Privacy Policy
Last updated: 23 July 2026 · Applies to scre.me, www.scre.me, thingwicked.com and its subdomains
1. Who we are
The scre.me platform is owned and operated by Something Wicked, Inc., a privately held Delaware corporation incorporated in May 2012 (mailing address: 2112 Market St., Unit A, San Francisco, CA 94114, USA) — referred to below as "Something Wicked," "we," "us." Something Wicked, Inc. is the data controller for personal information processed through this website. scre.me and the scre.me logo are trademarks of Something Wicked, Inc. Corporate identity can be verified at thingwicked.com.
Privacy contact: privacy@scre.me. Postal correspondence: see Legal & Business Correspondence.
2. What we collect
- Briefing and contact requests. When you submit the briefing form we collect your name, organization, email address, role, and the message you write. The same applies when you email any of our published addresses.
- Business and billing records. If we enter an engagement with you or your organization: contact details, business address, tax or VAT identifiers, and invoicing and payment history. Payments are handled by our payment processors — we do not receive or store full card numbers.
- Technical logs. Our web server records standard access logs (IP address, user-agent, pages requested, timestamps) for security and reliability.
What we do not do: this site sets no advertising or analytics cookies and loads no third-party trackers, fonts, or scripts — every asset is served from our own infrastructure. We do not buy contact lists, and we do not sell or share personal information as those terms are defined in the California Consumer Privacy Act.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Responding to briefing and partnership requests | Steps prior to entering a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Delivering contracted services, invoicing, and payment | Performance of a contract (Art. 6(1)(b)) |
| Accounting, tax, and other legal record-keeping | Legal obligation (Art. 6(1)(c)) |
| Site security, abuse prevention, server logs | Legitimate interests (Art. 6(1)(f)) |
| Establishing or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
4. Who we share it with
We share personal information only with service providers acting on our instructions, and only as needed to run the business:
- Hosting — DigitalOcean, LLC (web servers, USA)
- Email — Google LLC (Google Workspace, USA)
- Payments & invoicing — Stripe, Inc. and Zoho Corporation
- Professional advisers (accountants, counsel) under confidentiality
- Authorities where disclosure is required by law, and parties to a corporate transaction under appropriate protections
5. International transfers
We are established in the United States and our providers process data primarily in the United States. Where we receive personal data from the EEA, UK, or Switzerland, we rely on the transfer safeguards our processors provide — the EU Standard Contractual Clauses and, where the provider is certified, the EU–U.S. Data Privacy Framework. Confirm per-processor transfer mechanism with counsel.
6. How long we keep it
| Data | Retention |
|---|---|
| Briefing/contact requests that do not lead to an engagement | 24 months from last contact, then deleted |
| Contract, invoicing, and payment records | Duration of the relationship + 7 years (statutory tax/accounting retention) |
| Server logs | 90 days |
| Legal correspondence and dispute records | Duration of the matter + applicable limitation period |
7. Your rights
European Economic Area, United Kingdom, Switzerland
You may request access, rectification, erasure, restriction, portability, and may object to processing based on legitimate interests. Where processing rests on consent you may withdraw it at any time. We respond within one month (extendable by two further months for complex requests, with notice). You may lodge a complaint with your supervisory authority — for the UK, the Information Commissioner's Office.
California
Under the CCPA/CPRA you may request to know, access, correct, and delete personal information, and you will not be discriminated against for exercising these rights. We do not sell or share personal information, so no opt-out is required. We verify and respond within 45 days (extendable once by 45 days with notice). You may use an authorized agent with written authorization.
Other U.S. states
Residents of states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others) may exercise the equivalent rights those laws grant. Where a state provides an appeal right, you may appeal a refusal by replying to our decision, and we will respond within the statutory appeal period.
To exercise any right, email privacy@scre.me from the address the request concerns, or write to the postal address on the legal correspondence page.
8. Security
All traffic to this site is encrypted in transit (TLS). Form submissions are stored outside the public web root on access-controlled infrastructure. Access to personal information is limited to people who need it to perform the purposes above.
9. Children
This site and our services are directed to businesses and professionals. They are not directed to children, and we do not knowingly collect personal information from anyone under 16.
10. Changes
We will post any revision here with an updated "last updated" date, and material changes will be flagged on this page for 30 days.