Your documents sit in protected storage in the EU, reachable only through the app.
After that we delete a case's documents and photos automatically.
You can delete your documents from your case file at any time.
Who is responsible
Nafite B.V., Spoorstraat 30a, 6511 AH Nijmegen, the Netherlands (Chamber of Commerce 76060217) is the controller for the personal data processed through Scratchfair. Questions about privacy: hallo@scratchfair.com.
Which data we process
| Data | Why | Legal basis |
|---|---|---|
| Documents you upload: claim, contract, photos, replies | To read your claim, run the checks and draft your letters | Performance of the contract |
| Details read from them: name, booking number, rental dates, amounts, rental office | Same | Performance of the contract |
| Email address and name, if you give them | To send you the link to your case and reminders about deadlines | Performance of the contract |
| Payment details: amount, status, payment method (not your card number) | To process the payment and for our accounts | Contract and legal obligation |
| Outcome you report, without name | Anonymous statistics for the strength estimate and the damage index | Legitimate interest |
| Usage data with consent: pages, clicks, device type | To improve the site (Google Analytics 4) | Consent |
| Anonymous usage data without cookies | Counting visits (Vercel Web Analytics) | Legitimate interest |
Evidence mode
The free evidence mode stamps date, time and place on photos on your own device. Those photos are not uploaded to us unless you add them to a case yourself.
Who processes data for us
We use these processors, with a data processing agreement:
- Vercel (hosting of the website)
- Supabase (database and file storage, in the EU)
- Anthropic (AI that reads your documents; your data is not used to train models)
- Mollie (payments, the Netherlands)
- Twilio SendGrid (sending emails)
- Google (Google Tag Manager and Google Analytics 4, only with your consent)
- Cloudflare (Turnstile, a bot check when you start a case)
Some of these companies are based in the United States. Transfers take place under the EU-US Data Privacy Framework or the EU standard contractual clauses.
How long we keep data
- Documents and photos of a case: until 12 months after the case is closed or last used, then they are deleted automatically.
- You can delete your documents yourself at any time from your case file.
- Payment records: 7 years, because Dutch tax law requires it.
- Analytics data in Google Analytics: 14 months.
Your rights
You have the right to access, correct and delete your data, to restrict or object to processing, and to receive your data in a portable format. Where we rely on consent, you can withdraw it at any time, for cookies via the cookie settings. Email hallo@scratchfair.com; we reply within one month.
You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the supervisory authority in your own country.
Security
Files are stored in a private storage bucket and are only accessible through the app. Access to a case uses a personal link or a login link sent to your email address.