Legal

Privacy Policy

Last updated: 7 September 2026

1. Introduction

Scramble Marketing (“we”, “us”, or “our”), operated by Scramble Marketing Hub, is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, store, and share your personal information when you use our website, dashboard, and marketing services.

Data Controller: Scramble Marketing Hub
Contact Email: helloscrambleteam@gmail.com

2. What Data We Collect

We collect the following categories of personal data:

2.1 Account Information

  • Name — to personalise your account and communications
  • Email address — for authentication, notifications, and reports
  • Company name — to identify your organisation within the dashboard
  • Website URL — to connect and pull marketing data for your properties

2.2 Authentication Data

  • Google OAuth tokens — encrypted access and refresh tokens used to securely connect your Google Search Console, Google Analytics, and Google Ads accounts on your behalf
  • Session tokens — to maintain your authenticated session

2.3 Analytics & Marketing Data

  • Search Console data — keyword rankings, impressions, clicks, and average positions for your connected properties
  • Google Analytics data — traffic, sessions, conversions, and audience metrics
  • Google Ads data — campaign performance, spend, and conversion data

2.4 Technical Data

  • IP address, browser type, device information
  • Pages visited and interactions with our platform
  • Cookies and local storage data (see our Cookie Policy)

3. Why We Collect Your Data (Legal Basis)

We process your personal data on the following lawful bases:

  • Contract performance — to provide the marketing dashboard and reporting services you have signed up for
  • Legitimate interests — to improve our services, prevent fraud, and ensure platform security
  • Consent — for optional analytics cookies and marketing communications (you can withdraw consent at any time)
  • Legal obligation — to comply with applicable laws and regulations

4. How We Store and Protect Your Data

Your data is stored securely using Supabase (hosted on AWS infrastructure) with the following protections:

  • Encryption at rest — all database records, including Google OAuth tokens, are encrypted using AES-256 encryption
  • Encryption in transit — all data transfers use TLS 1.2 or higher
  • Access controls — row-level security policies restrict data access to authorised users only
  • Regular backups — automated database backups to prevent data loss

5. Data Retention

We retain your data for the following periods:

  • Account data — retained for the duration of your active account plus 30 days after account deletion
  • Google OAuth tokens — retained while your Google account is connected; deleted immediately upon disconnection
  • Marketing analytics data — retained for up to 24 months to enable historical reporting and trend analysis
  • Technical logs — retained for up to 90 days for security and troubleshooting purposes

When data is no longer needed, it is securely deleted or anonymised.

6. Third-Party Services

We share your data with the following trusted third-party service providers, all of which process data in accordance with GDPR requirements:

We do not sell your personal data to any third parties.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

  • Right of access — request a copy of all personal data we hold about you
  • Right to rectification — request correction of inaccurate or incomplete data
  • Right to erasure (“right to be forgotten”) — request deletion of your personal data
  • Right to restrict processing — request that we limit how we use your data
  • Right to data portability — receive your data in a structured, commonly used, machine-readable format
  • Right to object — object to processing based on legitimate interests or for direct marketing
  • Right to withdraw consent — withdraw any consent you have given at any time

8. How to Exercise Your Rights

To exercise any of your rights, please contact us at: helloscrambleteam@gmail.com

We will respond to your request within one calendar month. In certain circumstances, we may extend this period by a further two months, in which case we will inform you and explain the reason for the delay.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection.

9. Cookies

We use cookies and similar technologies on our website. For full details on what cookies we use, why, and how to manage them, please see our Cookie Policy.

10. International Data Transfers

Some of our third-party service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the ICO, or the service provider is established in a country with an adequacy decision.

11. Children’s Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this page periodically.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Scramble Marketing Hub
Email: helloscrambleteam@gmail.com