Privacy policy

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

"/Scale", "we" and "us" mean that provider. This policy covers the website slashscale.com and the /Scale application.

There is one important division. For the data inside a company's workspace, that company is responsible and we work on its instructions, as its processor, under the data processing agreement in the terms. If your employer or a client uses /Scale and your question is about data in their workspace, ask them first. We help them answer. For everything else described here, such as your account, this website and payment, we are responsible ourselves.

/Scale is made for businesses. It is not meant for anyone under 16.

2. What we collect and why

2.1 When you visit the website

Our server records each request in a log: your IP address, the time, the address requested, the response, and the browser type and referring page your browser sends. We use the log to deliver the pages, keep the service secure and find faults (Article 6(1)(f) GDPR, our legitimate interest in a working, secure service). Log entries are deleted after 30 days.

The website loads no advertising or social media scripts. Fonts and our own scripts come from our own server. One script comes from elsewhere: the Google tag for the website statistics in 2.11.

2.2 When you start with your website

When you enter a website address under "Start free", /Scale:

• fetches the public home page of that site and of likely competitors;
• sends what it read there (title, description, headings, navigation labels, tools detected on the page) to an AI model for a first reading;
• keeps your answers in the set-up: the website, your goal, competitors, the tools you use, and the colleagues you name.

To prevent abuse, /Scale counts sign-up attempts per IP address for up to an hour. The count is held in memory and not stored. During the competitor step your browser loads small site icons from Google's icon service, so Google sees your IP address and the websites concerned. A set-up that never becomes an account is deleted after 30 days. The legal basis is taking steps to enter into a contract at your request (Article 6(1)(b) GDPR) and our legitimate interest in preventing abuse (Article 6(1)(f)).

2.3 Your account

For an account we store your email address, your name, your time zone, whether you signed up by email or with Google, when the account was created, when you last signed in, and the workspaces you belong to with your role in each. If you sign in with Google, we also receive and store the address of your Google profile picture. There are no passwords: you sign in with a single-use link sent by email or with Google.

We need this to provide the service to you (Article 6(1)(b) GDPR). If you use /Scale as an employee, the basis is our and your employer's legitimate interest in your being able to use it for your work (Article 6(1)(f)). Without an email address you cannot have an account.

Connected apps. You can let an AI assistant on your computer or in your Claude account, such as Claude Code, work in one of your workspaces. You allow it on a page of /Scale after signing in. We then store the app's name, the workspace you chose, when you allowed it and when it was last used, and fingerprints of the keys the app uses to sign its requests; the keys themselves are kept by the app on your side. The app acts in your name and with your role in that workspace, and what it does there is recorded under your name like your own work. You end a connection at any time under Settings → Claude Code in the workspace, or by signing out everywhere; a connection that is not used for 90 days ends by itself. The legal basis is the same as for your account.

2.4 Your work in a workspace

/Scale keeps a record of who decided what. Your approvals, comments, answers and chat messages, the documents you upload and the meetings you record are stored in the workspace under your name, and the other members of that workspace can see them. Of a spreadsheet or CSV file you upload, /Scale also keeps its tables in a form its analyses can query; a column whose header marks a person’s details, such as a name, an email address or a phone number, is left out of them, and email addresses in the other cells are removed. The chat you have open is also kept in your browser until you close the tab.

This data belongs to the company whose workspace it is. We process it on that company's behalf.

The activity log. /Scale also logs how each signed-in person uses a workspace: when you open the app and on what kind of device (such as “Mac” or “iPhone”), which of its pages you open, which of its controls you press, which actions you run and whether they went through (such as connecting or disconnecting a tool, or approving a change), that you asked a question in the chat, replied in a thread or uploaded a file, when you sign in or join, and when you go to order or stop a plan or to add model credit. An entry holds the time, your name and account, and the name that the page, the control or the action has in /Scale. With it can come the id of the thing it was about, such as a tool, a card or a dashboard; a choice you made from a fixed list, such as a role; the type of a file you uploaded, such as “image/png”; the plan you went to order or the amount of credit; and, when /Scale refused an action because of your role or the workspace's plan or credit, a fixed sentence that says so. It never holds what you type or hand in, and never what a page shows: no question, message, note, key or file, no file name, and no text of a button or a card. For a colleague who connects a tool from a link, the same is logged without a name or address. What a connected app (2.3) does in your name is logged under your name.

