Privacy Policy

Last updated: October 21, 2026

This Privacy Policy explains how Ascent Digital LLC, doing business as Scribendo HQ ("Scribendo HQ," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you visit scribendohq.ai, use scribo.scribendohq.ai, create or administer an account, use the Scribendo HQ WordPress Connector, submit a form, purchase a subscription, request support, or otherwise use our websites, software, APIs, and related services (collectively, the "Services").

By using the Services, you acknowledge the practices described in this Privacy Policy. If you use the Services for an organization, you represent that you are authorized to provide information and instructions on its behalf.

1. Our Role

Scribendo HQ
acts as a controller or business for personal information used
to operate our websites, administer accounts, bill customers, secure the Services, and communicate with users.

When a customer uses the Services to submit prompts, website information, product information, images, or other content for processing, Scribendo HQ generally acts as a processor or service provider on that customer's behalf. The customer controls what is submitted and is responsible for providing any notices, obtaining any permissions, and establishing any lawful basis required for that information.

This Privacy Policy does not replace the privacy policy of a customer's WordPress site, online store, or other connected service.

2. Information We Collect

We may collect the following categories of information.

Account and business information

· Name, email address, company name, website domain, and account number.

· Tenant ID, plan, trial information, account status, subscription status, and service limits.

· Administrator and tenant-login information, including email addresses, password hashes, session information, password-reset data, and two-factor authentication challenge data.

· WordPress Connector configuration, including tenant identifiers, internal API credentials, connected domain, and feature settings.

We do not store account passwords in readable form. Passwords and two-factor authentication codes are stored or checked using cryptographic hashes or signed tokens, as applicable.

Billing and transaction information

· Selected plan, price, billing status, transaction status, trial dates, Stripe customer ID, and Stripe subscription ID.

· Cardholder name, payment-card number, expiration date, security code, and billing postal code when entered during signup or billing changes.

Payment-card details are transmitted to Stripe for authorization and recurring subscription processing. We do not intentionally store the full payment-card number or card security code in the Scribendo HQ application database after submission. Stripe independently processes payment information under its own privacy terms.

Customer content and generation data

· Prompts, topics, titles, briefs, keywords, audience and demographic selections, tone, language, SEO information, calls to action, and other generation instructions.

· Blog, landing-page, product, category, and WordPress page or post context needed to perform a requested task.

· Product names, SKUs, brand information, dimensions, materials, features, benefits, warranty, shipping, return, compatibility, and other product details.

· Images, image URLs, image metadata, alt text, uploaded media, and generated images. Images may depict identifiable people.

· Generated text, images, metadata, and related output.

Do not submit sensitive personal information, confidential credentials, regulated health or financial information, or images of people unless you have a lawful reason and all rights and permissions needed for that processing.

Communications and form submissions

· Information provided through contact, support, signup, password-reset, and other forms, such as name, email address, telephone number, subject, and message.

· Communications with our support or administrative teams and information needed to respond to a request.

Technical, usage, and security information

· Internet Protocol address, connected domain, request endpoint, date and time, request frequency, error information, and account or tenant associated with a request.

· Browser, device, network, referring page, and similar request information that may be collected by our hosting and security providers.

· API usage counts, content-generation counts, rate-limit windows, payment submission attempts, temporary lockouts, suspected bot activity, and security audit records.

· Essential cookie and session-token information used to keep users signed in and protect accounts.

3. How We Collect Information

We collect information:

· Directly from you when you create an account, subscribe, configure a connector, submit a form, upload content, or contact us.

· From administrators or other authorized users of the organization that provides your account.

· From a connected WordPress or WooCommerce installation when an authorized user validates the connector or requests content or image generation.

· From Stripe through subscription and webhook events.

· Automatically from browsers, devices, hosting infrastructure, API requests, cookies, and security tools.

· From service providers acting for us in operating the Services.

4. How We Use Information

We use personal information to:

· Create, authenticate, maintain, and secure administrator and tenant accounts.

· Provide the Services, including blog, landing-page, WooCommerce product, SEO, and image generation.

· Validate WordPress Connector access and enforce plan limits.

· Process subscriptions, free trials, plan changes, renewals, and cancellations.

· Send welcome messages, two-factor authentication codes, password-reset emails, service notices, and support responses.

· Deliver contact and support form submissions to the appropriate recipient.

· Detect bots, card-testing activity, credential abuse, malware, denial-of-service activity, excessive API traffic, and other security threats.

· Temporarily limit or block abnormal requests and maintain an audit trail for security
review.

· Diagnose errors, maintain service reliability, and improve functionality and prompts.

· Comply with law, enforce agreements, prevent fraud, and protect users, Scribendo HQ,
and others.

