Privacy Policy

Screebl (“we”, “us”) is a reporting platform for marketing agencies, operated by WebWizards SARL, Cites des Oudayas, Bloc 15 N7, Ain Sebaa, Casablanca, Morocco.

For any privacy question or request, write to info@screebl.ai.

Under the EU General Data Protection Regulation (GDPR) we play two different roles:

• Controller for the data we need to run our own business: user accounts, website visits, support conversations and billing.
• Processor for the content our customers (agencies and freelancers) put into Screebl: campaign data, uploaded files, reports and their clients' contact details. The agency decides what goes in and why; we process it only to provide the service, under our data processing terms.

If you are an agency's client viewing a report, the agency is responsible for your data. Please contact them first; we will help them answer you.

• Account data — name, email address, role, the agency you belong to, and a sign-in identifier from our authentication provider. Passwords are handled by Google Firebase; we never see or store them.
• Client contact data — the name, company and email address of an agency's clients, entered by the agency so the client can receive an invitation and open their portal.
• Customer content — spreadsheets you upload, report data, images added to reports, and campaign briefs.
• Report viewer data — when a shared report is opened we count the view. If the report is protected, we check the access key you enter. Questions typed into the report assistant are processed to answer them.
• Technical data — IP address, browser type and timestamps in our server logs, used for security and troubleshooting.
• Communications — emails you send us and our replies.

Usage and error data — we use PostHog (EU) to count page visits anonymously and to record technical errors so we can fix them. If you click Accept in the cookie banner, PostHog also sets a cookie and records your session (clicks and page changes; everything you type in form fields is hidden, and inside the signed-in app all on-screen text is hidden too) and, when you are signed in, links it to your user id and role. Shared reports and the client portal are never recorded. We do not use advertising trackers.

• To provide the service you or your agency signed up for — accounts, reports, sharing, exports, emails. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• To keep Screebl secure — preventing abuse, rate-limiting public endpoints, investigating incidents. Legal basis: our legitimate interest in a safe service (Art. 6(1)(f)).
• To meet legal obligations — for example keeping invoicing records. Legal basis: legal obligation (Art. 6(1)(c)).
• To improve the product and fix errors — anonymous visit counts and error reports: legitimate interest (Art. 6(1)(f)). Session recordings and the analytics cookie: your consent (Art. 6(1)(a)), which you can withdraw at any time with Cookie settings in the footer.
• To reply to you when you contact us. Legal basis: legitimate interest, or steps before entering a contract.

We do not sell personal data and we do not use it for advertising.

Screebl has two optional AI features, both powered by OpenAI through our own servers (your browser never talks to OpenAI directly):

• Metric suggestions — when you click Suggest while filling a report, we send the column names of your uploaded file, the types of blocks in the row and the campaign brief. The rows of data themselves are not sent.
• Report assistant — only appears on reports whose campaign has a written brief. When a viewer asks a question, we send the question, the recent conversation, the report's contents and the brief.

Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models by default. Avoid putting personal data in campaign briefs, since briefs are shared with the assistant.

We use the service providers below (“sub-processors”) to run Screebl. Each only receives what it needs for its task and is bound by a data processing agreement.

We may also disclose data where the law requires it, or to protect our rights and the safety of our users.

Our application servers and file storage are hosted by AWS in the European Union. Some providers listed above may process data outside the European Economic Area, notably in the United States. Screebl is operated from Morocco, so our team may access data from there.

Where personal data leaves the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified.

• Account data and customer content — for as long as the account is active. After an account is closed we delete or anonymise it within 90 days, unless the law requires us to keep it longer.
• Server logs — kept for a limited period for security, then deleted.
• Invoicing records — for the period required by accounting law.
• Report assistant conversations — stored only in the viewer's own browser, until they clear them.

• All traffic is encrypted with HTTPS.
• Sign-in is handled by Google Firebase Authentication; every API request is verified.
• Access is role-based and scoped to your agency.
• Report access keys are stored as one-way hashes, never in plain text.
• Uploaded images are served through short-lived signed links.

No system is perfectly secure. If a breach affects your data, we will notify you and the competent authority as the GDPR requires.

Under the GDPR (Articles 15 to 22) you can ask us to:

• give you a copy of your personal data (access),
• correct it (rectification),
• delete it (erasure),
• limit how we use it (restriction),
• send it to you or another provider in a usable format (portability),
• stop using it where we rely on legitimate interest (objection).

Write to info@screebl.ai. We answer within one month. You also have the right to complain to your local data protection authority. In Morocco, that is the CNDP.

Screebl is a business tool and is not intended for anyone under 16.

We only use what is needed to run the site. See our Cookie Policy for the full list.

We will update this page when our practices change and, for significant changes, tell account holders by email before they take effect.