Effective date: 16 September 2026
Scrollstop is a brand operated by Jan Armbruster, entrepreneur individuel (EI), located at 90 rue Cambronne, 75015 Paris, France.
For questions about this policy or to exercise your privacy rights, email jan@scrollstop.io. Further business details appear in our Legal Notice.
This policy explains how we handle personal information when you visit scrollstop.io, contact us, request a sample, use our client portal, or buy one of our two products: ListingKit, our real-estate listing video service, and Rapidcreative, our template system for video professionals. It also explains our role when a client supplies information for a video.
| Purpose | Information involved | Legal basis |
|---|---|---|
| Answer enquiries and prepare requested samples or quotes | Name, work email, business details, messages, listing links and materials you send us | Steps requested before a contract, if you are the prospective contracting customer; otherwise our legitimate interest in responding to professional enquiries |
| Manage orders and provide customer support | Business contact details, briefs, approvals, revision requests and delivery correspondence | Performance of our contract with you; for employees or representatives of a client, our legitimate interest in administering that client relationship |
| Produce samples and listing videos | Listing-page URLs and content, property details, photographs, branding, templates, production instructions and generated video assets | Performance of our contract or steps requested before it; where the material contains information about other people and we process it solely under a client's instructions, the client determines the lawful basis and Scrollstop acts as its processor |
| Collect payment and keep required records | Billing identity and address, tax details where applicable, invoices, amounts and payment status | Contract performance and compliance with accounting and tax obligations |
| Operate and protect the website and client portal | IP address, request time, requested page, and browser and device details sent with each request; automated security checks on client-portal visits | Our legitimate interest in providing a functioning, secure website |
| Professional outreach to real estate professionals about Scrollstop | Name, company or agency, professional role, work email and phone, website and professional social profiles, public listing activity, our notes and fit assessment, the source of the details, and our correspondence | Our legitimate interest in offering our services to real estate professionals; consent where the recipient's country requires it for marketing emails or calls |
| Provide the client portal | Invited client email addresses, sign-in links and session details, requests and briefs, uploaded photographs and branding, delivered videos and notification emails | Performance of our contract with you; for employees or representatives of a client, our legitimate interest in administering that client relationship |
| Send the free Rapidcreative sample and the marketing emails you sign up for | Email address | Your consent, given when you submit the sign-up form; you can unsubscribe at any time |
| Sell and deliver the Rapidcreative product | Name, email address, payment and billing details handled by LemonSqueezy, and access to the product's Notion workspace | Performance of our contract with you |
The legitimate interests referred to above are operating our business, communicating with professional contacts and protecting our services. We assess these interests against the rights and reasonable expectations of the people concerned.
Providing information is generally voluntary. We need sufficient contact and project information to answer you and make your video, and the billing information required to issue a valid invoice. Without those details, we may be unable to fulfil your request. Optional marketing choices do not affect your ability to purchase the service.
Most information comes directly from you, your business or someone authorised to send materials on your behalf. When you provide a property-listing URL, we retrieve the information and images needed for the requested video from that page. This can include the property address and details, listing photographs, agent or brokerage details and other information displayed on the listing. Website technical information is generated when your device requests our pages.
For professional outreach, we also obtain business contact details from real estate agency and brokerage websites, public business directories, property-listing platforms, and public engagement with posts on professional social networks such as LinkedIn and Instagram. When we contact someone using information collected this way, we identify the source or source category and provide privacy information at the time required by applicable law. Every marketing message provides a way to opt out.
We ask clients to avoid sending unnecessary personal information, such as identity documents, access codes, private seller correspondence or financial details unrelated to the video.
Listing briefs, photographs, agent contact blocks, feedback and seller updates can contain personal information. Where we process that information solely to produce a client's content under their instructions, the client is the controller and Scrollstop acts as their processor. That processing is governed by our agreement with the client and the applicable data processing terms.
Our production workflow uses the OpenAI API to retrieve and analyse information from the listing page identified by the client, analyse listing images and help assemble the requested video using Scrollstop templates. The information sent to the API can therefore include listing URLs and page content, property information, photographs, agent or brokerage contact details, branding, production instructions and generated outputs. We use those outputs only to provide and improve the requested deliverable within the agreed service.