· Complete a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate safeguards.

Where applicable law requires a legal basis, we rely on one or more of the following:

· Contract: processing necessary to provide the Services you request.

· Legitimate interests: securing, supporting, maintaining, and improving the Services; preventing fraud and abuse; and operating our business, balanced against your rights.

· Legal obligations: processing needed to comply with tax, accounting, legal, regulatory, and law-enforcement requirements.

· Consent: where we ask for consent and applicable law requires it. You may withdraw consent, but withdrawal does not affect prior
lawful processing.

5. Artificial Intelligence Processing

Scribendo HQ uses artificial intelligence providers, including OpenAI, to generate or transform requested content and images. Depending on the task, we may send the provider relevant prompts, website or product context, audience selections, and
image data. We seek to send only the information needed to perform the request.

AI output may be inaccurate, incomplete, or unsuitable. Customers are responsible for reviewing generated output before publishing or relying on it and for ensuring that submitted content and generated use comply with law and third-party rights.

Scribendo HQ does not use automated decision-making that produces legal or similarly significant effects about individuals. Automated bot and abuse controls may temporarily reject or limit a request. Contact us if you believe a legitimate
request was incorrectly blocked.

6. How We Disclose Information

We may disclose information to the following categories of recipients:

· OpenAI: AI text and image generation or transformation.

· Stripe: payment authorization, subscriptions, billing events, fraud prevention, and payment support.

· Application Hosting: content delivery, operational logs, and BotID bot-detection security services.

· Email Service: transactional email delivery, including welcome, two-factor authentication, password-reset, contact, and support
messages.

· Professional advisers and contractors: legal, accounting, security, support, and other providers bound to appropriate confidentiality obligations.

· Authorities and affected parties: when reasonably necessary to comply with law or legal process; protect rights, safety, or property; investigate fraud or abuse; or enforce agreements.

· Transaction participants: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.

7. Sale, Sharing, and Advertising

We do not sell personal information for money. We do not currently share personal information for cross-context behavioral advertising or use it for targeted advertising as those terms are defined under applicable U.S. state privacy laws.

We disclose information to service providers for the business purposes described in this policy. We do not knowingly sell or share the personal information of individuals under 18.

Because we do not currently sell or share personal information for targeted advertising, a Global Privacy Control signal does not change how we process information. If our practices change, we will update this policy and provide any legally required opt-out method.

8. Cookies and Similar Technologies

We use essential cookies and signed session tokens for login, authentication, account security, and service operation. These technologies are necessary to provide logged-in functionality and cannot always be disabled without preventing use of the
applicable feature.

Our hosting and bot-detection providers may process browser, device, network, and request signals to deliver and secure the Services. We do not currently use third-party advertising cookies on the Services.

You may configure your browser to reject or delete cookies, but parts of the Services may not work correctly as a result.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including providing the Services, maintaining business and transaction records, resolving disputes, enforcing agreements,
preventing fraud, and satisfying legal obligations.

Retention depends on the type of information and context:

· Account, tenant, subscription, and service-configuration information is generally retained while the account is active and for a reasonable period afterward.

· Billing and transaction records may be retained for tax, accounting, fraud-prevention, and legal requirements.

· Customer content and generated output are retained as needed to provide the requested functionality and maintain associated account records. Content published to a customer's WordPress site is solely owned, controlled, and retained by that
customer.

· Contact and support communications are retained as needed to respond, maintain service history, and resolve disputes.

· Short-lived authentication, rate-limit, and card-submission information is retained for the applicable verification or lockout period and may remain in operational logs or backups for a limited additional period.

· API security counters and flagged audit records are retained according to their operational usefulness, capacity limits, and the need to investigate or prevent abuse.

· Service-provider logs and backups are retained according to provider settings, contractual commitments, and legal requirements.

When information is no longer needed, we delete or de-identify it where reasonably practicable.
Information may remain temporarily in backups or be retained when required by law or necessary to establish, exercise, or defend legal claims.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. Measures may include encryption in transit, encryption of selected stored secrets, password hashing, two-factor authentication, access controls, signed sessions, bot detection, rate limiting, audit logging, webhook signature verification, and restricted administrative access.

No transmission or storage system is completely secure. We cannot guarantee absolute security.
You are responsible for maintaining the confidentiality of your credentials, limiting access to your account, keeping connected WordPress installations updated/secure/free of malware, and notifying us promptly of suspected unauthorized use.

11. International Data Transfers

Scribendo HQ and its service providers may process information in the United States and other jurisdictions whose privacy laws may differ from those where you live. Where required, we use recognized transfer mechanisms or rely on appropriate provider
safeguards, such as contractual protections, Standard Contractual Clauses, or participation in an applicable data-privacy framework.

