Privacy Policy

Last updated 2026-08-25

This is a working draft. It describes how the service actually operates today and will be replaced by a reviewed version before the first paid account.

This policy explains what personal data HempScale collects, why, and what happens to it. It is written to match how the system actually works, not as a generic template.

Who is responsible

HempScale is the controller for the data described here. Contact: hello@hempscale.eu.

What is collected when you ask for an analysis

The address of the shop you enter, a truncated one way fingerprint of your IP address, a random session identifier stored in a cookie, and the email address you give when you ask for the results to be sent.

Raw IP addresses are never stored. The fingerprint exists to count attempts and to stop the form being used to run up costs; records of an analysis are deleted after 30 days.

Shop address, to read the site and build the profile
IP fingerprint, to enforce rate limits (legitimate interest)
Session identifier, to measure how the site is used
Email address, to send the results and to follow up once about them (consent)

What is read from your shop

Only pages that are publicly reachable and permitted by your robots.txt: the home page, about, catalogue, product pages, blog, reviews, lab reports and contact page. Nothing behind a login is read, and no credentials are ever requested.

A copy of what was read is stored for 14 days so that a review can be explained and reproduced, then deleted.

Where the data sits

Servers and database are hosted in the European Union. Media and backups are stored in EU jurisdiction object storage. Backups are encrypted and kept in a separate bucket with separate credentials.

Processors

The service uses these processors, each for the purpose named:

Hetzner, EU hosting
Cloudflare R2, media and backup storage in EU jurisdiction
Cloudflare Turnstile, bot protection on the public form
OpenRouter, language model calls for copy, review and explanation
kie.ai, image and video generation
DataForSEO, search demand data (no personal data is sent)
Firecrawl, page reading (site content only)
Resend, transactional and notification email
Paddle, payment and invoicing, acting as merchant of record
Meta Platforms, only where an Instagram account has been connected for publishing

How long things are kept

Analysis records: 30 days. Site read dumps: 14 days. Draft media: 30 days. Published and delivered content: 12 months after the subscription ends. Leads and their contact details: until you ask for removal or until they go stale, whichever comes first.

Your rights

You can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to hello@hempscale.eu and the request is handled within 30 days. Every marketing email carries an unsubscribe link, and unsubscribing is permanent.

You also have the right to complain to your national data protection authority.