--- title: "Privacy notice | Scorepilot" description: "How we handle your information when you visit the Scorepilot website, join the waiting list or send us a message." canonical_url: "https://scorepilot.eu/privacy" meta: "og:description": "How we handle your information when you visit the Scorepilot website, join the waiting list or send us a message." "og:title": "Privacy notice | Scorepilot" --- > Index of every page on this site: [llms.txt](https://scorepilot.eu/llms.txt) # Privacy notice How we handle your information when you visit the Scorepilot website, join the waiting list or send us a message. Last reviewed: 18 October 2026 ## Who is responsible SIA "AstroDev", a company registered in Latvia, is responsible for the personal data described here (the “data controller”). Our company number appears in the [legal notice](https://scorepilot.eu/legal#operator) for this website. For privacy questions, access requests or removal from the waiting list, use [legal@scorepilot.eu](mailto:legal@scorepilot.eu). This notice covers the public website at scorepilot.eu. Joining the waiting list does not create an assessment account. This website does not collect student submissions, assessment results or payment details. ## What we collect and why ### Waiting list We collect the email address you submit and store it in our waiting list with Resend. We also record the time you join and the version of the signup notice to document your consent. Resend maintains the contact’s creation time, waiting-list membership and email subscription status. We use your address to email you when Scorepilot opens for educators. Joining does not sign you up for an ongoing newsletter. The legal basis is your consent (GDPR Article 6(1)(a)), given when you choose to join after reading the form notice. Providing an email address is optional, but we need it to send the opening notification. You can withdraw consent at any time using [legal@scorepilot.eu](mailto:legal@scorepilot.eu). Withdrawal does not affect the lawfulness of earlier processing. ### Contact enquiries We collect your name, email address and message, and any information you choose to include in our correspondence. These details are required to send the form and let us respond. Please leave out student information and sensitive personal details. We process enquiries on the basis of our legitimate interest in answering questions and communicating with people interested in Scorepilot (Article 6(1)(f)). Where you ask us to take steps towards a contract with you, Article 6(1)(b) applies instead. Sending a message does not add you to the waiting list. ### Website delivery and security Our server receives technical information needed to deliver the website, such as your IP address, requested URL and browser request headers. Form protection uses your IP address and an attempt counter to limit repeated requests. A hidden anti-spam field and a security token are checked when you submit a form. The website does not keep routine HTTP access logs or store waiting-list records and contact messages in a local database on its hosting server. Cloudflare Turnstile checks browser and device signals, including IP address, browser information and connection characteristics, to distinguish visitors from automated abuse. It loads when you first submit a form. Our legitimate interest in operating a secure and available website is the legal basis for this processing (Article 6(1)(f)). For your theme preference and browser storage, see our [cookies and storage notice](https://scorepilot.eu/cookies). The website has no advertising or audience-analytics integration in its current implementation. ## Who receives the information - **Resend (Plus Five Five, Inc.):** stores waiting-list contacts and delivers contact-form emails to our inbox. Contact delivery includes your name, email and message. See [Resend’s privacy policy](https://resend.com/legal/privacy-policy). - **Cloudflare, Inc.:** provides Turnstile security checks. We do not include your form answers in our Turnstile verification request. Cloudflare also processes security signals for its own improvement of bot detection, as explained in its [Turnstile privacy notice](https://www.cloudflare.com/turnstile-privacy-policy/). - **Hetzner Online GmbH:** hosts our website on a server in Helsinki, Finland. It provides the infrastructure that handles website requests. See [Hetzner’s privacy information](https://www.hetzner.com/legal/privacy-policy/). - **Zoho Mail:** hosts our receiving and correspondence mailbox in its EU region. This includes your email address, message contents and email delivery information. See [Zoho’s privacy policy](https://www.zoho.com/privacy.html). Cloudflare also provides our domain’s DNS service and associated DNS statistics. Website traffic is not routed through Cloudflare’s proxy, and this website does not load a Cloudflare Web Analytics beacon. Authorised people handling Scorepilot enquiries can access the information needed