Stripe billing records: retained for 7 years per Estonian accounting law. Security logs: 90 days. You can request earlier deletion — see "Your rights" below.

You have the right to (i) access your personal data, (ii) request correction of inaccurate data, (iii) request deletion ("right to be forgotten"), (iv) request data portability, (v) object to processing, and (vi) lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). Telegram users in your connected groups can request access or deletion of their data by contacting privacy@scrub.ee with their Telegram username and the relevant group.

scrub.ee uses essential cookies for authentication and session management only. We do not use third-party advertising or analytics cookies on the application. The marketing site may use privacy-respecting analytics (no third-party cookies, no cross-site tracking).

Data is encrypted in transit (TLS 1.2+) and at rest. Access to production systems is restricted to authorized personnel. We do not publish detailed security architecture but will respond to good-faith security disclosures sent to privacy@scrub.ee.

Material changes will be announced via in-app notice or email to workspace owners at least 14 days before taking effect.

privacy@scrub.ee for all data and privacy inquiries.