This log is not part of the workspace. The other members cannot see it. Only the people who operate /Scale read it: to help when a customer asks for support, to find faults and misuse, and to learn which parts of /Scale are used so that we can improve them. The legal basis is our legitimate interest in running, securing and improving the service (Article 6(1)(f) GDPR). It is stored with us on Google Cloud in Belgium, also for a workspace that is kept in the customer's own Google Cloud project. It is not passed on and not used for advertising. The log sets no cookie and keeps nothing in your browser.

2.5 If a colleague names you

A member of a workspace can invite you, ask you to connect a tool, ask you a question, or email you a chart. They give us your name, your email address and your role, or for a chart only your email address. That member's company is responsible for this.

• Invitation or request to connect a tool: you receive one email with a private link. Replies go to the colleague who sent it. A request to connect a tool lets you connect that one tool and shows you nothing else of the workspace.
• A chart for you: you receive one email in the member's name, sent through /Scale, with a chart from their workspace as a picture and the note they added. Replies go to the member. /Scale keeps neither your address nor the email: the activity log (2.4) notes only that the member emailed a chart.
• A question for you: the colleague sends you a private link. Your answer, the conversation on that page and any file you attach are stored in the workspace with your name and the date. An AI model reads them to record what you said. Your answer and the files are also added in full to the recommendation the question was about, and /Scale’s analysis reads them, including the figures in an attached spreadsheet. Anyone who has the link can answer in your name, so don't pass it on.

You don't need an account for a question or to connect a tool.

2.6 The tools you connect

When you connect a tool, /Scale stores the sign-in or the key it needs, encrypted, together with the name of the connected account, the permissions granted, and who connected it and when. It then imports marketing figures from that tool. Search, analytics and advertising data arrive as aggregates, such as clicks per page or cost per campaign. They are not meant to identify a person.

From a CRM or email tool, such as HubSpot, Pipedrive, Klaviyo, Mailchimp or Brevo, /Scale imports counts and totals only: for example new contacts per day by where they came from, the lifecycle stages they reached, deals won and their value, what each campaign or automated email sent and earned, orders and revenue per day, and the size of your lists. From HubSpot it asks, for each contact and deal, only for the dates, the original source and the amount it counts, and stores only the counts. From Pipedrive it reads deals, leads and activities only to count them by day, pipeline, stage and source, and keeps the reasons deals were lost only when they are on your own predefined list. From Klaviyo, Mailchimp and Brevo it reads no record of a person at all. /Scale never stores a contact's name, email address, phone number or any other detail of a person.

From a web analytics tool, such as Matomo or Microsoft Clarity, /Scale imports figures per day for the whole site and per page, device and channel: visits, goals, scroll depth and signs that visitors got stuck, such as rage clicks. It never imports visitor logs, session recordings, IP addresses or visitor ids, and it drops the part of a page address after a “?”, which can carry personal data.

From WordPress, /Scale imports the published posts, pages and other public content of the site you connect: their addresses, titles, dates, categories and tags, the SEO title and description, and counts of words and links. It never reads users, authors or comments, never stores the text of the content, and reads nothing unpublished.

From a shop system, such as Shopify or WooCommerce, /Scale imports counts and totals of your orders per day: orders, revenue, discounts, refunds and products sold, by the sales channel and by the source, medium, campaign, referring site and landing page the shop recorded for the visits that led to an order. It asks the shop only for the fields it counts and never reads or stores a customer's name, email address, phone number, address, customer number, order number or note. Connect it with a key that may only read orders.