The client is responsible for establishing the lawful basis for its use of that information and providing the relevant privacy notices. If your request concerns information controlled by one of our clients, we will refer it to that client and assist them as required. We remain responsible for our own processing, including our customer administration and legal records.
Access is limited to people and providers who need the information for the purposes described here. These can include authorised production support and providers of website hosting, business email, file storage and delivery, production tools, payments and accounting. Their access and responsibilities depend on the service they perform.
Our providers are listed below.
| Provider | Purpose and information received | Processing location and transfer arrangements |
|---|---|---|
| Vercel Inc. | Website and client-portal hosting and delivery: IP address, request details and the pages requested. Portal files — uploaded photographs and branding, and delivered videos — are stored in Vercel Blob in the European Union (Dublin). Vercel's analytics products are not used. | United States, with delivery servers worldwide |
| Supabase | Client-portal sign-in (Supabase Auth): invited clients' email addresses, one-time sign-in links and account identifiers; and the portal database (Supabase Postgres): client accounts, requests and briefs, and notification records. Uploaded photographs and delivered videos are not stored in Supabase; they are held in Vercel Blob. | Supabase Pte. Ltd. (Singapore); data stored in the EU (Ireland) |
| Railway Corporation | Hosts our video-template production tool. When it is used for an order, it processes the listing details, photographs and branding needed to render the videos. | United States |
| Resend — Plus Five Five, Inc. | Email delivery: recipient addresses, messages and delivery information. Used for client-portal sign-in links, request and delivery notifications, and the sample requests sent from our website together with their confirmation replies, all sent as plain text. | Its DPA describes primary processing in the United States; the scrollstop.io sending domain uses Resend's Ireland region |
| Google Workspace | Business email (Gmail), including correspondent names and addresses, message content, attachments and delivery metadata; and Google Sheets for our prospect research records. Google Analytics and Google sign-in are not used. | Google Cloud France is Google's contracting entity for Workspace customers in France. Workspace customer data is covered by Google's Cloud Data Processing Addendum; Google and its subprocessors can process information in several countries using the transfer mechanisms described in that addendum. |
| OpenAI | OpenAI tools are used for software development. The OpenAI API is also used to retrieve and analyse information from client-identified listing pages, analyse listing images and help assemble videos from Scrollstop templates. It can receive listing URLs and page content, property information, images, agent or brokerage details, branding, prompts, templates, production instructions and generated outputs. Information we paste into prompts or working templates, such as client briefs and business correspondence, may also be included. | OpenAI's business DPA names OpenAI Ireland Ltd. for EEA business customers and provides transfer mechanisms for processing in the United States. |
| Kit (ConvertKit) | Email address, for the free Rapidcreative sample and the marketing emails you sign up for | United States |
| LemonSqueezy | Merchant of record for Rapidcreative: checkout, payment, sales tax, receipts and product delivery. It acts as an independent controller for these activities, and its checkout uses payment and fraud-prevention providers, including Stripe, PayPal, Google Pay and hCaptcha. | United States |
| Vimeo | Plays the product video on the Rapidcreative page. The player is embedded with Vimeo's do-not-track setting. | United States |
| Notion | Delivers the Rapidcreative product workspace | United States |
| Close | Our CRM for professional outreach: prospect contact details, notes, call and email history, and opt-outs | United States |
| lemlist | Email outreach to prospects: names, work email addresses, company and message history | France |
| Apify | Collects publicly available business information and public post engagement for our prospect research | Czech Republic |
| Stripe | Payments, subscriptions and invoices for ListingKit: billing name, email address, billing address, tax details, amounts and payment status. Card details are entered with Stripe and are not received by us. | Stripe Payments Europe, Limited (Ireland); some processing takes place in the United States |
We may also disclose relevant information where necessary to comply with a legal obligation or establish, exercise or defend legal claims. Where a provider acts as an independent controller for its own purposes, its privacy information explains those activities.
Our providers operate in several countries, including outside the European Economic Area. Resend's published data processing agreement describes primary processing in the United States. OpenAI's current business DPA provides transfer mechanisms for covered processing, including applicable adequacy decisions or the European Commission's Standard Contractual Clauses. Google Workspace's Cloud Data Processing Addendum also provides transfer mechanisms for covered customer data processed outside the European Economic Area. Other processing locations depend on the services and account configurations used.