12. Your Privacy Rights

Depending on your location and subject to applicable exceptions, you may have the right to:

· Request access to or a copy of your personal information.

· Request correction of inaccurate information.

· Request deletion of personal information.

· Request restriction of or object to certain processing.

· Receive certain information in a portable format.

· Withdraw consent where processing is based on consent.

· Opt out of certain sales, sharing, targeted advertising, or profiling where applicable.

· Limit certain uses of sensitive personal information where applicable.

· Appeal our refusal of a privacy request where applicable.

· Receive equal service and not be discriminated against for exercising a privacy right.

· Lodge a complaint with an applicable data-protection authority.

To submit a request, contact us at: https://scribo.scribendohq.ai/contact-us. Describe the right you wish to exercise and the account or email address involved. We may request information reasonably necessary to verify your identity and authority.
Authorized agents may submit requests where permitted by law, but we may require proof of authorization and direct identity verification.

If Scribendo HQ processes information solely on behalf of a customer, we may direct your request to that customer or assist the customer in responding.

13. California Privacy Notice

This section applies to California residents where the California Consumer Privacy Act, as
amended ("CCPA"), applies.
During the preceding 12 months, we may have collected the categories described below:

Identifiers:
Examples:
Name, email, IP address, account number,
tenant ID, domain, Stripe IDs
Sources: You, account
administrators, connected sites, Stripe, devices
Purposes: Account administration,
service delivery, billing, security, support
Recipients: Hosting, storage, email,
payment, AI, security, and professional service providers

Customer records
Examples:
Name, contact details, company, payment and
subscription information
Sources: You, administrators, Stripe
Purposes: Signup, billing, support,
account management
Recipients: Stripe and operational
service providers

Commercial information:
Examples:
Plan, subscription, trial, transaction,
usage, and purchase history
Sources: You, Stripe, service
activity
Purposes: Billing, limits, account
support, reporting
Recipients: Stripe, hosting,
storage, professional advisers

Internet or electronic activity:
Examples:
IP address, request endpoint, timestamps,
request counts, session and bot-detection data
Sources: Browsers, devices,
connected sites, hosting and security systems
Purposes: Authentication, security,
rate limiting, fraud prevention, service operation
Recipients: Application Hosting Company,
Email Service, security and infrastructure providers

Professional or employment-related information:
Examples:
Company and business-role information
submitted with an account or support request
Sources: You or your organization
Purposes: Business account
administration and support
Recipients: Operational and
professional service providers

User-provided content and inferences:
Examples:
Prompts, audience selections, content
preferences, product information, images, and generated output
Sources: You, authorized users,
connected sites
Purposes: AI generation,
customization, service improvement
Recipients: OpenAI, Application
Hosting Company, Email Service where included in communications

Sensitive personal information:
Examples:
Account login credentials and payment-card
details submitted for processing; other sensitive information only if a user
chooses to include it
Sources: You
Purposes: Authentication, payment
processing, support, and security

We collect, use, and disclose these categories for the purposes described in Sections 4 and 6.
We do not use or disclose sensitive personal information to infer characteristics about individuals beyond what is reasonably necessary to provide and secure the Services.

We have not sold personal information for money or shared personal information for cross-context behavioral advertising during the preceding 12 months. California residents may exercise applicable rights to know, access, correct, delete, and receive information
about disclosure by contacting us at: https://scribo.scribendohq.ai/contact-us.

14. Children's Privacy

The Services are intended for businesses and adults and are not directed to children under 13.
We do not knowingly collect personal information directly from children under 13. If you believe a child has provided personal information to us, contact us at: https://scribo.scribendohq.ai/contact-us so we can investigate and take
appropriate action.

Users must not submit children's personal information or images through AI generation or support features unless they have all legally required authority, notices, and consents.

15. Third-Party Sites and Customer Websites

The Services may link to third-party sites or publish content to customer-controlled WordPress and WooCommerce sites. Scribendo HQ does not control the privacy practices of those sites. Review their privacy policies before providing information.

Customers are independently responsible for their published content, customer relationships, ecommerce operations, cookies, forms, analytics, and privacy notices.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Services, providers, or legal requirements. We will post the updated policy and revise the "Last updated" date. If a change is material, we may provide additional notice through the Services or by email where appropriate or legally required.

17. Contact Us

Questions,
concerns, complaints, and privacy-rights requests may be sent to:

Company: Ascent Digital LLC, doing business as Scribendo HQ

Email: https://scribo.scribendohq.ai/contact-us

Mailing address: 302 Ridge
Way Dr. Monroe GA, 30655

Website: https://scribendohq.ai/