From a rank tracker such as SE Ranking, /Scale imports the keywords you track, their positions on each check day with the page of your site that ranked, their search volume, and the positions of the competitors you added there. From an AI visibility tool such as Peec AI, it imports how often AI answers to your tracked prompts name your brand and your competitors, your tracked prompts, and the domains and pages those answers cite; it never reads the AI answers themselves. From Plausible, it imports daily reports like those of the other analytics tools above, and no single visit.

From a data warehouse such as Snowflake or BigQuery, or a spreadsheet in Google Sheets, /Scale imports the rows of the tables and views in the one schema, dataset or spreadsheet you share with it, up to a limit, as they are. It never selects a column whose name marks it as a person's details, such as a name, an email address, a phone number, an address or a customer id, and it removes email addresses from the other values. Keep it to figures, without data about individual people, and give /Scale access that may only read it. Reads from Snowflake run on your own warehouse, which counts them against your Snowflake credits; reads from BigQuery and Google Sheets cost you nothing.

From Trustpilot, /Scale imports your own company's TrustScore, star rating and review counts, and per day how many new reviews arrived, with how many stars, in which language, how many carry Trustpilot's verified or invitation mark, and how many you answered and how fast. It reads the public reviews only to count them and never stores a reviewer's name, profile or location, or the title or text of a review or of your reply.

From SEO tools that charge per request, such as Ahrefs and Moz, /Scale imports estimates for your domain and the competitors you track (such as Domain Rating or Domain Authority, organic traffic, keywords and linking domains) and the keywords your own site ranks for. Each such import spends units of your plan with that tool, and /Scale asks you, with an estimate of the units, before it reads anything new.

A few tools run on your own computer and cannot be read from outside, such as the website crawler Screaming Frog. For these you send /Scale the files the tool exports: on the tool's page in your workspace, or with a script on your computer that holds an upload key. /Scale reads the files into your workspace and then deletes them. It keeps only a fingerprint of the upload key, and the key can hand in files and read nothing. A crawl describes the pages of your website and is not meant to identify a person.

Disconnecting a tool under Sources removes the stored sign-in or key. A Google permission is also withdrawn at Google once no other connection uses it. For Meta, LinkedIn, Microsoft, TikTok, Pinterest, Reddit and Snapchat, remove /Scale in your account settings there as well (for TikTok, under the ad account's authorizations); for Slack, remove /Scale from your Slack workspace's apps. A key you pasted, such as one from HubSpot, Pipedrive, Klaviyo, Mailchimp, Brevo, Matomo, Microsoft Clarity, Shopify, WooCommerce, SE Ranking, Peec AI, Plausible, Snowflake, Ahrefs, Moz or Trustpilot, can also be deleted in that tool. Figures already imported stay in the workspace until it is deleted.

2.7 Voice input and meeting recordings

Voice input in the chat uses your browser's own speech recognition. Depending on the browser, its maker processes the audio, for example Google for Chrome.

If you record a meeting, your browser captures the audio only after you confirm that everyone in the meeting has agreed. While you record, the audio is sent through our server to OpenAI, so that the words appear on your page as people speak. You can switch this live transcript off on the meeting page. When you finish, the recording is uploaded to the workspace, transcribed by OpenAI, and stored with its transcript and the notes you typed during the meeting. An AI model then extracts statements from the transcript and your notes for a member to review.

2.8 Email

/Scale sends service emails only: sign-in links, a confirmation of your email address, invite codes for people on the waitlist, invitations, requests to connect a tool, and charts a member sends from the chat. The members of a workspace whose address is confirmed also get an email when an analysis opens new recommendations, and its admins and marketeers get up to three reminders in the first three weeks to connect the tools chosen in the sign-up, while those are not connected. An admin or marketeer switches either off for the workspace under Settings, Daily run. There is no newsletter and no advertising email. If you write to us, we keep the correspondence to answer you and as a business record.

