Privacy Policy

Version 1.1 — Effective 4 August 2026

This Privacy Policy explains how KB Lynx Pte Ltd ("Scroll World", "we") collects, uses, and shares personal data when you use scrollworld.ai and related services (the "Service"). It applies to account holders ("creators"), anonymous trial users, and people who view shared Scroll World pages ("viewers").

1. Data We Collect

Account data. Email address, display name, and profile image (from Google or Apple if you use SSO), sign-in timestamps, and consent records (which policy versions you accepted, when, and a hashed IP). We never collect or store passwords, because the Service is passwordless.

Content data. Stories, prompts, and brainstorming messages you submit; configuration choices (audience, theme, design style, language); and the generated storyboards, scripts, video, audio, and pages.

Billing data. Subscription plan, status, and billing cycle dates. Payment card details are collected and processed directly by Stripe; we never see or store full card numbers. We receive from Stripe limited information such as payment status, last four digits, and invoice records.

Usage and analytics data. For creators: feature usage and generation history. For viewers of shared pages: a pseudonymous visitor identifier (a salted hash derived from device/browser signals and stored in a cookie), view events deduplicated per day, scroll depth and time-per-section measurements, approximate country, device type, and any star rating submitted. We do not store raw IP addresses in analytics records; IPs are hashed with a salt for deduplication, abuse prevention, and enforcing the one-anonymous-trial limit.

Communications. Emails you send us and delivery/open metadata for transactional emails sent via our email provider.

2. How We Use Data

We use personal data to: provide and operate the Service, including generating Scroll Worlds from your content; authenticate you via magic links and SSO; send transactional emails (login links, welcome, generation status, billing notices, quota alerts); process subscriptions and payments; measure views and provide creators with analytics about their pages; enforce plan quotas and the anonymous trial limit; moderate content for safety and legal compliance; prevent fraud and abuse; improve and debug the Service; and comply with legal obligations. Where required, our legal bases are performance of contract, legitimate interests (service security, analytics, abuse prevention), consent (where applicable), and legal obligation.

We do not sell personal data. We do not use your private stories or generated content to train our own machine-learning models. We do not serve third-party advertising.

3. AI Processing and Sub-processors

To operate the Service and generate your Scroll World, we share the minimum necessary data with the third parties below, each acting as our processor or sub-processor under data-processing terms. We do not permit any of them to use your content to train their own models where an opt-out is offered, and we do not sell data to any of them.

Which video model renders your Scroll World depends on your plan and your choice at creation time; the pricing page shows the models available on each plan, and the provider for the model you pick is the one that receives your scene prompts. Only text prompts are sent to video providers — never your account details.

Sub-processors may change as the Service evolves. We will update this list and, for material changes, notify account holders. Questions about our sub-processors: hello@scrollworld.ai.

4. Sharing of Data

We share data: with the sub-processors above; with viewers, when you share a Scroll World (the page content, title, and rating averages are public to anyone with the link while the page is active); with authorities where required by law or to protect rights and safety; and with a successor entity in a merger or acquisition, subject to this Policy. Aggregated, de-identified statistics (for example, total platform views) may be used publicly.

5. Cookies and Similar Technologies

We use strictly necessary cookies for authentication and security, and a first-party analytics cookie on shared Scroll World pages containing the pseudonymous visitor identifier used for view deduplication, scroll analytics, and one-rating-per-visitor enforcement. Shared pages display a notice describing this. We do not use cross-site tracking or advertising cookies. You can clear or block cookies in your browser; some features (login, ratings) will not work without necessary cookies.

6. Retention

Account and content data are retained while your account is active. If you delete your account, we delete or de-identify your personal data within 30 days, except records we must keep for legal, billing, tax, or dispute purposes (retained up to 7 years) and minimal abuse-prevention hashes. Unclaimed anonymous trial content is deleted after 30 days. Viewer analytics are stored in pseudonymous form and aggregated over time. Backups roll off on a fixed schedule of up to 35 days.

7. Security

We protect data using encryption in transit, encrypted storage for media and databases, signed time-limited URLs for media, role-based access controls, audit logging of administrative actions, and passwordless authentication with single-use, expiring login links. No system is perfectly secure; notify us of suspected vulnerabilities or breaches at hello@kb-lynx.com. We will notify affected users and regulators of personal-data breaches where required by law.

8. Your Rights

Depending on your jurisdiction (including under GDPR, UK GDPR, PDPA, or CCPA/CPRA), you may have rights to access, correct, delete, port, or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. You can exercise most rights directly: update your profile in settings, deactivate or delete individual Scroll Worlds, or delete your account entirely. For other requests, contact hello@scrollworld.ai; we respond within the legally required period and may need to verify your identity via your registered email. You may also lodge a complaint with your local data-protection authority. We do not discriminate against you for exercising privacy rights.

9. Children

The Service is not directed at children, and we do not knowingly collect personal data from anyone under 18 as an account holder. Creators may produce Scroll Worlds intended for young audiences; viewers of shared pages are measured only through the pseudonymous analytics described above, and shared pages contain no advertising, tracking for profiling, or data collection beyond those analytics and optional ratings. If you believe a child has created an account or that we hold a child's personal data, contact hello@scrollworld.ai and we will delete it promptly.

10. International Transfers

We may process and store data in countries other than yours, including through our sub-processors. Where required, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions.

11. Changes

We will post any changes to this Policy on this page with a new version number and effective date, and for material changes will notify account holders and require re-acceptance at next sign-in.

Contact / Data Controller: KB Lynx Pte Ltd — hello@scrollworld.ai