Privacy Policy

1. Scope

This Policy applies to personal information handled through:

• the Scrowise website and accounts;
• Listings, offers, and marketplace activity;
• Plus and Pro transaction workflows;
• identity, ownership, and compliance verification;
• communications with Scrowise;
• disputes, refunds, and payouts; and
• related operational services.

It does not govern a third-party platform, financial institution, payment provider, or website operating under its own privacy policy.

2. Accountability and privacy contact

Pheromones Inc. is responsible for personal information under its control and has designated responsibility for privacy compliance.

Questions, requests, and complaints may be directed to:

Scrowise Privacy Contact
Pheromones Inc., doing business as Scrowise
1 King St West
Toronto, Ontario, Canada
Email: [email protected]

We may need to verify your identity before responding to a privacy request.

3. Personal information we collect

The information collected depends on how you use Scrowise.

3.1 Identity, contact, and account information

This may include:

• name;
• email address;
• phone number;
• country or location;
• company or organization;
• biography and avatar;
• username, internal account identifier, and account status;
• password authentication data or OAuth identifiers; and
• email verification and password-reset records.

Passwords should be stored in protected form rather than as readable passwords, but you remain responsible for choosing a strong, unique password.

3.2 Identity and compliance information

Where verification is required, we may collect:

• government-issued identity document details and copies;
• photographs or other identity evidence;
• address or residency information;
• date of birth;
• company ownership or authority information;
• ownership proof relating to an Asset;
• source-of-funds information;
• sanctions, fraud, and risk-review information;
• explanations and supporting compliance documents; and
• administrator verification decisions and notes.

Please provide only the information requested. Verification documents can contain sensitive personal information.

3.3 Transaction, payment, and payout information

We may collect:

• Listings, offers, prices, currencies, plans, and fee choices;
• Buyer and Seller Transaction Terms;
• electronic signatures and signature records;
• transaction status and scheduling information;
• funding instructions and administrative verification results;
• payment evidence, receipts, screenshots, or invoices;
• payment references and limited financial details;
• Seller payout information;
• refund, reversal, and chargeback information;
• handover confirmations; and
• dispute evidence and outcomes.

Payment providers and financial institutions may collect additional financial information directly under their own privacy policies.

3.4 Listings, uploads, messages, and marketplace activity

We may collect:

• Listing titles, descriptions, prices, images, and supporting materials;
• Asset ownership and performance evidence;
• offers and responses;
• watchlists;
• Buyer, Seller, and administrator messages;
• uploaded files;
• scheduling and handover communications;
• support requests; and
• reports of suspected misconduct.

Some of this information is intentionally made public or shared with another Transaction participant, as described below.

3.5 Google and YouTube information

If you connect a Google account for YouTube channel verification, Scrowise may receive an OAuth authorization and YouTube information available through the approved read-only scope. This may include:

• Google or YouTube account identifiers;
• channel identifiers;
• channel ownership or access information;
• channel name and available metadata; and
• authorization and verification status.

Scrowise uses this access to support channel ownership verification. Read-only authorization does not give Scrowise permission to publish videos, alter a channel, or act outside the granted permissions.

You may revoke Scrowise’s access through your Google account settings, but doing so may affect verification or an active Transaction.

3.6 Device, log, and security information

When you use the Service, we may collect:

• IP address;
• browser and device type;
• operating system;
• request timestamps;
• pages or functions accessed;
• login and session events;
• referral or error information;
• security, fraud, and audit logs; and
• information about suspected misuse.

3.7 Support, communications, and preferences

We may collect:

• emails and other communications with us;
• verification and password-reset activity;
• notification and marketing preferences;
• survey or feedback responses; and
• information supplied when making a complaint or privacy request.

4. Sources of information

We collect personal information:

• directly from you;
• from Buyers, Sellers, and other users involved in a Transaction;
• automatically from your browser or device;
• from Google or YouTube when you authorize access;
• from financial institutions and payment or payout providers;
• from identity, fraud, compliance, email, hosting, and other service providers;
• from public sources where permitted by law; and
• from regulators, law enforcement, professional advisers, or other third parties where appropriate.

If you provide personal information about someone else, you must have lawful authority to do so and must not submit unnecessary information.

