Privacy policy

1.Who this covers

Scale Modern Business Solutions LLC ("Scale", "we") runs Scale Suite. This policy explains how we handle personal information about the people who use it: business owners, their team members and guests, people who enter raffles in Market, and visitors to suite.scalembs.com.

It does not cover scalembs.com, the website of our agency services, which may use advertising and analytics tools.

When your business puts information about its own clients and contacts into Scale, like contacts, punch card holders, booking guests, form answers or Market buyers, we handle it for your business as its service provider, under its instructions and our terms. Those people should contact the business first, and we help the business answer them.

2.What we collect

Account details: your name, email, phone, business name, role and how you sign in. We never see your passkey, and we store passwords only as a secure hash.

Your business content: contacts, messages, email, texts, documents, files, signatures, calendar, websites, forms, call captions and notes, and money records you put into Scale Suite.

Bank information, only if you connect a bank: account names, balances and transactions, through Plaid. We do not receive your bank login.

Payment details: Stripe collects card and payout details and the tax ID and owner details it needs to verify your business. We receive your Stripe account ID and status, and for your Scale bill only the card brand, last four digits and expiry.

Usage and device details: which features you use, your device and browser, and approximate location from your network address, to keep the service secure and working.

AI memory and settings: short notes the Scale Suite AI assistant ("AI") keeps and the rules you set.

Apple Wallet: for passes your business issues, the pass number, holder name, stamp count, and the device and push identifiers Apple sends when a pass is added, so the pass can update.

Raffle entries: your name, email and business, and whether you chose to hear from the sponsor.

Support and consent records: what you tell support, support access grants and visits, and when you agreed to these terms and to automatic renewal.

AI choices: whether AI improvement is on, and support access grants, visits and ends, with who chose, their role, when, and the policy version shown.

AI logs: for each AI request, the model, tools used, timing, cost and errors, with a scrambled user ID. Never the question, the answer or your content.

Market sellers: to verify sellers and follow the INFORM Consumers Act, bank account details, tax ID, a working email and phone number, and a government ID or business record. Stripe also verifies sellers through Pay.

Sign: for each document, the signers' names and emails, how each person confirmed who they are, when each person opened, agreed to sign electronically and signed, and an audit trail that stores each signer's full network (IP) address and full browser user agent, with the document's fingerprint (SHA-256).

Video: calls are transcribed, summarized by AI or recorded only if everyone in the call agrees, and the host keeps a log of those answers. Recordings are made in the host's browser and saved only to the host's own device; we never receive or store them.

Chat: the messages, channels and direct messages your team sends, and who has read what.

Inquiries: when you reserve founder pricing, your name, email, business, kind of business, phone if you give it, whether you agreed to texts, and the campaign tags, referring site and landing page of your visit. Your network address is used only as a salted scramble to limit abuse.

Cookies and browser storage: see the Cookie and tracking policy.

We get this from you, your team, your bank through Plaid, Stripe, Apple, and people who contact your business through Scale.

3.How we use it

To run Scale Suite for you, keep it secure, give you support you ask for, bill you, send service messages, run raffles, prevent fraud and abuse, and follow the law.

We use your business content only to provide the service to you and as you direct. We use usage details, and information that is de-identified or combined so it does not identify you, to improve Scale.

We do not use your business content to train or improve AI unless the account owner or an admin turns on AI improvement, which is off by default and can be turned off at any time, as the AI policy explains. We do not sell your personal information, and we do not share it for cross context behavioral advertising. Scale Suite does not use advertising or cross site tracking tools.

De-identified information: when we use information that has been de-identified, we keep it in a form that cannot reasonably be linked to a person or business, we do not try to re-identify it, and we require anyone we share it with to agree to the same.

4.AI processing

When you use AI, the content it needs for that task is sent to our AI providers: Anthropic for writing and call notes, and Cloudflare Workers AI for images. Our agreements with them do not allow them to train models on it, and they keep it only as their terms allow for running and securing their services. If AI improvement is turned on, Scale may use your AI conversations and the AI drafts you keep or change, with names, email addresses, phone numbers and account numbers removed first, to make AI give better answers. It is never sold or used for ads. Today Scale does not train or tune any AI model. See the AI policy describes.

