Legal
Privacy Policy
Effective 1 May 2026
1. Who We Are
FlipTheScript ("we", "us", "our") operates the FlipTheScript web application at flip-the-script.app. We are the data controller for personal data processed in connection with your account and use of the Service. Questions about this policy: hello@flipthescript.app.
2. What Data We Collect
Account data: your name and email address, provided when you register. Payment data: billing name, address, and payment method, collected and processed by our payment provider Paddle. We do not store full card details. Usage data: information about how you use the Service, including pages visited, features used, and actions taken. This may include your device type, browser type, and IP address. Content data: scripts, breakdowns, notes, schedules, and any other materials you upload or create within the Service. You control this data. We store it on your behalf to provide the Service.
3. How We Use Your Data
We use your personal data to: — Provide and operate the Service, including account authentication and cloud storage of your production data. — Process payments and manage your subscription. — Send transactional emails: account confirmations, billing receipts, and password resets. — Send service notices: policy updates, planned downtime, and security alerts. — Improve the Service using aggregated, anonymised usage data. — Comply with legal obligations. We do not sell your personal data to third parties. We do not use your content data to train AI or machine learning models.
4. Legal Basis for Processing
We process your personal data under the following lawful bases under UK GDPR: Contract: processing your account and content data is necessary to deliver the Service. Legitimate interests: processing usage data to improve the Service, prevent abuse, and maintain security. We have assessed that our interests are not overridden by your rights. Legal obligation: retaining billing records and other data required by law. Consent: where we send optional marketing communications, we will obtain your prior consent. You may withdraw consent at any time.
5. Third-Party Sub-processors
To provide the Service we share data with the following sub-processors: Supabase, Inc. — database hosting and user authentication. Your account and production data is stored on Supabase-managed infrastructure, hosted in the EU or US under appropriate safeguards. Vercel, Inc. — application hosting and file storage. Script PDFs and uploaded files are stored on Vercel infrastructure. Paddle.com Market Limited — payment processing. Paddle acts as the merchant of record and processes your payment and billing data. Resend, Inc. — transactional email delivery. All sub-processors are bound by data processing agreements and may only process data on our instructions. We will notify you of any material changes to this list.
6. Data Retention
We retain your account and content data for as long as your subscription is active. On cancellation, your account enters a 30-day read-only grace period during which you can export your data. After this period, your production data may be permanently deleted. Billing records are retained for up to 7 years to meet financial and tax obligations. You may request early deletion by contacting us.
7. International Transfers
Some sub-processors operate outside the UK. Where personal data is transferred to countries without a UK adequacy decision, we ensure appropriate safeguards are in place — such as the International Data Transfer Agreement (IDTA) or Standard Contractual Clauses approved by the UK ICO. Contact us for more detail on the specific safeguards in place for any transfer.
8. Cookies
We use a small number of strictly necessary cookies to operate the Service, including a session cookie that keeps you logged in. We do not currently use tracking or advertising cookies. If this changes, we will update this policy and request your consent where required.
9. Your Rights
Under UK GDPR you have the right to: Access — request a copy of the personal data we hold about you. Rectification — ask us to correct inaccurate or incomplete data. Erasure — ask us to delete your personal data in certain circumstances. Portability — receive your data in a structured, machine-readable format. Restriction — ask us to restrict processing in certain circumstances. Objection — object to processing based on legitimate interests. To exercise any of these rights, contact us at hello@flipthescript.app. We will respond within one month at no charge. If you are not satisfied with our response, you may lodge a complaint with the UK Information Commissioner's Office at ico.org.uk.
10. Security
We apply reasonable technical and organisational measures to protect your data, including encrypted data transmission (HTTPS), access controls, and regular security reviews. No method of transmission or storage is completely secure. We will notify you and the relevant authorities of any data breach as required by law.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice at least 14 days before they take effect. The effective date at the top of this page indicates when the policy was last updated.
12. Contact
Privacy questions or data requests: hello@flipthescript.app.