5. How we use personal information

We use personal information to:

• create, authenticate, and administer accounts;
• verify email addresses and reset passwords;
• maintain profiles, avatars, and preferences;
• publish and operate Listings, offers, and watchlists;
• prepare and record Transaction Terms and electronic signatures;
• administer Plus and Pro workflows;
• verify identity, ownership, funding, and source of funds;
• coordinate scheduling, handover, refunds, and Seller payouts;
• provide Buyer, Seller, and administrator communications;
• investigate disputes and suspected misconduct;
• prevent fraud, account compromise, abuse, and unlawful activity;
• comply with sanctions, court orders, legal obligations, and valid government requests;
• provide customer support and operational notices;
• process fees, accounting, tax, and financial records;
• maintain, troubleshoot, secure, and improve the Service;
• enforce our agreements and establish, exercise, or defend legal claims;
• conduct corporate, risk, and internal reporting; and
• send marketing where permitted and consistent with your preferences.

We may create aggregated or de-identified information that does not reasonably identify an individual and use it for lawful business purposes.

6. Consent and other permitted processing

Where consent is the appropriate basis, we seek meaningful consent in a manner appropriate to the sensitivity of the information and the context.

Some processing is necessary to provide the Service you request. For example, Scrowise cannot administer a Transaction without sharing relevant terms and handover information with the other party.

Applicable law may also permit or require collection, use, or disclosure without consent, including for:

• fraud prevention and investigation;
• collecting a debt;
• compliance with a warrant, subpoena, court order, or law;
• an emergency affecting life, health, or security;
• investigating a breach of an agreement or law;
• sanctions and regulatory compliance;
• a prospective or completed business transaction; or
• establishing, exercising, or defending legal claims.

Where EEA or UK law applies, our legal bases may include:

• performance of a contract or steps requested before entering one;
• compliance with a legal obligation;
• our legitimate interests in operating, securing, improving, and protecting the Service;
• consent, where required; and
• establishment, exercise, or defence of legal claims.

We assess legitimate interests against the rights and interests of affected individuals.

7. Public information and visibility to Transaction parties

7.1 Public Listings and profiles

Information included in a public Listing or public-facing profile may be visible to anyone who can access the Service. Depending on your choices, this can include:

• profile name, avatar, company, country, or biography;
• Listing descriptions and images;
• Asset information;
• asking prices; and
• other information intentionally submitted for publication.

Do not place private contact details, identity documents, payment information, passwords, authentication codes, or confidential records in public fields.

Public information may be copied or retained by others outside Scrowise’s control.

7.2 Buyer and Seller visibility

Transaction participants may see information reasonably necessary to assess and complete their Transaction, such as:

• names or profile information;
• offers and signed Transaction Terms;
• relevant Asset and ownership evidence;
• messages and schedules;
• funding or handover status;
• electronic signatures;
• confirmations; and
• dispute evidence relevant to the other party’s position.

We do not intend to disclose complete identity documents, source-of-funds records, or payout credentials to another user unless necessary, authorized, or legally required. Administrators may communicate conclusions or verification status without disclosing the underlying document.

7.3 Administrator visibility

Authorized administrators may access account, verification, transaction, upload, payment-evidence, message, dispute, refund, and payout information when needed to operate, protect, or review the Service.

8. When we disclose personal information

We may disclose personal information as follows.

8.1 Service providers

We use providers that help with functions such as:

• hosting and application storage;
• email delivery;
• authentication;
• financial, payment, and payout processing;
• identity, compliance, security, and fraud review;
• technical support and infrastructure;
• professional services; and
• data backup and recovery.

Providers are given information appropriate to their function and are expected to protect it through contractual, organizational, or legal obligations.

8.2 Financial institutions and payment providers

Transaction and financial information may be shared with banks, payment processors, payout providers, card networks, and their compliance partners to verify funding, process fees, issue refunds or payouts, address reversals, and comply with law.

8.3 Other Transaction participants

We disclose relevant information to Buyers, Sellers, and, where appropriate, their authorized representatives to administer a Transaction, handover, or dispute.

8.4 Professional advisers

We may disclose information to lawyers, accountants, auditors, insurers, consultants, and other professional advisers where reasonably necessary and subject to appropriate duties of confidentiality.

8.5 Legal, regulatory, and safety disclosures

We may disclose information to courts, regulators, law enforcement, government authorities, financial institutions, platforms, or affected parties where we reasonably believe disclosure is required or permitted to:

• comply with law or legal process;
• investigate fraud or unlawful conduct;
• administer sanctions or compliance requirements;
• protect Scrowise, users, or the public;
• respond to an emergency;
• enforce an agreement; or
• establish, exercise, or defend a legal claim.

We review requests where practical and may object to requests that appear invalid or excessive.