Live captions in Video use the speech recognition in your browser, which may send your audio to your browser maker, like Google for Chrome, under its own terms. Each person chooses whether to turn on their own captions.

5.AI memory and support access

AI keeps short notes, like a client preferring afternoons, so it can help you. You can see, edit, export and delete every note in Settings. Today the notes are stored encrypted on your device, with a key your browser keeps and will not export. If your browser blocks secure key storage, the notes are kept only until you close the tab and are not saved. This is not end to end encryption. When AI uses a note for a task, the note is sent with that task to our AI provider.

Support access is off by default, and only the account owner can turn it on, in Settings, AI. With it on, a person on the Scale support team can read your account settings and your AI settings and rules, read only, to fix something you asked about. They cannot send, pay, sign, delete or change anything, and they cannot open your Mail, Drive, Docs or Sign content. AI memory stays encrypted on your device, so support cannot read it. The owner picks 1 hour, 24 hours or 7 days. Access ends on its own when the time is up, or sooner if the owner ends it, and every grant, every visit and every end is logged and shown in Settings. Support access is a separate choice from AI improvement.

6.Who we share with

Service providers that help us run Scale, each under contract and only for that work: hosting and storage (Cloudflare), AI (Anthropic and Cloudflare), payments (Stripe, under the Stripe Privacy Policy), bank connections (Plaid, under the Plaid End User Privacy Policy), domains and email hosting (Tucows, under the Tucows privacy policy), Apple Wallet pass updates (Apple), and the providers that deliver the emails and texts you send.

Domain registration: the registry and registrar need your contact details, and some of them may be published in domain records where the rules require it.

People you choose to share with, like your team, clients you send things to, and other businesses in Market. A raffle sponsor gets the winner's contact details, and the details of entrants who chose to hear from it. In Market, a business gets the contact details of people who chose to share them at its booth or stage slot.

When the law requires it, like a valid subpoena, warrant or court order, or to protect people from harm. When the law allows, we tell you first. See Law enforcement and government requests.

If Scale is sold or merged, your information moves with the service and this policy still applies.

7.Where it is stored

Mostly in the United States. Cloudflare may handle a request in the data center nearest you. Scale Suite Mail mailboxes are stored in Canada with our email partner.

8.How long we keep it

Account details and business content: while your account is open. After you close it or delete a business, we keep it for 30 days so you can restore it, then a scheduled job deletes it. Consent, billing and support records are kept for at least 3 years. We do not keep separate backups today [if we add them, copies are deleted within 35 days after that]. The Data retention page lists every kind of data and how long we keep it.

Invoices, payment and tax records: 7 years. Records of your agreement to our terms and to automatic renewal: at least 3 years, or 1 year after your account closes if that is longer.

Security logs: [1 year, once we keep them; today our hosting logs are short lived]. Raffle entries and drawing records: 1 year after the drawing. The support access log: while your account is open.

Bank connections: disconnecting a bank deletes the stored connection token and stops new bank data. Transactions already brought into Money stay until you delete them or close your account.

Drive and Sign: files and signed documents stay until you delete them. Deleted files go to the trash, which is emptied automatically after 30 days. Each signer can download a signed copy from their own link for 30 days after signing.

Chat: messages stay until someone allowed to delete them does, or your account closes. The short change feed that delivers new messages is kept for 8 days.

Video recordings: kept only on the host's device, for as long as the host keeps them. We never have a copy.

9.Security

Connections to Scale are encrypted. Bank connection tokens are encrypted at rest. AI memory is encrypted on your device. You can sign in with a passkey, which we recommend over a password. Staff access to your content is limited as described above. The Security overview lists what is in place today and what is not yet.

No system is perfect. If a breach affects your information, we tell you as the law requires.

10.Your choices and privacy rights

You can see, correct, export and delete most of your information yourself in Settings.

