Try for free

Privacy Policy

Updated at October 31st, 2026

This Privacy Policy explains how Scalemate ("Scalemate," "we," "us," "our") handles personal data when you visit scalemate.co, use the Scalemate app, our API or other services (the "Service"), or contact us. Read it together with our Terms and Conditions.

1. Who we are

The controller of your personal data is Ruslan Dzhafarov, a sole trader registered in the Polish Central Register of Business Activity (CEIDG), NIP 1182269405, ul. Chlewińska 8a/6, 01-695 Warsaw, Poland, who operates Scalemate. You can reach us at info@scalemate.co.

2. Our two roles

  • Controller. We decide how to use data about you as our customer or website visitor: your account, billing, support, usage and marketing data. This policy describes that processing.
  • Processor. When you use the Service, you may put personal data into it, for example in your ad accounts, creatives, audiences or BigQuery results ("Customer Content" in our Terms). We process that data on your behalf under Section 8 of our Terms, and you are its controller. If you are a client or end user of one of our customers, contact that customer about your data.

3. What we collect

  • Account data: your name, email address, password (stored hashed), company and role, the answers you give when you sign up, and your name, email and profile ID if you sign in with Google or Facebook.
  • Billing data: billing name and email, company, address and VAT details, your plan, payments and invoices. Card details are handled by Paddle or Stripe. We don't store full card numbers.
  • Data from platforms you connect: for Meta, TikTok and other ad platforms, see Section 7. For Google Drive and BigQuery, see Section 6. For Slack, your workspace and channel identifiers and an access token.
  • Content you add: creatives, ad copy, templates, rules and their settings.
  • Usage and device data: IP address, browser and device details, the pages and features you use, recordings of how you use our website and app, error reports and server logs.
  • Communications: your support chats and emails, demo bookings and demo request forms.

4. Why we use it and our legal bases

  • To provide the Service: create and run your account, launch ads, run rules and integrations, send notifications and give support. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
  • Billing, invoicing, taxes and accounting. Legal basis: our contract (Article 6(1)(b)) and our legal obligations under tax and accounting law (Article 6(1)(c)).
  • Security and abuse prevention: protecting sign-up from bots and fake emails, detecting multiple Free accounts and other misuse, monitoring errors and keeping logs. Legal basis: our legitimate interest in keeping the Service secure and working (Article 6(1)(f)).
  • Analytics: understanding how our website and app are used, including session recordings, to improve them. Legal basis: our legitimate interest in improving the Service (Article 6(1)(f)), and your consent where the law requires it for cookies and similar technologies (Article 6(1)(a)).
  • Marketing: emails about Scalemate, and measuring and targeting our own ads on Meta, TikTok, X and Google, including audiences built from hashed email addresses. Legal basis: our legitimate interest in promoting the Service to businesses (Article 6(1)(f)), or your consent where the law requires it (Article 6(1)(a)). You can unsubscribe or object at any time.
  • Legal claims and compliance: establishing, exercising or defending legal claims and responding to lawful requests. Legal basis: our legitimate interest (Article 6(1)(f)) and our legal obligations (Article 6(1)(c)).

You need to give us your name and email address to create an account. Without them we can't provide the Service. Everything else is optional.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

5. AI

  • When you launch ads, we use the OpenAI API to group your creative files into ads. For this we send OpenAI only the file names and basic file details, such as image dimensions. We don't send the files themselves, ad performance data or your account details.
  • OpenAI doesn't use data sent through its API to train its models. We don't use your personal data or Customer Content to train AI models.
  • If you connect your own AI assistant to the Service, for example through our MCP server, the data it reads goes to that assistant's provider under your agreement with that provider.

6. Google user data

Scalemate's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Google Drive Integration

As part of our Services, Scalemate may integrate with Google Drive to allow you to upload and manage creative assets for your advertising campaigns. We access your Google Drive only with your permission and solely for the purposes of managing and launching ads on your behalf. We do not access or store any information from your Google Drive beyond what is necessary for these purposes. To group the files you select into ads, we may send their file names to OpenAI as described in Section 5. We never send the contents of your files to AI services. You can revoke our access at any time via your Google Account settings or via Scalemate's settings.

Google BigQuery Integration

If you connect Google BigQuery, Scalemate asks Google for read-only access to BigQuery and for your Google account's email address.

  • Data we access: the list of your Google Cloud projects, and the results of the SQL queries you write in Scalemate, which run in the Google Cloud project you choose. We never create, change or delete tables or data in your BigQuery.
  • How we use it: we store the results of the queries you set up and use them to evaluate your automation rules. Test runs in the query editor are shown to you and not stored. Your email address identifies the connection in Scalemate.
  • Sharing: we do not sell or transfer this data, do not use it, including your email address, for advertising, and do not send it to AI services or use it to train AI models. Only the providers that host Scalemate process it, to run the Service.
  • Protection: the data travels over encrypted connections (TLS) and is stored on our servers, with access limited to authorized staff.
  • Retention and deletion: stored query results are deleted automatically once they are older than the source's lookback window plus 7 days (at most 97 days), and immediately when you delete the source. Disconnecting BigQuery in Scalemate revokes our access with Google and deletes the stored access tokens and email address. Copies in server logs and backups are removed as those rotate. You can also revoke our access at any time in your Google Account settings.

