Privacy Policy

Last updated: 16 May 2026 · Scicon · Governed by Scots law

Scicon is committed to protecting your privacy. This policy explains what data we collect, why we collect it, and your rights under UK GDPR and the Data Protection Act 2018.

1. Who we are

The data controller for PushItPro is Scicon, registered in Scotland. We are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For data protection enquiries, contact us at privacy@pushitpro.com.

2. What data we collect

We collect the minimum data necessary to provide the service.

Data	Who	Purpose	Legal basis
Email address	Registered users only	Account creation, login, service communications	Contract performance
IP address	All users	Rate limiting, abuse prevention, security	Legitimate interests
Usage metadata	All users	Push count, expiry type, timestamps (no content)	Legitimate interests

3. What we do not collect

Due to our zero-knowledge architecture, we do not and cannot collect:

The content of any push (passwords, keys, or any secret text)
Encryption keys — these exist only in share link fragments and are never transmitted to our servers
Browsing history or tracking cookies
Payment card details — these are handled directly by our payment processor

4. How we use your data

We use the data we collect to:

Provide and maintain the PushItPro service
Enforce rate limits for anonymous users
Detect and prevent abuse, fraud, and security incidents
Send transactional emails (account verification, password reset)
Comply with legal obligations

We do not use your data for advertising, profiling, or any automated decision-making that produces legal or similarly significant effects.

5. Data sharing and third parties

We do not sell your personal data. We share data only with the following categories of third-party processors, under appropriate data processing agreements:

Cloudflare — cloud infrastructure and content delivery (Workers, Pages, R2 storage)
Neon — serverless database hosting
Clerk — user authentication and account management
Stripe — payment processing for paid subscriptions (paid tier users only)
Resend — delivery of transactional email (account and team invitations, contact enquiries, service notices)

All processors are required to handle data in accordance with UK GDPR.

6. Data retention

Push content is deleted immediately upon viewing or expiry
Push metadata (timestamps, expiry type, status) is retained for 90 days then deleted
Account email addresses are retained for the duration of the account and deleted within 30 days of account closure
IP addresses used for rate limiting are retained for 24 hours then deleted
Server logs are retained for 30 days

7. Your rights under UK GDPR

You have the following rights regarding your personal data:

Right of access — you may request a copy of the personal data we hold about you
Right to rectification — you may request correction of inaccurate data
Right to erasure — you may request deletion of your personal data
Right to restriction — you may request that we restrict processing of your data
Right to data portability — you may request your data in a machine-readable format
Right to object — you may object to processing based on legitimate interests

To exercise any of these rights, contact us at privacy@pushitpro.com. We will respond within 30 days.

8. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

Website: ico.org.uk
Telephone: 0303 123 1113

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS 1.2+), encryption at rest (AES-256), access controls, and regular security reviews. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Cookies

PushItPro uses only essential session cookies required for authentication. We do not use analytics, advertising, or tracking cookies. No cookie consent banner is required as we use only strictly necessary cookies.

11. Changes to this policy

We may update this privacy policy from time to time. Where changes are material, we will notify registered users by email at least 14 days before the changes take effect. The current version will always be available at pushitpro.com/privacy.

12. Governing law and jurisdiction

This privacy policy and any dispute arising from it shall be governed by the law of Scotland. The parties irrevocably submit to the exclusive jurisdiction of the Scottish courts.

13. Contact us

For any privacy-related questions or to exercise your rights, contact Scicon at privacy@pushitpro.com.