Last updated: 10 November 2026
This policy explains what personal data Scrumdemy collects on the website scrumdemy.com and in the Scrumdemy apps for iPhone and Android, why we use it, who we share it with and what rights you have. We have tried to keep it short and plain.
Who we are
Scrumdemy (“we”, “us”) is responsible for your personal data. Scrumdemy is based in Spain. For anything about this policy or your data, write to info@scrumdemy.com.
What we collect
- Your account. Your email address and, if you give it, your name. If you sign in with Google or Apple, we receive your name, email address and profile picture from them. If you sign up with an email and password, the password is stored by Firebase Authentication in a protected form; we never see it.
- Your learning activity. The exams you start, your answers, your scores, whether you passed and when, and the courses and lessons you open. We need this to show your results, your progress and your library on the website and in the app.
- Your purchases. What you bought, the price and currency, the date, where you paid (website, App Store or Google Play) and the payment or receipt reference. We never receive or store your full card number. See Payments.
- Messages you send us. If you email us, we keep your message and your address so we can answer.
- Technical data. Like every website, our servers record your IP address, browser, the page requested and the time, to run the service, keep it secure and fix errors.
- Usage data, only with your consent on the website. Which pages and exams you view and which buttons you click, through Google Analytics and PostHog. See Cookies and analytics.
We do not collect sensitive data, we do not sell your data and we do not use it for advertising.
Why we use it and on what legal basis
- To provide the service you asked for (performance of a contract): your account, exams, results, courses, purchases and keeping them in sync between the website and the app.
- To handle payments, refunds and our accounting (contract and legal obligation).
- To keep the service secure and prevent fraud and abuse (legitimate interest).
- To know when someone new signs up. When you create an account, our team receives a private notification with your name, email address, sign-in method and language (legitimate interest in running a small business).
- To answer your messages (legitimate interest, or contract if it is about a purchase).
- To understand how the website is used and improve it (your consent, which you can withdraw at any time).
Payments
When you buy on the website, the payment is handled by Stripe. You enter your card or other payment details on Stripe's secure checkout page, not on Scrumdemy. To process the payment and prevent fraud, Stripe receives your payment details, the email address of your account, your name, your country and technical data such as your IP address and device. Stripe may show the price in your local currency. You can read how Stripe uses your data in the Stripe Privacy Policy.
When you buy in the iPhone or Android app, the payment is handled by Apple (App Store) or Google (Google Play) under their own privacy policies. We only receive a receipt, which our server checks with Apple or Google before unlocking the content.
Whatever you buy, on whichever platform, is linked to your Scrumdemy account, so you can use it on the website and in the app. If a payment is refunded in full, access to that product is removed.
Cookies and analytics
The website uses a few cookies and similar storage that it needs to work, and analytics only if you accept them:
- __session (necessary): keeps you signed in. Lasts 14 days, or until you sign out.
- lang (necessary): remembers the language you chose.
- scrumdemy-consent (necessary, stored in your browser): remembers your cookie choice.
- Google Analytics (only if you accept): we use Google Analytics 4 through Google Tag Manager to see which pages are visited and how people find us. With your consent it sets the cookies _ga and _ga_<ID>, which last up to 2 years. We use Google Consent Mode: until you accept, no analytics cookies are stored and Google only receives basic cookieless signals that it uses to estimate visits in aggregate. Advertising storage is always off. See the Google Privacy Policy and how Google uses information from sites that use its services.
- PostHog (only if you accept): product analytics hosted in the European Union, reached through our own domain. With your consent it stores a random identifier (ph_<project key>_posthog) for up to 1 year. If you are signed in, events are linked to your internal user ID, not to your name or email. We do not record your screen. See the PostHog Privacy Policy.
You can change your choice at any time with the Cookies link at the bottom of every page, or delete cookies in your browser. The apps do not use analytics or advertising trackers.
Who we share data with
We only share data with the service providers we need to run Scrumdemy, who process it on our behalf or under their own policies as described above:
- Google (Firebase and Google Cloud): sign-in, database, file storage and website hosting.
- Stripe: website payments.
- Apple and Google: in-app purchases and, if you use them, sign in with Apple or Google.
- Google Analytics and PostHog: website analytics, only with your consent.
- Telegram: delivers the private new sign-up notification to our team.
- Our email provider: to answer your messages.
We may also disclose data when the law requires it.
International transfers
Some of these providers store or process data outside the European Economic Area, mainly in the United States. Our database is hosted by Google Cloud in the United States. When data leaves the EEA, it is protected by the EU–US Data Privacy Framework, where the provider is certified, or by the European Commission's Standard Contractual Clauses.
How long we keep it
- Your account, results and library: while you have an account. When you delete your account, we delete your profile, exam attempts, enrollments and purchase records from our database, and your sign-in account.
- Payment records: Stripe, Apple and Google keep their own transaction records, and we keep invoices and accounting records for as long as Spanish tax and accounting law requires.
- Messages: as long as needed to deal with your request.
- Analytics: as described in Cookies and analytics.
Your rights
You can ask to access, correct or delete your data, to restrict or object to how we use it, and to receive a copy in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting what was done before.
You can delete your account yourself, with everything linked to it, from your profile on the website or in the app. For anything else, write to info@scrumdemy.com; we will answer within one month. If you think we have not handled your data properly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the authority in your country.
If you live in California, you have similar rights under the CCPA, including to know what we collect and to have it deleted. We do not sell or share personal information for cross-context behavioral advertising.
Security
Data travels over encrypted connections (HTTPS). Access to the database is limited by security rules: you can only read your own records, and only our server can create purchases and enrollments. Payment details are handled by Stripe, Apple and Google, never by us.
Children
Scrumdemy is meant for adults preparing for professional certifications. We do not knowingly collect data from children under 16. If you think a child has given us personal data, contact us and we will delete it.
Changes to this policy
If we change this policy, we will publish the new version on this page and update the date at the top. If the changes are important, we will also tell you on the website or by email.