Privacy policy

Who we are

Scnro is operated by Danang Aqubit Lab Co., Ltd. (Công ty TNHH Danang Aqubit Lab) (tax code 0402220012, registered office Vietnam International Financial Center, ICT Building 1, Software Park 2, Da Nang City). Danang Aqubit Lab Co., Ltd. (Công ty TNHH Danang Aqubit Lab) decides how the personal data described here is used. For any privacy question or request, write to trung.pham@aqubitlab.com.

What we collect

Account: your email address, display name and language; if you sign in with Google, Facebook or Microsoft, what is described under Sign-in with Google, Facebook or Microsoft below.

Sign-in and security: sign-in links we send, sessions with their time, IP address and browser type, and the version and time of the terms you accepted.

Sign-in with Google, Facebook or Microsoft: we keep the identifier that service gives for your account and the email address it shares, and nothing else from it: no name, photo or friends list, and we never receive your password there. Google vouches for its address, and Microsoft does only for a verified domain; Facebook does not say its address is verified. Before an address that is not vouched for opens or joins an account, we email a six-digit code to it, or to another address you type, and you enter the code in the browser you started in. The code works for 10 minutes, allows five wrong tries and is stored only as a keyed hash. The service you chose also learns that you signed in to Scnro.

Sign-in counts: how many times a sign-in was started, came back from the service, succeeded, was refused (with the reason) or needed a code, by day, by service and by kind of browser (an ordinary one, or one inside Facebook, Zalo, TikTok or another app). The counts are anonymous: they carry no account, session, address or time of day, so they cannot be traced to a person. We use them to see where signing in fails; they are deleted after 12 months.

Organization: its name, plan, members and their roles, invitations (the invited email address and who sent it), and billing status. We do not receive or store your card details or bank login.

API keys and connected apps: a key's name, who created it, when and from which IP address it was last used (the key itself is stored only as a hash); for a connected app such as Claude, the app's name, the organization it acts for, and when it was connected and last used.

Usage: which tools were called, when, by which person and organization, whether each call was refused and why, and the Scnro Pennies they cost. Our web server logs requests with their IP address; keys and tokens are removed from logs.

Invitations and rewards: the invitation code you share and who signed up through it, the actions that earned Scnro Pennies (the first connection of an assistant, the domain of a company email address, share button presses) and the Scnro Pennies given.

Feedback you send: the stars and note you send with the Feedback button, and the part of the portal you sent them from, are kept with your account, and staff read them to improve the service. Your answers about a report (how useful it was, why, and any note) are kept with the study: staff see the rating and the reasons, and its note only when they open that study.

Contact form: the name, work email, organization, role and need you send through the form on our site. It is mailed to our team and kept so that we can answer you, and staff read it.

Report links: who made the link, the report and revision it opens, when it was made and how many times it was opened. A reader sees the creator's display name or the part of their email address before the @.

Bank transfers: the order number, amount, transfer description and the transfer reference returned by the bank or the provider that confirms transfers. We do not receive your bank login.

Usage events: which steps of Scnro you take (signing up, accepting the terms, making a team, connecting an assistant, the first Scnro Pennies spent, sharing a report, starting a Studio conversation, looking at the plans, pressing upgrade), when, and where you landed from before signing up (the utm tags of that page). We use them inside Scnro to see where people stop and to improve the service; they are not shared with any third party and are deleted after 12 months.

Home page counts: on the home page we count, day by day, how many visits saw each part of the page, which buttons were pressed and which demonstration example was tried. The counts say nothing about who you are: no cookie, no identifier, no IP address and no browser details are kept with them, and they are not linked to your account, even when you are signed in. To stop abuse, a digest of your address is kept for one hour in the system that limits how many counts one address can send, and copies of that system's files (its journal, its snapshots and the backups made when the service is updated) can keep it for longer; it is not linked to the counts. Like every request to our site, the request that sends a count is recorded in the web server's log with your IP address and the time (see Usage); that log is separate from the counts. Nothing is counted when your browser sends Global Privacy Control or Do Not Track. We use the counts inside Scnro to improve the site; they are not shared with any third party and are deleted after 12 months.

Content from your conversations

Scnro does not receive or store your chat with Claude or any other assistant. It does not read the assistant's memory, chat history or your files. It receives only what the assistant sends when it calls a Scnro tool, and stores what the tool needs to do its work: study titles and briefs, your answers to clarifying questions, the sources, documents and data you register, model inputs, scenarios, results, reports and exported files. Synthetic datasets are generated from a design and, where you supply your own data, from an aggregate profile of it.

The web Studio

When you use the web Studio, what you type, the Studio's replies and the results of the tools it calls are stored in a separate part of our database so that you can reopen a conversation. They are kept for 90 days after the last activity, or until you delete the conversation. For each model call we also keep the number of tokens, its cost and the Scnro Pennies charged, without the content; those records stay after a conversation is deleted.

To write its replies the Studio sends the conversation so far, and the tool results the study needs (which can include excerpts of the sources you registered and the figures of your study), to Anthropic, PBC, whose model runs the Studio. Anthropic processes that content on our behalf to produce the answer. We do not send your email address, your account details or your other studies. A source that does not allow use by an AI is not sent.

