This policy explains what ScalePal collects, why, and what you can ask us to do with it. It applies to app.scalepal.ai and the ScalePal service.
Three kinds of information, and nothing else:
We do not collect payment details on the free plan. We do not use tracking cookies or advertising pixels.
Connecting Facebook is optional. If you connect it so ScalePal can post for you, we store:
We use them only to publish a post you have approved, when you click to publish it. Nothing goes out that you did not approve.
When ads arrive in ScalePal we will also store the ad account you choose, and we will create an ad only when you ask for one. It is created paused, so it spends nothing until you turn it on.
To remove all of it, choose Disconnect in Account › Integrations, which deletes the stored tokens and Page details. You can also ask us to delete it, or remove ScalePal from your Facebook settings. The steps are on our data deletion page.
Separately from the above, we record anonymous statistics about how the product performs — how long a strategy took to generate, how many plans it produced, which kind of goal it was built for, roughly how many hours a week and what band of budget were declared, where people stop before finishing, and on your Focus page which kind of suggested task was opened, finished or set aside and which of our reasons you picked for setting it aside, how long it took to open the first one, whether finished work was marked as gone out, and whether you said something, nothing or not yet came of it (never what you wrote). When you pay for a plan we also record that the upgrade page was viewed, that a checkout was started and finished and how long it took to switch on, that a return to Free was scheduled or undone, and that a failed payment was shown to you, and never an amount, a card or an invoice. We use these to find what is slow or broken.
These records carry no identifier of any kind: no name, no email, no account number, no IP address, no cookie. They cannot be traced back to you, connected to each other, or connected to your account, which is why they survive when an account is deleted. They also contain none of what you wrote — a budget is recorded as a band such as “under $500” and never as the sentence you typed. The software can only record from a fixed list of these measurements, so no part of your conversation can reach them.
To provide the service. Your profile and goal are what the strategy is built from, and your conversation is what our Strategist remembers when you come back. Without them the product does not work.
We do not sell your information, and we do not share it for advertising.
Running the service means sending some of your information to companies that work on our behalf. Each is bound to use it only to provide their service to us:
Your conversation and your business profile are sent to Anthropic and to OpenAI to produce your strategy and the work built from it. Both are used under their commercial API terms. Neither trains its models on what we send through their APIs. Both hold a copy for a limited period so they can investigate abuse of their service, and then delete it; they do not keep it to build anything. [Both providers publish the exact retention window and both offer zero-retention arrangements on request. Worth confirming the current figure and asking about zero retention before beta — the sentence above is written to stay true either way, but a specific number is better than a general one]
We add to this list when the product needs something new, and we will tell you by email before a new one starts receiving anything you wrote.
Your information lives inside a workspace. Anyone you invite to that workspace can see everything in it — the profile, the strategy, the plans, the deliverables and the files. Inviting someone is how you share it, and removing them is how you stop.
Workspaces do not see each other. If you have more than one, they hold separate profiles, separate strategies and separate files, and nothing crosses between them.
In the United States. Your account, your database and the files you attach are held by Supabase in East US (Northern Virginia), and the server-side code that reads them runs on Vercel in Washington, D.C. (iad1). Pages and static assets are served from Vercel’s global network, which caches no information about you.
The models that generate your strategy and your deliverables are run by Anthropic, OpenAI and fal.ai, and are also in the United States.
If you pay for a plan, your payment details are processed by Stripe, also in the United States. You enter your card on Stripe’s own page, so it never reaches ScalePal.
If you are outside the United States — including in the UK or the EEA — using ScalePal means your information is transferred there and processed under United States law, which protects it differently from the law where you live. We rely on the Standard Contractual Clauses in our agreements with the providers above to make that transfer lawful.[Confirm SCCs are in place with each provider, and whether a UK addendum is needed, before taking UK or EEA customers]
For as long as your account exists. When you ask us to delete your account we erase your information within 30 days, and after that it cannot be recovered.
The anonymous usage statistics described above are the one exception. They are kept, because there is nothing in them belonging to anyone.
We keep records we are legally required to keep, such as billing records, for as long as the law requires.
Ask for any of these by writing to support@scalepal.ai and we will respond within 30 days. Doing it yourself from inside the app is something we are still building.
If you are in the UK or the EEA, these are your rights under the GDPR — access, rectification, erasure, restriction, portability and objection — and our lawful basis for holding what you give us is performing the contract you entered when you created an account. If you are in California, they are your rights under the CCPA and CPRA, and we neither sell nor share personal information as those laws define it. We will not treat you differently for exercising any of them.
What we actually do, and no more than that:
We are a two-person company and we will not claim more than that. We hold no security certification, we do not run a formal penetration-testing programme, and we have no dedicated security staff. If that matters for your business, it should weigh on your decision to use ScalePal.
If we discover that information belonging to you has been exposed, we will tell you by email without undue delay, and in any case within seventy-two hours of establishing that it happened. We will say what we know: what was exposed, when, who is affected, what we have done to stop it, and what you may want to do. If we do not yet know something we will say that too, rather than wait until the picture is complete.
We will also notify whichever authority the law requires, within the time it requires. New York's data-breach law applies to us, and the GDPR's seventy-two hour rule applies to anyone we hold data about in the UK or the EEA. [Basic commitment, written to be workable. Have a lawyer confirm the notification obligations that actually attach to a Delaware corporation operating from New York with users in both places]
ScalePal is for businesses. It is not intended for anyone under 16 and we do not knowingly collect their information.
If we change this policy materially we will tell you by email before the change takes effect.
ScalePal is operated by ScalePal Labs, Inc., a Delaware corporation based in New York. It is the data controller for everything described here.
Write to support@scalepal.ai for anything in this policy, including a copy of your information, a correction, or deletion. It is monitored and we answer within 30 days.