Privacy policy

Our platform is provided to companies as an AI-powered intelligence tool. If the Service is made available to you by your employer, your employer is the Controller of your personal data and Scale is the Processor.

Scale processes personal data only under the instructions of the Customer and is not responsible for the Customer's independent privacy practices.

Scale does not independently determine the purposes or means of processing Customer Data and acts solely on the instructions of the Customer in its role as Processor.

1. Types of Personal Data Processed as a Processor

a) User Profile Data

• Name

• Work email address

• Login credentials managed through our authentication provider

b) Customer-Uploaded Content

Documents (such as PDFs, spreadsheets, and presentations) that users upload to the platform.

These documents may incidentally contain personal data, such as team member names and email addresses in project files, steering committee decks, or similar materials. Scale does not systematically extract personal data from these documents.

c) Project Data

Team member names and email addresses added to projects by users in connection with project management and collaboration features.

d) Access and Technical Data

• IP address

• Browser type

• Operating system

• Device identifiers

• Date and time of access

• Error logs

• Usage metrics

This information is processed primarily for system stability, service performance, security monitoring, and service improvement.

e) Connected Content-Source Data

Files, pages, and other content the user selects from a connected Google or Microsoft account or another connected third-party content source (see Section II.3).

2. Use of AI

The Service uses artificial intelligence models to analyze Customer-uploaded documents and generate insights and recommendations.

The AI engine is powered by Google Gemini Enterprise Agent Platform by default. Where a Customer configures a third-party AI provider, processing is subject to that provider's terms.

AI may encounter personal data incidentally present in uploaded documents. It does not extract, profile, or store personal data separately from the documents themselves.

AI processing involves automated analysis of documents that may incidentally contain personal data. The Service is not designed to profile individuals or evaluate personal aspects of data subjects.

AI outputs are advisory only and do not produce legal or similarly significant effects on individuals. All business decisions remain the responsibility of human users at the Customer.

To the extent that such automated analysis could be interpreted as profiling under applicable law, data subjects have the right to object to such processing under GDPR Article 21.

Scale's default AI provider (Google Gemini Enterprise Agent Platform) is contractually prohibited from using Customer Data to train or optimize its general AI models.

Where the Customer configures a third-party AI provider, the Customer is responsible for reviewing that provider's data usage terms.

All AI processing occurs within EU infrastructure by default. If a Customer configures a third-party AI provider, processing location is determined by that provider's terms.

3. Connected Workspace Accounts and Content Sources

Users may connect external content sources to the Service — such as a Google or Microsoft work account, or third-party workspace and knowledge tools (e.g., document and wiki platforms) — and select files, pages, and other content for the Service's AI features to analyze.

Scale accesses connected-source data only as authorized by the connecting user (through an OAuth authorization or an API key provided by the user, depending on the source), and only reads content the user has chosen to make available. The user can revoke this authorization at any time in the Service, or by revoking the authorization or API key in the provider's own settings.

Content from connected sources is used solely to provide the Service's features to the user's organization — such as analyzing project materials and answering users' questions — and is processed as Customer Data under this Policy, including by the AI engine described in Section II.2. Anything the Service stores from or about connected content, including temporary copies made during processing, is likewise handled as Customer Data under this Policy's retention and deletion terms (Section II.4). Connected-source data is not used for advertising, is never used to train or improve generalized AI or machine-learning models, and is not shared with third parties other than the service providers listed in Section IV (Processor role).

The connected providers themselves (e.g., Google, Microsoft, or the third-party tool the user connects) process the content under the Customer's or user's own agreements with those providers; Scale accesses these sources on the user's behalf and does not engage them as sub-processors.

Scale Platform's use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Scale Platform's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

4. Storage Duration as a Processor

Scale retains Customer Data only as long as necessary to provide the Service and fulfill contractual obligations.