What you do through your own assistant is not affected: Scnro still does not receive your chat there.

The learning loop

Scnro keeps with a person's account what they do in the learning loop: their answers to the cases, the days they were active, the steps they ran that count toward points, their points and levels, the Scnro Pennies they spent on the loop, their notices, the letters they chose to receive, and the reasons they give when they ask for half back.

The habits shown under Decision habits are worked out from the answers by fixed rules, not by an AI model: each option carries tags, and a habit is named only from 10 answers. Only the person sees them. How others chose is a count of answers without names, given as a share only from 30 answers; answers from Scnro staff and from test organisations are not counted.

Letters about the loop are sent only when the person turns them on in their account, and each carries a link to unsubscribe in one click. Scnro staff read the reasons given for half back to improve the service, and each reading is recorded. Deleting the account deletes all of this; deleting an organisation deletes what belongs to it.

How we use it

We use this data to sign you in, to keep accounts and organizations secure, to run the tools you call and keep your studies available across conversations, to meter Scnro Pennies and bill plans, to give and count the Scnro Pennies earned by invitations and other actions and to prevent abuse of them, to send service email (sign-in links, invitations, plan and expiry notices), to find and fix faults and abuse, to see how Scnro is used so that we can improve the service, and to write to you about a problem you met. We do not sell personal data, show advertising, or use your study content to train AI models.

Who we share it with

We share data only with providers that help us run the service: Resend, which delivers our email (recipient address and message content); the provider that confirms bank transfers, when you pay that way (the order number, amount, transfer description and transfer reference); Google, Microsoft and Meta (Facebook), when you choose to sign in with them (each learns that you signed in to Scnro, and we send it only what the sign-in needs); Anthropic, PBC, whose model answers in the web Studio (see The web Studio); and our hosting provider, on whose servers the service and its backups run.

Research tools look up public statistics and records from sources such as the World Bank, IMF, OECD, ILO, Eurostat, the US SEC, Crossref and GLEIF. Those requests carry search terms such as a country, sector, indicator or organization name; they do not carry your account details.

We may disclose data when the law requires it. An organization's owners and admins can see its members, keys and usage.

Storage and security

All connections use TLS. API keys, sign-in links, sessions and OAuth tokens are stored as hashes, and access tokens are short-lived. Each organization's data is separated from others', and access by our staff is limited to operating, supporting and improving the service and is recorded. Staff can see who uses Scnro, which tools they call and how far each study has come; those views show no study title or content. A few staff members hold a separate permission to open the content of any study, and every opening is recorded. What they can open is what is stored: your question, your answers, what Scnro asked you, your confirmations, any note you left about a report, and the report; never your chat with the assistant.

How long we keep it

A browser session ends after 30 days without use; a sign-in link after 15 minutes; an unused app connection after 90 days.

When a paid period ends the organization returns to the free Starter plan and nothing is removed. An organization its owner deletes is removed after 30 days: we remove its API keys, invitations, projects and memberships and its billing identifiers, and its report links stop working at once. An organization that an earlier release had expired is kept; if it stays unused for 90 days we email a warning, and 14 days later remove the same things.

When you delete your account your email address, name and the identifiers of the services you signed in with are removed, with the sign-in links and codes that carry them, your sessions end and your keys and connections are revoked.

Facebook data: if you remove Scnro in your Facebook settings (Settings & privacy, Settings, Apps and websites), Facebook tells us and we delete the identifier it gave us for your account and any confirmation code waiting for it. Your Scnro account stays, reached by your email address. The page scnro.com/data-deletion explains this and shows a request's status by the confirmation code Facebook gave you.

Staff reading records (who on our team looked at what, and when) are deleted after 12 months. The log of which person called which tool is deleted after 90 days. A separate evidence record of each call stays and is not deleted: the person's identifier, the tool, the decision, the time and hashes, not what was sent. The Scnro Pennies charged stay in the organization's history. What you send with the Feedback button is deleted after 12 months, or sooner if you delete your account or your organization is removed; your answers about a report stay with the study, like the rest of its content. What you send through the contact form is kept until you ask us to delete it. The record that a study's content was opened, with its reason, is kept and not deleted. Payment order data (the order number, amount and transfer reference) is kept for the period Vietnamese law sets for accounting records.

Study content (briefs, sources, results and reports) is kept while the organization exists and is not yet erased automatically by the steps above. To have it erased, write to trung.pham@aqubitlab.com and we will delete it within 30 days. Backups and other security records may persist for a limited time after that; the evidence record of each call and the record of an opening stay.

Your choices and rights

You can see and change your profile, revoke keys, disconnect apps, leave or delete an organization and delete your account in the portal. You can ask us for a copy of your personal data, to correct it, to erase it or to stop using it, and we will answer within 30 days. Write to trung.pham@aqubitlab.com. Personal data is processed under the Law on Personal Data Protection 2025 (Law No. 91/2025/QH15) and Decree 356/2025/ND-CP. You may also complain to the data protection authority where you live.

Changes to this policy

When this policy changes in a way that matters, the version above changes and the portal asks you to accept it again.