Privacy Policy

Last updated: June 18, 2026

1. Introduction & controller

This Privacy Policy explains how S9 Production Ltd, a company incorporated in Malta ("SCORUX", "we", "us"), collects, uses, and protects your personal data when you use scorux.com and the related services (the "Services").

SCORUX acts as the data controller for the personal data described below, in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable Maltese data-protection law.

2. Contact

For any question about this Policy or to exercise your rights, contact us at contact@scorux.com. You may also contact the Maltese supervisory authority, the Information and Data Protection Commissioner (IDPC), if you consider that your rights have not been respected.

3. Who can use SCORUX

SCORUX is intended exclusively for businesses, legal entities, and professionals using the Services in the context of their trade, business, craft, or profession. Account holders must be at least 18 years old and act on behalf of a duly registered business or legal entity.

We do not knowingly collect personal data from minors or from individuals acting outside the scope of their professional activity. If you believe such data has been provided to us, please contact us and we will delete it.

4. What data we collect

Account data: first name, last name, email address, password (stored in hashed form), company name, VAT identification number, country, and billing address (all mandatory at sign-up, as the Services are reserved to Business Users).
Purchase & billing data: packs and Credits purchased, order numbers, invoices, amounts, VAT status, and payment status. Payment-card details are handled by our payment processor and are not stored by SCORUX.
Usage data: analyses unlocked, requested, or submitted, Credit balances and history, and slot submissions you provide (slot name, provider, optional screenshot and link).
Contact & support data: the subject and content of messages you send via the contact form, the identity details you provide when contacting us without an Account (first name, last name, business email, company name), and any related correspondence.
Marketing preferences: whether you have opted in to receive updates from SCORUX.
Technical data: IP address, device and browser information, and consent records (including the date, version of documents accepted, and bot-protection signals).
Cookies & analytics: see Section 11 and our Cookie Policy.

5. Why we use your data & legal bases

Purpose	Legal basis (GDPR)
Creating and managing your Account; providing the Services	Performance of a contract — Art. 6(1)(b)
Processing payments and issuing invoices	Performance of a contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c)
Complying with accounting and VAT obligations	Legal obligation — Art. 6(1)(c)
Responding to contact-form and support enquiries	Legitimate interest — Art. 6(1)(f); steps prior to a contract — Art. 6(1)(b)
Securing the Website and preventing fraud and abuse (incl. bot protection)	Legitimate interest — Art. 6(1)(f)
Sending optional marketing updates	Consent — Art. 6(1)(a)
Analytics and audience measurement (where consented)	Consent — Art. 6(1)(a)
Establishing, exercising, or defending legal claims	Legitimate interest — Art. 6(1)(f)

6. Who we share your data with

We do not sell your personal data. We share it only with the following categories of recipients, acting as our processors under Article 28 of the GDPR:

Provider	Purpose	Location
Stripe Payments Europe Ltd	Payment processing & invoicing	Ireland (with transfers to the United States)
Vercel Inc.	Website hosting & content delivery	United States (with EU edge regions)
Resend	Transactional emails	EU region
Calendly LLC	Call scheduling	United States
Cloudflare, Inc.	Bot protection (Turnstile) on sign-up and the contact form, and security	United States (with EU infrastructure)
Google LLC (Google Analytics 4)	Website analytics (subject to consent)	United States
Microsoft Corporation (Microsoft Clarity)	Session analytics & heatmaps (subject to consent)	United States

We may also disclose your personal data to competent authorities where required by law or a valid legal order; to professional advisers (lawyers, accountants, auditors) bound by confidentiality; and to a successor entity in the event of a merger, acquisition, or sale of business assets.

7. International data transfers

Some of our processors are located outside the European Economic Area (EEA), in particular in the United States (e.g. Vercel, Calendly, Cloudflare, and the underlying US infrastructure of Google Analytics and Microsoft Clarity). When we transfer personal data outside the EEA, we rely on:

Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) as a safeguard under Article 46 of the GDPR;
the EU–US Data Privacy Framework where the recipient is certified under it (in particular Google LLC and Microsoft Corporation);
supplementary technical and contractual measures where appropriate.

You may request a copy of these safeguards by contacting us at contact@scorux.com.

8. How long we keep your data

Data category	Retention period
Account data	For the duration of your Account, then deleted within 30 days of closure, unless a legal obligation requires longer retention
Purchase & billing data (invoices)	10 years from the transaction (Maltese VAT and accounting obligations)
Transaction & Credit-usage history	Duration of the Account + 3 years after closure
Contact-form & support exchanges	3 years after the last contact
Consent records (Terms, Privacy, marketing)	Duration of the Account + 3 years, to evidence consent
Server & security logs	Up to 12 months
Google Analytics data	14 months (maximum retention set in GA4)
Microsoft Clarity recordings & heatmaps	Up to 3 months (Clarity default retention)
Cookies	See Cookie Policy for individual durations

After these periods, data is either deleted or anonymised.

9. Your rights

Under the GDPR, you have the following rights:

Right of access (Art. 15) — obtain confirmation and a copy of your data.
Right to rectification (Art. 16) — correct inaccurate or incomplete data.
Right to erasure (Art. 17) — "right to be forgotten", subject to legal retention obligations.
Right to restriction of processing (Art. 18).
Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
Right to object (Art. 21) — in particular to processing based on legitimate interest.
Right to withdraw consent at any time, where processing is based on consent (without affecting the lawfulness of prior processing).
Right to lodge a complaint with a supervisory authority (in Malta, the IDPC).

To exercise any of these rights, contact us at contact@scorux.com. We respond within one month, as provided by the GDPR.

10. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls, and bot-protection on sensitive forms. No system is completely secure; we cannot guarantee absolute security, but we work to protect your data and to notify you and the competent authority of any qualifying breach as required by law.

11. Cookies

We use cookies and similar technologies. Analytics and non-essential cookies are set only with your consent, managed through our consent banner. For a full description, see our Cookie Policy.

12. Changes to this Policy

We may update this Privacy Policy to reflect changes in our Services or applicable law. We will notify you of any material change by email or via a notice on the Website at least 15 days before it takes effect. The "Last updated" date reflects the most recent revision.

13. Applicable law

This Privacy Policy is governed by the laws of Malta and the GDPR.