8.6 Corporate transactions

Information may be disclosed in connection with a financing, merger, acquisition, reorganization, insolvency, or sale of all or part of the business. We use reasonable measures to require appropriate confidentiality and handling during such a transaction.

9. International and cross-border processing

Scrowise is based in Canada, but users, service providers, financial institutions, and technical systems may be located in other countries.

Personal information may therefore be processed or stored outside your province or country. While in another jurisdiction, it may be subject to that jurisdiction’s laws and may be accessible to courts, law enforcement, national-security bodies, or regulators under local law.

Scrowise remains accountable for personal information transferred to service providers for processing as required by applicable Canadian privacy law. We use contractual and other safeguards appropriate to the circumstances, but foreign laws may differ from those in Canada.

Contact us if you would like information about relevant cross-border processing or safeguards.

10. Local storage and similar technologies

The current Scrowise application uses browser local storage to maintain the login session. Local storage places information in your browser so the Service can recognize an authenticated session and provide account functionality.

Someone with access to your device or browser profile may be able to access stored session information. You should:

• use a secured device;
• sign out on shared devices;
• protect your operating-system account; and
• clear site data if you no longer use the device.

Browser controls may allow you to clear or block local storage, but doing so can sign you out or prevent parts of the Service from working.

With your permission, Scrowise uses Google Analytics 4 (“GA4”) on the public website to understand page use, navigation, and website performance. GA4 may process information such as the page URL and title, browser and device details, approximate location, session data, and interactions with the website. Scrowise does not send contact-form fields, private app activity, or URL query parameters to GA4.

The Google tag does not load unless you select Allow analytics. Advertising storage, advertising user data, and advertising personalization remain disabled. You can refuse analytics by selecting Necessary only, or withdraw consent at any time through Cookie settings in the website footer. Withdrawing consent disables further analytics collection and removes accessible GA4 cookies from the Scrowise domain.

We use a necessary first-party cookie to remember your analytics choice for up to six months. We may also use necessary cookies, local storage, server logs, or similar technologies for security, authentication, preferences, and essential Service operations. Google may process analytics information in other jurisdictions; information about Google’s handling of data is available in Google’s Privacy Policy.

11. Marketing and operational messages

Scrowise may send operational communications needed to provide or protect the Service, including:

• email verification;
• password resets;
• security alerts;
• Transaction and handover notices;
• dispute, refund, and payout updates;
• legal or policy notices; and
• responses to support requests.

These messages are not marketing, and you may be unable to opt out while maintaining an account or active Transaction.

We send commercial electronic messages in accordance with applicable law, including Canada’s anti-spam requirements. Where required, we obtain consent or rely on another lawful basis, identify the sender, provide contact information, and include an unsubscribe method.

You may unsubscribe through the message instructions or by contacting [email protected]. We will process unsubscribe requests within the period required by law, though you may continue to receive necessary operational messages.

12. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy or as required or permitted by law.

Retention depends on the nature of the information and may take into account:

• whether an account or Transaction remains active;
• financial, accounting, and tax obligations;
• dispute and chargeback periods;
• fraud and security prevention;
• sanctions and compliance requirements;
• limitation periods;
• legal holds, investigations, or proceedings;
• the sensitivity of the information; and
• backup and disaster-recovery cycles.

Transaction, financial, identity-verification, and compliance records may generally be retained for up to seven years after Transaction completion or account closure, whichever is later. We may retain them longer where required by law or reasonably necessary for an investigation, dispute, sanctions review, legal claim, unpaid obligation, or preservation notice.

Public Content may remain visible until it is removed or the relevant Listing ends. Copies may remain in backups for a limited period or in records retained for legal, security, or dispute purposes.

When information is no longer required, we take reasonable steps to delete it, anonymize it, or securely dispose of it.

13. Security

Scrowise uses administrative, technical, and physical safeguards appropriate to the sensitivity and use of personal information. Measures may include:

• access controls and authentication;
• restrictions on administrator access;
• protected communications and storage where appropriate;
• logging and monitoring;
• verification procedures;
• service-provider controls;
• backup and recovery practices; and
• incident-response procedures.

No internet service, storage system, or transmission method can be guaranteed completely secure. You are responsible for securing your password, devices, connected accounts, and authentication methods.

Notify [email protected] promptly if you suspect unauthorized account access, disclosure of transaction credentials, or another security incident.

14. Privacy breaches

Scrowise assesses suspected losses of, unauthorized access to, or unauthorized disclosures of personal information.