We offer these rights to everyone, wherever you live and whether or not the law requires it of us: to know what personal information we collect, use and disclose, to get a copy, to correct it, and to delete it.

We do not sell or share personal information, so there is nothing to opt out of. Scale Suite does not track you across other websites, so a Do Not Track or Global Privacy Control signal does not change how it works. If that ever changes, we will treat those signals as a request to opt out.

We use sensitive information, like your sign in details, bank information and the contents of your messages, only to provide the service and for other uses the law allows.

We will not treat you differently for using these rights. You can use an authorized agent. To make a request, email privacy@scalembs.com or use Settings, Help and support. We verify your identity before we act and answer within 45 days.

For information a business put into Scale about you, ask that business first. We help it answer you.

10A.California privacy rights (CCPA and CPRA)

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you these rights, and we offer them to everyone:

• Right to know and access: the categories and the specific pieces of personal information we collected about you, where it came from, why, and who we disclosed it to.
• Right to delete personal information we collected from you, with the exceptions the law allows, like records we must keep.
• Right to correct inaccurate personal information.
• Right to a copy you can take elsewhere: export your data in Settings at any time, or ask us.
• Right to opt out of the sale or sharing of personal information. We do not sell or share it (section 10B).
• Right to limit the use of sensitive personal information. We use it only to provide the service and for other uses the law allows, so there is nothing to limit.
• Right not to be treated differently for using these rights.

How to use them: export, correct and delete most information yourself in Settings, or email privacy@scalembs.com, or use Settings, Help and support. We confirm we got your request within 10 business days, verify your identity by matching information we already have, usually through your sign in, and answer within 45 days. If we need more time, up to 45 more days, we tell you why. An authorized agent can ask for you with your signed permission, and we may ask you to confirm it.

Categories we collect, where from, why, and for how long, over the last 12 months:

• Identifiers and contact details, like name, email, phone and account ID: from you and your team; to run and secure the service and support you; while your account is open.
• Customer records and commercial information, like your plan, bills and payments: from you and Stripe; for billing and records; 7 years for invoices and tax records.
• Financial information, like bank balances and transactions if you connect a bank, and Stripe account status: from Plaid and Stripe; to show your money in Money and Books; until you disconnect or delete it.
• Internet and device activity, like features used and errors: from your device; to keep the service working and secure; see the Data retention page.
• Approximate location from your network address: from your device; for security; not kept beyond short lived logs.
• Audio and video, only for Video calls everyone agreed to record: from the people on the call; for the business's records; until the business deletes it.
• Professional or business information, like your business name and role: from you; to run your account; while it is open.
• Sensitive personal information: your sign in details, the contents of your mail, messages and documents, bank account details through Plaid, and for Market sellers, government ID and tax ID: from you, Plaid and Stripe; only to provide the service, verify sellers and follow the law; for the periods on the Data retention page.

We disclose each category only to the service providers on the Subprocessors list and to the people you choose, as section 6 describes. Whether the CCPA applies to Scale depends on its size, and today it likely does not [Mike: confirm], but we follow it anyway.

10B.Do not sell or share

We do not sell personal information, and we do not share it for cross context behavioral advertising. We have not done either in the last 12 months, and we do not sell or share the personal information of anyone under 16. Because of that, we do not show a "Do not sell or share my personal information" link. If this ever changes, we will tell you first, add that link, and treat a Global Privacy Control signal as a request to opt out.

11.Children

Scale is for businesses and people 18 and older and is not directed to children. We do not knowingly collect personal information directly from children under 13, and if we learn we did, we delete it.

If your business puts information about minors into Scale, like a youth team roster, you are responsible for having the right to do so, including any parent consent.

12.Changes and contact

If we change this policy in a way that matters, we tell you at least 30 days ahead in the app and by email, and we update the date at the top.

Questions: privacy@scalembs.com, or by mail to Scale Modern Business Solutions LLC, 2415 San Ramon Valley Blvd, Suite 4, San Ramon, CA 94583.