SCALE AI TECHNOLOGIES LTD (Company Number 15489002) (“SCALE AI”, “we”, “us” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use our websites, platform, and related services (collectively, our “Services”). It also describes your rights and choices regarding your personal information under UK data protection laws.

Scope: This Privacy Policy applies to personal information that we collect in our capacity as a data controller – for example, information you provide to create an account or use our Services, or information collected through our websites. It does not apply to any personal data that we may process on your behalf when you use our automation and integration platform to connect to third-party applications or process data about your own customers or end users. In those cases, we act as a data processor on your instructions, and our processing of that data is governed by our agreements with you (such as our Data Processing Addendum), not this Privacy Policy.

Please read this Privacy Policy carefully before using our Services or submitting any personal information. By using the Services or providing personal information to us, you acknowledge that your information will be handled as described in this Privacy Policy. If you do not agree with any part of this Policy, you should not use our Services.

Information We Collect

We may collect and process different types of personal information about you. The categories of information we collect include:

• Information You Provide Directly: When you register for an account, contact us, or use our Services, you may give us personal information such as your name, business email address, phone number, job title, company name, mailing address, login credentials, or other contact details. We also collect any personal information you submit through forms (for example, when requesting support, signing up for newsletters, or responding to surveys).

• Account and Profile Data: In the course of using the Services, you may provide additional profile information (like a profile picture, department or team information, or preferences) and content such as project or workflow details. Any personal data included in this content that you input into our platform is considered “Account Data”.

• Payment and Billing Information: If you purchase a subscription or paid Services, our payment processor will collect your payment card details and billing information. We retain limited billing details (such as billing address and transaction references) as needed for invoicing, record-keeping, and compliance.

• Information We Collect Automatically: When you interact with our Services, we automatically collect technical information about your device and usage of our platform. This may include your IP address, browser type, device identifiers, pages viewed, features used, dates and times of access, and referring website information. We also log certain activity information, such as when integrations run or fail, to help troubleshoot and improve the Services.

• Cookies and Tracking Technologies: We use cookies, web beacons, and similar tracking technologies on our websites to personalize content, remember your preferences, and analyze usage of our Services. Cookies are small text files placed on your device that enable us to collect information such as browser type, time spent on pages, page interactions, and other diagnostic data. You can control or disable cookies through your browser settings. However, note that blocking certain cookies may impact your experience of our site (for example, some features may not function).

• Information from Third Parties: We may receive personal information about you from third-party sources. For instance, if you log into our Service via a single sign-on provider (like Google or Microsoft), or if you integrate our platform with third-party applications, we may receive your username, email address, or other details necessary to facilitate that connection. We might also obtain basic contact and employment information from business partners or marketing lead providers where lawfully permitted.

How We Use Your Information

We use personal information for the following purposes, in accordance with applicable law:

• To Provide and Operate the Services: We process your personal information to create and manage your account, authenticate you when you log in, provide the features and functionality of our automation platform, and enable you to connect with third-party applications as requested. (Legal basis: contractual necessity).

• To Communicate with You: We use contact information (like your email and phone number) to send service-related communications, such as confirmations, technical notices, updates, security alerts, and administrative messages. We may also respond to your inquiries, support requests, or other correspondence. (Legal basis: contractual necessity or legitimate interests in providing you with information).

• To Provide Customer Support: If you contact us for help, we will use your information to assist you, troubleshoot issues, and improve your experience. (Legal basis: contractual necessity or legitimate interests).

• To Improve and Develop Our Services: We analyze usage data, feedback, and other information to understand how our Services are used and to make enhancements. This helps us develop new features, optimize performance, and improve the user experience. Wherever feasible, we use aggregated or anonymized data for these purposes. (Legal basis: legitimate interests in managing and improving our business).

• For Marketing and Newsletters: With your consent (or where otherwise permitted by law for business-to-business contacts), we may use your email or contact details to send promotional communications about our products, services, and events. You can opt out of marketing emails at any time by clicking the unsubscribe link or contacting us. (Legal basis: consent or legitimate interests, as applicable).

• To Ensure Security and Prevent Misuse: We process personal information to maintain the security of our platform, including monitoring for fraudulent or suspicious activity. We may use information (like IP addresses or user activity) to prevent, detect, and investigate fraud, abuse, security incidents, and other harmful activities. (Legal basis: legitimate interests in protecting our Services and complying with legal obligations).

