Trust and data handling

Who runs Screwtape

Screwtape.ai operates the Service and is the controller for account, billing and security data, and the processor for the content customers send. Contact for privacy, security, data requests and legal notices: screwtapedev@gmail.com.

AI disclosure

Verdicts are produced by AI models and automated checks. They can be wrong. Keep a person in charge of payments.

When a model key is configured, judge and consensus calls are scored by a large language model (openai/gpt-oss-120b on Groq, then Cloudflare Workers AI @cf/meta/llama-3.1-8b-instruct-fast), plus deterministic checks. Every response names the engine that ran. Screwtape does not make payment decisions; your systems and people do.

What happens to the content you send

Receipts are kept for audit (1 year on Team, 7 years on Finance Control); judged content is not stored by default. Judged content lives in memory for the request and is not written to the database or logs, unless you opt in to retention or to data sharing. Retention is 0, 1, 30 or 90 days on free keys and follows the plan on Team and Finance Control. Duplicate-invoice checks store salted fingerprints, never the vendor, invoice number, amount or date. Deleting your key with DELETE /v1/keys/me deletes everything tied to it.

We do not sell data, run ads, or train models on your content unless your key turns on data sharing.

Subprocessors

• Cloudflare, Inc.: Hosting (Workers), database (D1), CDN, DNS and the Workers AI fallback model. Location: United States and Cloudflare's global network. Safeguard: Cloudflare DPA with EU Standard Contractual Clauses (Modules 2 and 3) and EU-U.S. Data Privacy Framework certification.

• Groq, Inc.: Model inference for judge and consensus calls (default model openai/gpt-oss-120b). Location: United States. Safeguard: Groq Customer Data Processing Addendum with EU Standard Contractual Clauses.

• PayPal: Card and PayPal payments for packs and plans (PayPal acts as an independent controller for payment data). Location: United States and PayPal's regions. Safeguard: PayPal's own privacy statement and transfer safeguards.

• x402 facilitators (x402.dexter.cash, facilitator.xpay.sh): Verify and settle USDC payments; they receive the payment payload only, never judged content. Location: Operator-hosted, location not published. Safeguard: No personal data beyond a public wallet address is sent.

• Public blockchain RPC providers (Base, Solana): Read on-chain payment status. Location: Various. Safeguard: Only public transaction data is read.

We announce new subprocessors on this page at least 14 days before they process customer personal data.

Transfers out of the EU

Screwtape and its subprocessors process data in the United States. Transfers of EU, UK and Swiss personal data rely on the EU Standard Contractual Clauses, built into our DPA, and on our subprocessors' own SCCs or Data Privacy Framework certification.

Documents

• Terms of Service: https://screwtape.ai/terms/

• Privacy notice: https://screwtape.ai/privacy/

• Data Processing Addendum: https://screwtape.ai/dpa/ (Markdown download at https://screwtape.ai/dpa.md)

• Security details: https://screwtape.ai/security/ and https://screwtape.ai/.well-known/security.txt

Sanctions screening

Requests from Cuba, Iran, North Korea, and the Crimea, Donetsk and Luhansk regions of Ukraine are blocked with HTTP 451, based on Cloudflare's location data. USDC payments from addresses on the OFAC SDN list are refused before settlement. The bundled list is dated 2026-10-21 and is refreshed from the free OFAC list before deploys.

Cancel or delete

Cancel a plan at https://screwtape.ai/plans/cancel/ or in PayPal automatic payments. Delete a key, and everything stored with it, with DELETE /v1/keys/me. For anything else, email screwtapedev@gmail.com.