2.9 Payment

When you order a paid plan or add model credit, the payment is handled by Mollie. Mollie collects your payment details on its own page. For a plan, Mollie keeps your permission to charge the same card or account for each following period until you cancel. We give Mollie the amount, a reference to your workspace and the invoice details you entered under Settings, Invoices: company, contact name, email address, postal address and VAT ID or registration number. Mollie issues the invoice on our behalf and sends it to that email address. We receive and store Mollie's numbers for the customer, the permission, the subscription, each payment and each invoice, the plan with its status and period, the amount, the status of each payment and the kind of payment method. We never see or store card numbers. The legal basis is the contract (Article 6(1)(b) GDPR) and our duty to keep accounting records (Article 6(1)(c)).

The AI models are paid from your workspace's model credit. We keep a record of the credit added to a workspace, who added it and when, and of what the workspace's model use was charged. The legal basis is the same.

2.10 The waitlist and invite codes

While /Scale is open by invitation, the sign-up opens with an invite code. If you join the waitlist, we store your email address and the time you joined. We use the address for one thing: to email you an invite code, with a link that enters it for you. If you join again after your code was sent, the same email is sent once more. The legal basis is taking steps to enter into a contract at your request (Article 6(1)(b) GDPR). To leave the waitlist, write to hello@slashscale.com.

For each invite code we record the address it was sent to, how often it was entered and when it was last entered. We don't record who entered it. To prevent guessing, /Scale counts tries per IP address for up to an hour. The count is held in memory and not stored.

2.11 Website statistics

We use Google Analytics 4 to see how many people visit the website and which pages they read. It runs on the pages of this website and on the sign-in and sign-up pages. It does not run inside a workspace: what /Scale itself logs there is described in 2.4. The provider is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

If you agree in the cookie banner, Google Analytics stores cookies in your browser that tell one visitor from another. For each page you open it records the page's address and title, the page you came from, your browser, device and screen size, your language, the country and city your IP address points to, and what you do on the page, such as scrolling to the end, following a link to another website or sending a form. What you type into a form is not recorded. The legal basis is your consent (Article 6(1)(a) GDPR and section 25(1) of the German TDDDG). You can withdraw it at any time in the cookie settings. The cookies are then deleted from your browser.

Until you choose, and if you decline, Google Analytics stores and reads nothing in your browser. The Google tag is still loaded. For each page opened it sends Google a signal that carries no cookie and no other mark that would recognise your browser again: the page's address and title, the page you came from, details of your browser and the time. Google uses these signals to estimate totals. The legal basis is our legitimate interest in knowing roughly how many people visit the website (Article 6(1)(f) GDPR).

In both cases /Scale leaves out of a page's address whatever you typed, such as an email address, a website or an invite code. Only campaign tags, such as utm_source, stay in it. Google states that Google Analytics 4 does not store IP addresses. The Google tag is told that nothing may be used for advertising, and the statistics are not used for it.

3. Cookies and browser storage

/Scale's own cookies are needed to provide what you asked for. They need no consent under section 25(2) of the German TDDDG. The cookies of Google Analytics are set only after you agreed in the cookie banner (2.11). There are no advertising cookies.

Your browser's local storage also remembers your answer to the cookie banner and a few display choices: whether the sidebar and the set-up list are open, the chat model you picked, the dashboard you last opened, the microphone you last recorded with, whether the live transcript is on, and monthly or annual prices on the pricing page. These stay in your browser and are not sent to us. An app you connected (2.3) sets no cookie: it keeps its own keys on your computer or in your Claude account.

To change your answer, open the cookie settings. The same link is at the foot of every page of the website.

4. Data from Google, Meta, LinkedIn and other ad platforms

/Scale asks for access to these accounts only when you choose to sign in with Google or to connect a tool, and Google, Meta or LinkedIn show you what is requested before you agree.

4.1 What /Scale reads from Google

To read YouTube, /Scale uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and the Google Privacy Policy applies to the data Google processes. You can withdraw /Scale's access at any time in the security settings of your Google account. When you disconnect YouTube, /Scale deletes the YouTube data it imported.