• To Comply with Legal Obligations: We may need to process personal data to comply with U.K. laws and regulations – for example, keeping transaction records for financial reporting or responding to lawful requests by public authorities. (Legal basis: compliance with a legal obligation).

• Other Purposes with Your Consent: If we intend to use your personal information for a purpose not described above, we will explain it to you at the time and obtain your consent as required.

Legal Bases for Processing

Under the UK General Data Protection Regulation (UK GDPR), we must have a valid legal basis to process your personal data. Depending on the context, our legal bases include:

• Contract: Processing is necessary to perform our contract with you or to take steps at your request prior to entering into a contract. For example, we need to process your account data and credentials to provide you with access to the platform.

• Legitimate Interests: We process certain information for our legitimate business interests in a manner that does not override your privacy rights. For instance, improving our platform, securing our Services, and sending product updates to business contacts may be based on legitimate interests. We will always consider your rights and objections before processing on this basis.

• Consent: We rely on your consent in specific situations, such as when sending marketing emails to individuals or using certain non-essential cookies. When consent is our basis, you have the right to withdraw it at any time.

• Legal Obligation: Some processing is necessary for us to comply with our legal obligations, such as retaining records for tax and accounting purposes or disclosing information when required by law or court order.

• Vital Interests or Public Interest: In rare cases, we may process data to protect someone’s life or for a task in the public interest. (While unlikely to apply to our Services, we include this basis for completeness under UK GDPR).

How We Share Your Information

We do not sell your personal data to third parties. However, we may share personal information with the following categories of recipients, but only for the purposes described in this Policy and with appropriate safeguards in place:

• Service Providers: We share personal information with trusted third-party service providers who perform services on our behalf. This includes cloud hosting providers, data center operators, analytics and performance monitoring tools, email delivery services, customer support software, and other IT service vendors. These processors are bound by confidentiality and data protection obligations and may only use your data as instructed by us.

• Affiliates and Business Partners: If SCALE AI TECHNOLOGIES LTD is part of a group of companies in future, we may share your information with our corporate affiliates (such as a parent company or subsidiaries) for internal administrative purposes, platform hosting (e.g., if we use regional data centers), or to support and market our Services. We may also share limited business contact information with integration partners or resellers who work with us to serve mutual customers, but only where you have engaged with such partners or provided consent.

• Third-Party Application Connections: If you choose to connect our platform with third-party applications or services (for example, using our connectors to send data to another software tool), any personal information transmitted in this way will be shared with the third-party application at your direction. We are not responsible for how those third-party services use the data you send to them. Their use of your information is governed by their own privacy policies and terms, which you should review.

• Legal and Compliance: We may disclose personal information when we have a good-faith belief that such disclosure is necessary to comply with applicable laws, regulations, legal processes or governmental requests. We will also share information as required to enforce our Terms of Use or other agreements, to detect or prevent fraud or security issues, or to protect the rights, property, or safety of SCALE AI, our users, or the public.

• Business Transfers: If we are involved in a merger, acquisition, investment, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of our Services to another provider, your information may be transferred to a successor or affiliate as part of that transaction. In such cases, we will ensure the recipient is bound by appropriate privacy obligations and that you are notified as required by law.

Data Retention

We keep personal data for only as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. The specific retention periods depend on the nature of the data and the reasons we collect it. For example:

• Basic account information (like your name, contact details, and account credentials) is retained for as long as you have an active account with us. If you delete your account or your subscription ends, we will delete or anonymize this information within a reasonable period (generally within 60 days), unless we are required to retain it longer for legal reasons.

• Content and configuration data you input into the platform (your “Account Data”) is stored until you actively remove it or as needed to provide the Services. You can delete certain data through your account at any time. We may also periodically purge older transactional records or logs (such as integration execution logs) from our systems, typically after about 30 days, to optimize performance and storage.

• If you have provided personal information for marketing communications, we retain that information until you opt out of receiving such communications or until it is no longer useful for our marketing purposes (whichever comes first). We generally remove or anonymize inactive contact information from our marketing database on a periodic basis.

• In all cases, we may retain information for an additional period if necessary to establish, exercise or defend our legal rights. We also may keep backup copies for a limited time to ensure integrity or for disaster recovery. Even after deletion from our active systems, residual copies might persist in secure archives (but we will continue to protect such information).

Data Security

We have implemented appropriate technical and organizational measures to protect personal data from unauthorized access, loss, misuse, or disclosure. These measures include encryption in transit, access controls to personal information, regular security testing, and employee training on data security. While we strive to protect your information, please note that no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of data. You are responsible for maintaining the security of your account credentials (username and password) and for any actions taken under your account. If you believe that your account or personal data has been compromised, please contact us immediately.