We will investigate and contain an incident, preserve appropriate records, and notify affected individuals and report to the appropriate privacy authority where required by law, including where a breach creates a real risk of significant harm.

Notices may describe the circumstances, timing, information involved, steps taken, potential risks, and protective actions available to affected individuals, as appropriate.

We maintain breach records as required by applicable law.

15. Access and correction

You may request access to personal information Scrowise holds about you and information about how it has been used or disclosed. You may also request correction of inaccurate or incomplete information.

Where PIPEDA applies, we will respond to a complete access request within 30 calendar days, subject to any lawful extension. If an extension is required, we will provide notice within the initial 30-day period, explain the reason and new deadline, and identify the right to complain to the Office of the Privacy Commissioner of Canada. Other laws may provide different response periods.

Some account and profile information may be updated directly through the Service.

Access may be limited where permitted or required by law, including where disclosure would:

• reveal another person’s personal information;
• reveal confidential commercial information;
• be protected by legal privilege;
• interfere with an investigation or legal proceeding; or
• create a serious safety or security risk.

If we deny access or correction, we will explain the reason where legally permitted and identify available complaint options.

16. Deletion, withdrawal of consent, and account closure

You may request account closure or deletion of personal information. You may also withdraw consent to processing based on consent, subject to legal and contractual restrictions and reasonable notice.

Withdrawal or deletion may not be available where information is required to:

• complete or resolve a Transaction;
• process a refund or payout;
• preserve electronic signatures or contractual records;
• comply with financial, tax, sanctions, fraud, or legal obligations;
• investigate misconduct or a security incident;
• respond to a chargeback or dispute;
• collect an amount owing; or
• establish, exercise, or defend a legal claim.

Withdrawing consent may prevent us from providing some or all of the Service. Withdrawal does not affect processing already lawfully completed.

17. Additional international rights

Privacy rights vary by location. Where applicable, including in the European Economic Area or United Kingdom, you may have rights to:

• access your personal information;
• correct inaccurate information;
• request deletion;
• restrict processing;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent;
• object to direct marketing; and
• complain to the data-protection authority where you live or work.

These rights may be subject to exceptions and identity verification. Scrowise may need to retain or continue processing information where permitted by law.

If information is transferred from the EEA or UK, Scrowise will use an applicable transfer mechanism or safeguard where required.

Scrowise does not sell personal information. Scrowise also does not share personal information for cross-context behavioural advertising.

18. Complaints and Canadian privacy rights

Contact us first if you have a privacy concern. Send your complaint to [email protected] and include your name, account email, the nature of the concern, relevant dates or Transaction identifiers, the requested outcome, and supporting information. Do not email passwords, authentication codes, or unnecessary identity documents.

We may verify identity, request additional information, and pause the review until a request is sufficiently complete. We aim to acknowledge a complete privacy complaint within 10 business days and provide a substantive response or status update within 30 calendar days. Complex requests may require more time where permitted by law; if so, we will provide notice and a further update.

We document privacy complaints and restrict access to complaint materials to people who need them for review, legal, security, or compliance purposes. We will not retaliate against a person for making a good-faith privacy complaint or exercising a legal privacy right.

If you are not satisfied, you may have the right to contact the Office of the Privacy Commissioner of Canada or an applicable provincial privacy authority. Contacting Scrowise first does not eliminate your right to approach a regulator.

19. Age restriction

Scrowise is intended only for people who are at least 18 years old. We do not knowingly offer accounts or Transactions to minors.

If you believe a person under 18 has provided personal information through Scrowise, contact [email protected]. We may verify the report and remove the account or information where appropriate, subject to legal retention requirements.

20. Third-party links and platforms

The Service may link to or interact with third-party websites and platforms, including Google and YouTube. Those third parties determine their own privacy practices.

Review their privacy policies before providing information or authorizing access. Scrowise is not responsible for a third party’s collection, use, retention, security, or disclosure of personal information.

Revoking third-party access may not delete information Scrowise previously received and must lawfully retain.

21. Changes to this Policy

We may update this Policy to reflect changes to the Service, technology, legal requirements, or privacy practices.

The updated version will be posted with a revised effective date. We will provide additional notice or seek consent where required by law, particularly if a change materially affects how previously collected personal information is used or disclosed.

Earlier versions may be made available where required.

22. Contact

For privacy questions, requests, or complaints, contact:

Scrowise Privacy Contact
Pheromones Inc., doing business as Scrowise
1 King St West
Toronto, Ontario, Canada
Email: [email protected]