4.2 How /Scale uses, stores and shares it

• Use: to sign you in, and to show and analyse your marketing performance inside your workspace: the agenda, business cases, forecasts, dashboards and chat answers.
• Storage: the imported figures are stored in your workspace on Google Cloud in Belgium, or in your company's own Google Cloud project if it keeps its workspace there (section 5). The sign-in that lets /Scale read your account is stored encrypted.
• Sharing: to produce an analysis or an answer, /Scale passes the excerpts that task needs to the AI model providers in section 5, who process them on our behalf. It is shared with no one else.

4.3 Limited Use

/Scale's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide and improve the features you see in /Scale;
• we transfer it only as needed to provide those features, to comply with the law, or as part of a merger or sale of the business, and then only with notice to you;
• we never use or transfer it for advertising, including retargeting and personalised or interest-based advertising;
• we do not use it to develop, improve or train generalised AI or machine learning models, and our model providers may not either;
• people do not read it, unless you ask us to for support, it is needed for security or to investigate abuse, or the law requires it.

4.4 Withdrawing access

Disconnect the tool under Sources in your workspace, or remove /Scale under third-party access in your Google account. To have figures deleted that were already imported, write to us. Disconnecting YouTube deletes its figures at once.

4.5 Meta and LinkedIn

From Meta, /Scale reads advertising results by campaign and ad set, and the insights and posts of your Facebook page and Instagram account. It does not read who commented on, liked or followed them. From LinkedIn, it reads advertising analytics and the follower and engagement figures of your company page. The LinkedIn permission would also allow changes to the page. /Scale only reads. This data is used, stored and shared in the same way as the Google data above.

4.6 Microsoft, TikTok, Pinterest, Reddit and Snapchat

From each of these ad platforms, /Scale reads the ad account you choose: per campaign and day, spend, impressions, clicks, the conversions and conversion value the platform attributes, and platform figures such as video views or saves, together with the account's name, currency and time zone. From Microsoft it also reads the role your Microsoft user has on the account, to show whether the connection can only read; Microsoft sends that user's name and contact details with it, and /Scale does not keep them. /Scale never reads audiences, customer lists, the people who saw or clicked an ad, the answers people give in lead forms, or your profile on these platforms. The Microsoft and Snapchat permissions would also allow changes, and TikTok's are those of /Scale's app; /Scale only reads. This data is used, stored and shared in the same way as the Google data above.

5. Who receives data

We use the following companies to run /Scale. Each processes personal data only on our instructions and under a data processing contract. They are also our sub-processors for the data in customers' workspaces.

Slack

If you connect Slack, you pick one channel on Slack's own screen, and Slack gives /Scale an address for posting to it, which /Scale keeps encrypted like a password. After an analysis that opens new recommendations, /Scale posts one message to that channel: which analysis ran, your workspace's name, the titles of the new recommendations and links to them in /Scale. It never posts the names or addresses of your team, and it reads nothing in Slack: no messages, channels, members or files. Slack tells /Scale the names of your Slack workspace and of the channel, which the connection's page shows. What is posted is then kept by Slack under your agreement with Slack.

What the AI model providers receive

/Scale's analyses, drafts and chat answers are written by language models from OpenAI and Anthropic. For each task /Scale sends what that task needs. That can include the workspace's name, website and goals, the names of members where they appear in the work (for example as the owner of an initiative), excerpts of imported figures, content and screenshots of web pages, your chat messages, the text of documents you attach, figures read from spreadsheets you upload, and the conversation with someone who answers a question.

The providers process this on our behalf under their terms for business customers. Under those terms they do not use it to train their models. They may keep requests for a limited time, currently up to 30 days, to detect misuse.

Tools on your own account

The tools you connect with your own sign-in or key, such as Google, Meta, LinkedIn, SISTRIX, Semrush, Similarweb, DataForSEO, Ahrefs, Moz, HubSpot, Pipedrive, Klaviyo, Mailchimp, Brevo, Matomo, Microsoft Clarity, WordPress, Shopify, WooCommerce, SE Ranking, Peec AI, Plausible, Trustpilot and Snowflake, receive the queries /Scale makes for you: your website address, pages and keywords, and the periods it asks figures for. They act under your own agreement with them. From Looker, /Scale imports the results of the Looks and dashboards in the folder you choose, as they are, apart from email addresses, which it removes: keep that folder to figures, without data about individual people. Google's PageSpeed and Chrome UX Report services receive the addresses of the pages that are measured.