Your Rights and Choices

Under the UK GDPR and Data Protection Act 2018, individuals in the United Kingdom (and similarly, individuals in the European Economic Area under EU GDPR) have certain rights regarding their personal data. Subject to applicable law and certain exceptions, you have the following rights:

• Access: You have the right to request confirmation of whether we are processing your personal data, and if so, to request a copy of the data along with information about how we use and share it. This is commonly known as a “Subject Access Request.”

• Rectification: You have the right to request that we correct or update any inaccurate or incomplete personal information we hold about you. We encourage you to review and correct your profile information through your account settings.

• Erasure: You have the right to request that we delete your personal data when it is no longer needed for the purposes for which it was collected, or when processing is unlawful or you have withdrawn consent (and no other legal basis for processing applies). This is sometimes called the “right to be forgotten.” Please note that this right is not absolute – we may need to retain certain information for legal obligations or legitimate interests (for example, we cannot delete data that is required to fulfill an ongoing contract or that we must keep for regulatory compliance).

• Restriction of Processing: You can ask us to restrict or suspend the processing of your personal data in certain circumstances – for example, if you contest the accuracy of the data or object to our processing, we will consider requests to limit usage while we address your concern.

• Data Portability: You have the right to request a copy of certain personal data in a commonly used, machine-readable format, and to have that information transferred to another data controller, where technically feasible. This right applies to personal data that you have provided to us, when processing is carried out by automated means and is based on your consent or necessary for performance of a contract.

• Object to Processing: You have the right to object to our processing of your personal information in some cases. In particular, you can object to processing that is based on our legitimate interests (including profiling) or to processing for direct marketing purposes. If you object, we will stop the processing unless we have compelling legitimate grounds to continue that do not override your rights, or where needed for legal claims. If you object to direct marketing, we will cease processing your data for those purposes as soon as reasonably practicable.

• Withdraw Consent: If we rely on your consent for processing, you have the right to withdraw that consent at any time. For example, you can opt out of our marketing emails by clicking the unsubscribe link or contacting us, and you can withdraw consent for non-essential cookies by adjusting your browser settings or using our cookie management tools.

• Complaints: You have the right to lodge a complaint about our data practices with the UK Information Commissioner’s Office (ICO) or your local supervisory authority. We would, however, appreciate the chance to address your concerns before you approach the ICO, so please consider contacting us first.

You can exercise your rights by contacting us using the information in the “Contact Us” section below. We will respond to legitimate requests within the time frames required by law (generally one month, extendable by an additional two months where necessary). We may request proof of identity or additional information to verify your request and ensure the security of personal data.

International Data Transfers

SCALE AI TECHNOLOGIES LTD is based in the United Kingdom. Depending on your location and the nature of the Services, your personal data may be transferred to, stored in, or accessed from countries outside of the UK. For example, we may use cloud servers or service providers located in the European Economic Area (EEA), the United States, or other jurisdictions. Whenever we transfer personal data out of the UK to countries that are not deemed by the UK government to have adequate data protection laws, we will ensure appropriate safeguards are in place as required by UK GDPR. These may include entering into the UK International Data Transfer Agreement or Addendum (or, where applicable, the European Commission’s Standard Contractual Clauses, together with UK-specific measures) with the recipient, or relying on another approved mechanism or derogation under the law.

We will take steps to ensure that personal data transferred internationally is treated securely and in accordance with this Privacy Policy. If you have questions about our international data transfer practices, please contact us.

Children’s Privacy

Our Services are not directed to, nor intended for use by, children. We do not knowingly collect personal information from individuals under the age of 13 in the UK (or under the age of 16 in the EEA, as applicable) without verifiable parental consent. If we become aware that we have inadvertently collected personal data from a child below these ages, we will take steps to delete such information as soon as possible. If you are a parent or guardian and you believe we might have information about a minor child, please contact us so that we can investigate and address the issue.

Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make significant changes, we will notify you by prominently posting a notice on our website or, if appropriate, by sending you a notification (e.g., via email or through your account). The “Last Updated” date at the top of this Policy indicates when the latest changes were made. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us at:

SCALE AI TECHNOLOGIES LTD (Company No. 15489002)
Registered office: The Bristol Office, 2nd Floor, 5 High Street, Westbury On Trym, Bristol, BS9 3BY, United Kingdom
Email: info@scale-ai.ai