Privacy

Last updated: 5 November 2026

Who is responsible

Scava, Vienna, Austria. Email: info@scava.ai. See the imprint.

In short

• No analytics, no advertising trackers, only the cookies needed to sign in.
• What people store in an app belongs to the person who built it. We keep it for them and do not look at it.
• Data is kept in the European Union, unless the builder of an app chose the US for it.
• You can delete your account yourself at any time, in your account.

This website and the waitlist

This website explains Scava and runs a waitlist for its launch. You can read it without signing up.

When you join the waitlist we store your email address, the tool you build with, and, if you enter them, your company and a short note. If you came through a link with a source (for example ?ref=instagram), we store that source to see which links work. We also store when you signed up and when you confirmed.

Once you confirmed, you get a link of your own to share and a page that shows your place on the list. If someone joins through your link and confirms, we note that they came through it, as the source of their sign-up. Nobody sees whom you invited, and the people you invite do not learn your address from us.

We send you one email to confirm your address. If our email service is not set up yet when you sign up, your sign-up waits and the email follows as soon as it is. Only confirmed addresses stay on the list. We then write to you once, when Scava opens. Every email has a link to leave the list; leaving deletes your entry. Addresses that are not confirmed within 30 days of that email are deleted.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the link in our emails or by writing to us.

Your Scava account

To sign you in we store your email address and, if you sign in with Google, the name Google gives us. For every sign-in we store when it started and what kind of browser and device it was (for example "Chrome on Windows"), so you can see and end your sign-ins. If you connect a computer for an agent, we store when it was connected and last used. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

Apps you build

If you build apps, we store them, their versions and settings, who you share them with, your house rules and groups, and how much your apps use. What people store in your apps is your data: for it you are the controller, and we process it on your behalf under the Data Processing Agreement.

Apps shared with you

If someone shares an app with you, we know your email address from them. When you open the app, we sign you in and note when you opened it, so the person who built it can see who uses it. What you enter in the app is kept for the person who built it, who decides about it; ask them if you want something in their app changed or deleted. Change requests you send go to them, with your address.

Payments

Builders pay through Stripe. Stripe receives the payment details; we never see card numbers. We store which plan you have and its status. To give the free week only once per card, we store the card's fingerprint that Stripe provides (not the card number). Legal basis: the contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).

Keeping Scava safe

To deliver Scava and keep it safe, our hosting provider processes your IP address and technical details of your browser. To stop misuse, we count requests per IP address; we store only a scrambled form (a hash) of the address and delete these counts regularly, usually after about a day. We keep a log of important actions (for example publishing, sharing, connecting an agent) for one year. When an app reports an error, we keep the kind of error and where it happened, never who saw it. For every email we send we keep a short record (address, subject without any sign-in codes, time, and whether it went out) for 90 days. Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

Cookies

Only what signing in needs: one cookie on scava.ai, one for each app address you open, and a short one while you sign in with Google. No analytics, no advertising.

Where your data is kept

Our database and files are stored in the European Union. Once Scava opens, the entries and files of an app are stored in North America instead if the builder of that app chooses so; accounts and sign-ins always stay in the European Union. Cloudflare may process data in other countries; transfers to the USA are covered by the EU-US Data Privacy Framework and standard contractual clauses.

How long we keep it

• Your account and your apps: until you delete them. Deleting your account deletes your apps with everything in them; our own records keep what happened without your address. Backups expire within 30 days.
• Sign-ins end 7 days after you last used Scava.
• If an account was blocked for misuse and is deleted, we keep only a scrambled form (a hash) of its address, so it cannot simply sign up again.
• Waitlist, emails and logs: as described above.

Service providers

• Cloudflare, Inc. (USA) hosts Scava: website, database, files, and the AI gateway for apps that use AI.
• Lettermint (Netherlands) sends our emails.
• Stripe handles payments of builders.
• Google, only if you choose "Continue with Google": Google tells us your email address and name.

Cloudflare and Lettermint process data only on our behalf and under a data processing agreement. We do not sell or share your data with anyone else.

Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, and to receive it in a common format. You can delete your account yourself under "Your account"; builders can download everything an app holds on its page. For anything else write to info@scava.ai. You can also complain to the Austrian data protection authority (Datenschutzbehörde, dsb.gv.at).

Terms · Data Processing Agreement · Imprint · Back to the start page