Providers based in the United States include Vercel, Railway, Resend, Kit, LemonSqueezy, Vimeo, Notion and Close; OpenAI, Google, Stripe and Supabase can also process information outside the European Economic Area. These transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses in the provider's data processing terms.
You can email jan@scrollstop.io for information about the safeguards relevant to your data and how to obtain a copy, subject to necessary redactions.
| Information | Retention period or criteria |
|---|---|
| Enquiries and free-sample correspondence that do not lead to an order | 12 months after the enquiry is resolved or our last meaningful exchange, unless needed for an identified dispute |
| Customer administration and contractual records | For the business relationship, then the relevant records are kept in restricted archives for applicable legal obligations and limitation periods; ordinarily five years for commercial contractual records |
| Invoices and accounting supporting documents | Ten years from the close of the relevant financial year where required by French accounting law |
| Working files, source materials and delivered videos containing personal information | While the subscription is active and for 90 days after it ends; if an account stays paused for 12 months, we delete its files. This is subject to the client's documented instructions and the applicable data processing agreement |
| Website logs | Kept by our host, Vercel, for its standard short retention period; we do not keep separate copies. Relevant incident records are retained only as needed to investigate or handle a specific incident or claim |
| Prospect records used for professional outreach | 3 years after our last contact with the person |
| Marketing objections | The minimum information necessary to record and honour the objection, for 3 years after the objection |
| Client-portal accounts, requests, uploaded files and delivered videos | While the subscription is active and for 90 days after it ends; 12 months after a pause starts if the account stays paused |
| Rapidcreative sample and marketing email list | Until you unsubscribe |
| Rapidcreative purchase records | Kept by LemonSqueezy as merchant of record for its tax and accounting obligations |
Related business email follows the same periods. We delete or anonymise information when its retention period ends, unless a specific legal obligation or dispute requires continued retention. Backups kept by our providers are overwritten on their standard cycles. Information preserved for legal reasons is restricted to those purposes.
Scrollstop's own pages do not set cookies or use browser storage, analytics, advertising pixels or tag managers. The technologies below are strictly necessary for something you asked for, protect a service against abuse, or are set by LemonSqueezy under its own responsibility. The exception is a visitor-counting cookie that our portal's hosting platform sets, described in the last row.
| Where | Set by | Name | Purpose | Duration |
|---|---|---|---|---|
| Rapidcreative page video | Vimeo (via Cloudflare) | __cf_bm |
Protects the video player from automated traffic. The player is embedded with Vimeo's do-not-track setting, so it sets no analytics cookies. | 30 minutes |
| Rapidcreative checkout, only after you choose to buy | LemonSqueezy and its payment providers (Stripe, PayPal, Google Pay, hCaptcha, Cloudflare) | Several, including laravel_session, XSRF-TOKEN, ls_cart_id and fraud-prevention cookies |
Run the checkout and protect the payment. LemonSqueezy is responsible for these under its own privacy policy; some, such as error monitoring and checkout analytics, serve LemonSqueezy's own purposes. | From the browser session up to two years |
| Client portal, after you sign in | Scrollstop | portal_access, portal_refresh |
Keep you signed in; removed when you sign out | About one hour; 30 days |
Links to third-party websites take you to services governed by their own privacy information. This does not replace our responsibility to disclose any third-party content or tracking loaded directly on our website.
Subject to the conditions in applicable law, you can request access, correction, deletion or restriction of your information. You can object to processing based on legitimate interests and object at any time to the use of your information for direct marketing. Where processing is automated and based on consent or a contract, the right to data portability may apply.
Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. Under French law, you may also give instructions concerning your personal information after your death.
Email jan@scrollstop.io to make a request. We may request proportionate additional information if needed to confirm your identity. We normally respond within one month. If a lawful extension is necessary because of a request's complexity or number, we will explain this within that first month.
You may complain to the French data protection authority, the CNIL, or another competent supervisory authority. You do not have to contact us first.
We use automated tools to analyse listing pages and images and to help assemble videos. This production automation does not make decisions about people that produce legal or similarly significant effects.
We may update this policy as our services or legal obligations change. The effective date identifies the current version. We will provide additional notice where a material change to our processing requires it.