for that work. We may also disclose information where required by law. We do not sell your information. Our email provider applies automated abuse prevention. Resend states that a small sample of emails may be processed on its dedicated RunPod infrastructure for trust and safety. Its [data protection information](https://resend.com/security/gdpr) explains this processing and its subprocessors. ## Processing outside the EEA Our website server is in Finland. Resend stores data in the United States, including when email is sent from its EU region. Its [data processing addendum](https://resend.com/legal/dpa) includes the European Commission’s standard contractual clauses for transfers from the EEA. Cloudflare’s [data processing addendum](https://www.cloudflare.com/cloudflare-customer-dpa/) is incorporated into its self-service agreement and provides standard contractual clauses for restricted transfers. Our Zoho Mail organisation uses EU hosting. Zoho’s [privacy policy](https://www.zoho.com/privacy.html) describes access by group companies and subprocessors, including processing outside the EEA, and contractual safeguards for those transfers. EU hosting does not mean all processing is confined to the EU. You can request information about the safeguards applying to your data, including a copy of the relevant clauses, using [legal@scorepilot.eu](mailto:legal@scorepilot.eu). ## How long we keep information Waiting-list records are kept until you withdraw consent, or for up to six months after public launch, whichever happens first. If the project closes without launching, the waiting list is deleted. Contact enquiries are kept for up to 12 months after the last reply, unless an ongoing request or legal obligation requires longer retention. A minimal unsubscribe record may be retained to respect your choice and prevent further mail. Any information retained for a legal obligation or dispute is limited to what is necessary for that purpose. The website’s form rate-limit counters are held in server memory. They expire after ten minutes and are removed on a subsequent form request or when the server restarts. They are not a permanent visitor history. We do not maintain separate backups of waiting-list records or correspondence. Providers may retain recovery copies under their own retention and deletion procedures. We review the waiting list and contact correspondence monthly and apply deletion manually. We handle withdrawal requests when they are received. Any personal information in diagnostic records is kept only while needed to investigate or resolve an issue, or meet a legal obligation, and is included in our monthly review. ## Your choices and rights You can ask to access or correct your information, request deletion or restriction, object to processing based on legitimate interests, and request a portable copy where the GDPR provides that right. You can withdraw waiting-list consent without giving a reason. Use [legal@scorepilot.eu](mailto:legal@scorepilot.eu) and tell us which email address or enquiry your request concerns. We may need proportionate information to verify that the request is yours. We normally respond within one month; if a lawful extension is needed, we will explain it within that month. You can complain to a data protection authority, including the authority where you live or work. In Latvia, this is the [Data State Inspectorate (Datu valsts inspekcija)](https://www.dvi.gov.lv/en). We do not use the waiting list or contact form to make solely automated decisions with legal or similarly significant effects on you. ## Changes to this notice We will update this notice when the website’s data use changes and show the revised date above. If we want to use your information for a new purpose that needs consent, we will ask before doing so. ```json {"@context":"https://schema.org","@graph":[{"@id":"https://scorepilot.eu/#website","@type":"WebSite","description":"Create, deliver, grade, and improve assessments in one workspace for educators.","name":"Scorepilot","url":"https://scorepilot.eu/","publisher":{"@id":"https://scorepilot.eu/#identity"}},{"@id":"https://scorepilot.eu/privacy#webpage","@type":"WebPage","description":"How we handle your information when you visit the Scorepilot website, join the waiting list or send us a message.","name":"Privacy notice","url":"https://scorepilot.eu/privacy","isPartOf":{"@id":"https://scorepilot.eu/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://scorepilot.eu/privacy"]}],"primaryImageOfPage":{"@id":"https://scorepilot.eu/#logo"}},{"@id":"https://scorepilot.eu/#identity","@type":"Organization","name":"Scorepilot","url":"https://scorepilot.eu","logo":{"@id":"https://scorepilot.eu/#logo"}},{"@id":"https://scorepilot.eu/#logo","@type":"ImageObject","caption":"Scorepilot","contentUrl":"https://scorepilot.eu/favicon.svg","inLanguage":"en","url":"https://scorepilot.eu/favicon.svg"}]} ``` ## Sitemap See the full [sitemap](https://scorepilot.eu/sitemap.md) for all pages.