Scalemate's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Data from Meta, TikTok and other ad platforms

When you connect an ad platform such as Meta (Facebook and Instagram) or TikTok, we receive an access token and the data you give us access to: your user ID and name on that platform, and the ad accounts, business managers, pages, pixels, audiences, campaigns, ads, creatives and performance data you manage there. We use this data only to provide the Service to you, for example to launch ads, run your rules and show you results. We don't use it for our own advertising and we don't sell it.

Deleting this data. You can disconnect a platform in Scalemate at any time, or remove Scalemate in your Facebook or TikTok settings. To have us delete the data we received from a platform, email info@scalemate.co from the email address on your Scalemate account. We delete it within 30 days of your request.

8. Who we share it with

We don't sell your personal data. We share it only with the following service providers, which process it on our behalf to run the Service, and with the others listed below.

  • DigitalOcean: hosting of our servers, database and file storage.
  • Vercel: hosting of our website and web app.
  • SendGrid (Twilio): sending account and notification emails.
  • Mixpanel: product analytics and session recordings on our website and app.
  • Rollbar: error monitoring.
  • Chatwoot: support chat.
  • Slack: internal notifications to our team about sign-ups and account activity, and delivering your rule notifications if you connect Slack.
  • OpenAI: grouping creative files by file name (Section 5).
  • Google: sign-in with Google, reCAPTCHA bot protection, Google Tag Manager and Google Analytics, Google Fonts, and Google Drive and BigQuery if you connect them.
  • Meta and TikTok: connecting your ad accounts and delivering ads on your instructions, and measuring our own ads through the Meta Pixel and TikTok Pixel.
  • X (Twitter): measuring our own ads through the X Pixel.
  • EmailListVerify: checking that email addresses entered in our demo request forms are valid.
  • Cal.com: booking demo calls.
  • Submit-Form: receiving demo request forms from our website.
  • Stripe: processing payments made directly to us.
  • Paddle: our reseller. When you buy through Paddle, Paddle sells you the subscription as merchant of record and processes your payment, billing and tax data as an independent controller under its own privacy policy.

We may also share personal data with our professional advisers, such as lawyers and accountants; with authorities, when the law requires it; and with a buyer or successor if we sell or reorganize our business, who will be bound by this policy.

9. Transfers outside the EEA

Some of our providers are located, or process data, outside the European Economic Area, for example in the United States. In those cases we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

10. How long we keep it

  • Account data and Customer Content: while your account exists. When you ask us to close your account, we delete it from our active systems within 30 days. Copies in backups are overwritten in the normal backup cycle.
  • Data from connected platforms: until you disconnect the platform or close your account. BigQuery data follows Section 6.
  • Invoices and accounting records: as long as tax and accounting law requires, generally 5 years from the end of the year of payment.
  • Server logs: about 7 days.
  • Analytics data, session recordings and error reports: for the retention periods set in Mixpanel and Rollbar.
  • Marketing data: until you unsubscribe or object.
  • Data needed for legal claims: until the claims are time-barred.

11. Your rights

Under the GDPR you have the right to:

  • access your personal data and get a copy of it;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict how we use your data;
  • receive your data in a portable format;
  • object to processing based on our legitimate interests, including at any time to direct marketing;
  • withdraw your consent at any time, without affecting processing before the withdrawal.

To use these rights, email info@scalemate.co from the email address on your account. We reply within one month. We may ask you to confirm your identity first.

You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl, or to the supervisory authority in the country where you live or work.

12. Cookies and similar technologies

  • Necessary: keeping you signed in, security and bot protection, checkout through Paddle or Stripe, and remembering your preferences.
  • Analytics: Mixpanel, including session recordings, and Google Analytics.
  • Advertising: the Meta Pixel, TikTok Pixel, X Pixel and Google tags, to measure our ads and show them to people who visited our website.
  • Support: the Chatwoot chat widget.

You can block or delete cookies in your browser settings. If you block necessary cookies, some parts of the Service, such as signing in, may stop working. We don't respond to Do Not Track signals.

13. Security

Data travels between your browser and our servers over encrypted connections (TLS), and access to personal data is limited to the people who need it to run the Service. Card payments are handled by Paddle and Stripe, which are PCI DSS certified. No system is completely secure, so we can't guarantee the absolute security of your data.

14. Children

The Service is for businesses and people aged 18 or over. We don't knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this Privacy Policy. If a change materially affects how we use your personal data, we will notify you by email or in the Service before it takes effect. The date at the top of this page shows the current version.

Contact Us

Scalemate is operated by Ruslan Dzhafarov, ul. Chlewińska 8a/6, 01-695 Warsaw, Poland, NIP 1182269405. If you have any questions, email us at info@scalemate.co.