A workspace in your own Google Cloud project

A customer can keep its workspace in a Google Cloud project of its own (Settings → Deployment). The workspace's content, imported figures, uploads, recordings and screenshots are then stored in that project's database and file storage, in the place the customer chose and under the customer's own agreement with Google. /Scale reads and writes them there with access the customer gives and can withdraw at any time. /Scale itself still runs in Belgium and works on the data there while it is in use. Accounts, memberships, the plan, invoices, model credit, the activity log (2.4) and server logs stay with us, and what a task needs still goes to the AI model providers above.

Website statistics

Google Ireland Ltd. provides Google Analytics for the website and the sign-in and sign-up pages (2.11) and processes those statistics on our behalf. It receives nothing from inside a workspace and is not a sub-processor for the data in customers' workspaces.

Who at /Scale can see what

The people who operate /Scale can see a list of all workspaces with name, website, owner's email address, plan, connected tools and last run. They can read the activity log (2.4): who opened which page and ran which action in a workspace, and when. They open a workspace's content only where that is needed for support you asked for, for security, or to fix a fault.

We do not sell personal data and do not pass it on for advertising. We disclose it to authorities only where the law obliges us to.

6. Outside the EU

Workspaces are stored in the European Union. A workspace that a customer keeps in its own Google Cloud project is stored where that customer chose. OpenAI and Anthropic process the data sent to their models in the United States. Google may process the website statistics there too. These transfers rest on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the Commission's standard contractual clauses. Write to us if you want a copy of the safeguards.

7. How long we keep it

There is no delete button for an account or a workspace yet. Write to hello@slashscale.com and we delete it within 30 days. Copies that the hosting provider keeps for recovery expire within a further 30 days.

8. Security

• All connections to /Scale are encrypted, and stored data is encrypted by the hosting provider.
• The sign-ins and keys for your connected tools are stored with an additional layer of encryption (AES-256-GCM) and are never shown again.
• Each workspace's data is kept apart and shown only to its signed-in members.
• There are no passwords to leak: sign-in is by single-use link or Google.
• /Scale reads from your tools and has no way to write to them.

No certification is claimed. If you believe you have found a security problem, write to hello@slashscale.com.

9. If /Scale reads your website

/Scale's programs fetch public web pages: mainly the websites of our customers, and now and then a public page of another site in a customer's market. They identify themselves as SlashScale-Crawler, SlashScale-Agent or SlashScale-Onboarding. They never sign in and never submit a form. SlashScale-WordPress and SlashScale-WooCommerce read only a WordPress site or WooCommerce shop whose owner connected it in /Scale (2.6), and sign in only with the application password or read-only key that owner gave them. From a page /Scale keeps technical facts, such as its title, description, headings, links and response, and sometimes a screenshot. If a public page contains personal data, for example an author's name, that data can be part of what is read. The basis is our customers' and our legitimate interest in analysing public websites (Article 6(1)(f) GDPR).

The crawler page says how to keep the crawler away from a site. You can also write to us and object.

10. Your rights

Under the GDPR you can:

• ask what data we hold about you and get a copy;
• have wrong data corrected;
• have your data deleted, or its use restricted;
• receive the data you gave us in a common, machine-readable format;
• object to processing that rests on a legitimate interest, for reasons arising from your situation;
• withdraw a consent at any time, with effect for the future.

Write to hello@slashscale.com. We answer within one month. If your request is about data in a company's workspace, we pass it to that company.

You can also complain to a data protection authority. The one responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

/Scale's AI ranks and prepares marketing work. It makes no decisions about people, and we make no decision about you by automated means alone.

11. Changes

We update this policy when /Scale or the law changes. The date at the top shows the current version. If a change affects how we use data you have already given us, we tell account holders by email before it takes effect.