GDPR Compliance

For personal data of our users, Scrab Tools acts as the data controller. Where we process files on your behalf through our tools, we act as a processor for that content and engage subprocessors (listed in our Privacy Policy) under appropriate agreements.

We rely on: consent (e.g. optional analytics/marketing cookies, which you can withdraw at any time); performance of a contract (providing the tools and account features you request); legitimate interests (securing the service, preventing abuse and fraud, and improving the product, balanced against your rights); and legal obligation (where we must retain or disclose data by law).

You have the right to be informed, and rights of access, rectification, erasure ('right to be forgotten'), restriction of processing, data portability, and objection, as well as rights regarding automated decision-making.

We do not carry out automated decision-making that produces legal or similarly significant effects about you.

To exercise any right, contact us via the Contact page. We verify requests and respond within one month, extendable by two further months for complex requests, as permitted by the GDPR.

We collect only the data needed to deliver the service. Uploaded files for server-side tools are deleted automatically (guests within 1 hour, registered users within 24 hours). Account data is kept only while your account is active; logs are retained for a limited period for security and then deleted or anonymized.

Where personal data is transferred outside the EEA/UK to our subprocessors, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses, together with supplementary measures where needed.

We implement appropriate technical and organizational measures (encryption in transit, hashed credentials, access controls, audit logging, security headers, rate limiting). In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected individuals as required by the GDPR.

We use vetted subprocessors (hosting, database, storage, email, AI, and bot-protection providers) under data processing agreements. Business customers who require a Data Processing Agreement can request one via the Contact page.

If you believe we have not handled your personal data lawfully, please contact us first so we can address it. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the ICO).