Effective date: 2 July 2026 · Version 1.0 · Scout & Scout Team
This notice explains what personal data we process when you use the Scout or Scout Team product, why, on what legal basis, who we share it with, and your rights under the EU General Data Protection Regulation (GDPR) and Finnish data-protection law. It is separate from, and complementary to, our website Privacy Policy, which covers personal data we collect through groundworksai.com (the waitlist, bookings, the newsletter, and site logs).
Groundworks Marketing AI Oy (Business ID / Y-tunnus 3625461-9), Finland, trading as Groundworks AI, is the controller for the personal data described in this notice. Registered address Toinen Linja 3 B 24, 00530 Helsinki, Finland. For privacy questions or to exercise your rights, contact us at privacy@groundworksai.com.
This notice covers personal data processed inside the Scout/Scout Team product for subscribers. We hold two different roles depending on the data:
| Category | Examples | Source |
|---|---|---|
| Account & billing | Name, business name, email, login credentials, plan, payment details (held by Stripe — we do not store full card numbers) | You |
| Intake data | The Day-0 intake form (company context, ICP, offer and positioning, voice, growth motion, cadence preferences) | You |
| Website-scrape data | Brand tokens (logo, colours, fonts), primary CTA, and image assets crawled from your own website, which you confirm or edit at intake | First-party crawl of your site, with your instruction |
| In-platform signals | Your review/approval history and patterns, content-fuel responses, self-reported outcomes | Your use of the service |
| Integration reads (Scout Team) | Newsletter performance, social engagement metrics, and workspace context from the accounts you connect | Connected integrations, with your authorisation |
| Audience/recipient data in your content | Personal data of people you address in generated content/outreach | You (you are controller — see the DPA) |
| Technical & usage | IP address, device/browser data, log and usage data within the product | Automatically |
We do not intentionally collect special-category personal data, and you should not submit it through the service.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide, operate, and support the service; generate and deliver your content | Performance of a contract (Art. 6(1)(b)) |
| Process payments and manage subscriptions | Contract (Art. 6(1)(b)); legal obligation for tax/accounting (Art. 6(1)(c)) |
| Improve and secure the service; prevent abuse | Legitimate interests (Art. 6(1)(f)) — our interest in keeping the service reliable, secure, and free of misuse, and in fixing and improving it, balanced against your rights |
| Connect and read the integrations you enable (Scout Team) | Contract (Art. 6(1)(b)) and your authorisation |
| Product/service communications to you (e.g. run notifications) | Legitimate interests (Art. 6(1)(f)) — our interest in keeping an active subscriber informed about the service they pay for |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal data.
(Art. 13(2)(e) GDPR.) Providing your account, billing, and intake data is a contractual requirement — we need it to deliver the subscription, and without it we cannot provide the service (e.g. we cannot bill you, set up your account, or generate content fitted to your business). Providing data through the integrations you choose to connect (Scout Team) is optional, but the related features will not work if you do not.
Automated decision-making. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing (Art. 22 GDPR). Content is generated using AI, but every item is surfaced to you for review and approval in The Review before it is used — a human (you) is always in the loop.
To generate your content, we send relevant inputs and signals to Anthropic's Claude via Anthropic's commercial API. Anthropic processes this data as our sub-processor to return generated content. Anthropic does not use commercial-API inputs or outputs to train its models by default, and deletes them within 30 days of processing (longer only where required for safety review or by law). We are in the process of arranging Zero-Data-Retention (ZDR) with Anthropic for our production models; if and once ZDR is in place, Anthropic retains no inputs or outputs at rest beyond returning your content. Until then, the 30-day default above applies. You never provide an Anthropic API key; we operate the service under a single commercial account.
We use the following third parties to provide the service. Each processes personal data only as needed to perform its function, under contract. The Data Processing Agreement (Annex III) carries the authoritative list.
| Sub-processor | Purpose | Applies to |
|---|---|---|
| Anthropic | AI content generation (Claude) | Scout & Scout Team |
| Fly.io (EU region) | Product application hosting / data storage | Scout & Scout Team |
| Stripe | Payment processing | Scout & Scout Team |
| Notion | Workspace-context read (the source you nominate) | Scout Team |
| bundle.social | Social publishing; holds your connected-account tokens | Scout Team |
| Beehiiv | Newsletter publishing | Scout Team |
Website-only providers (e.g. our website host and form/scheduling tools) are listed in the website Privacy Policy, not here. Stripe processes your account and billing data, for which we are the controller — it is a controller-side processor for that data. For Scout Team publishing, the aggregator holds the access tokens for the social accounts you connect (encrypted at rest); we store only a reference to your connected account, not the tokens themselves.
We host and process data in the EU/EEA (our application runs in an EU region — Fly.io EU, see §6). Some sub-processors process data outside the EEA, principally in the United States (e.g. Anthropic, Stripe). Where they do, the transfer is protected by an appropriate safeguard under Chapter V GDPR — the EU–US Data Privacy Framework where the provider is certified, and/or the European Commission's Standard Contractual Clauses. You can obtain a copy of the relevant safeguard, or details of the mechanism that applies to a specific sub-processor, by contacting privacy@groundworksai.com.
We keep personal data for as long as needed for the purposes above and to meet legal obligations. Specifically:
Under the GDPR you have the right to: access your data; have it corrected; have it erased; restrict or object to processing; data portability; and — where we rely on your consent — withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal. To exercise any right, contact privacy@groundworksai.com. We provide an in-product export to support access/portability. We respond without undue delay and within one month of your request (extendable by two further months for complex or numerous requests, in which case we will tell you), per Art. 12(3) GDPR.
You also have the right to lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) — tietosuoja.fi.
We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, EU-region hosting, and sub-processors who maintain recognised security standards. No system is perfectly secure; we will notify you and the supervisory authority of a personal-data breach where required by law.
The Scout/Scout Team product uses only the essential cookies/local storage needed to sign you in and run the application (e.g. session management). It does not use advertising or tracking cookies. Cookies on the public website are covered by the website Privacy Policy.
The service is for business use by adults. It is not directed at children, and we do not knowingly collect data from anyone under 18.
We may update this notice. The version and date at the top show when it last changed, and each version is tagged material or minor:
Privacy questions and rights requests: privacy@groundworksai.com. Supervisory authority: Office of the Data Protection Ombudsman, Finland (tietosuoja.fi).
Effective 2 July 2026 · Version 1.0 · Groundworks AI is the trading name of Groundworks Marketing AI Oy · groundworksai.com