Privacy Policy
1. Scope and who is responsible
This policy explains what personal data ScaleUp collects when you use scaleup.app and the ScaleUp application, why we collect it, who else processes it, how long we keep it, and what you can ask us to do with it.
ScaleUp, Business Bay, Dubai, United Arab Emirates, decides how and why your personal data is processed. That makes us the data controller under the EU and UK GDPR, the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), and the controller under UAE Federal Decree-Law No. 45 of 2021 (PDPL).
Separately, the material you upload about your own customers — for example a document containing customer names — is data you control. We process it only on your instructions, as your processor, under the licence in our Terms of Service.
2. What we collect
| Category | What it includes |
|---|---|
| Account and sign-in data | Your phone number or email address, your Google account identifier and verified email if you sign in with Google, one-time passcode attempt counts, session and refresh tokens, and the date, time and IP address at which you accepted our Terms. |
| Business profile | Business name, owner name, category and sub-categories, team size, location, website, language and description. |
| Brand voice and goals | The tone, style rules and marketing goals you select or write during onboarding. |
| Knowledge sources | Documents, links and FAQs you upload, the text extracted from them, and the numeric embeddings we derive so the agent can retrieve the right passage. These files are whatever you choose to upload — if they contain personal data about your customers or staff, we process that too. |
| Media | Images and other files you upload or generate, plus technical details such as dimensions, format, size and a content hash used to avoid storing duplicates. |
| Content | Post drafts, variants, edits, revision history, schedules, approval and rejection decisions, and publishing results. |
| Channel connections | For each Instagram or Facebook Page you connect: the account and Page identifiers, display name, the access token Meta issues (stored encrypted), token expiry, and connection health events. |
| Notification preferences | How you want to be told about pending approvals, and your approval-mode setting. |
| Audit records | An append-only log of significant actions — who connected a channel, edited a post, approved, rejected, scheduled or published it — with actor, timestamp and request identifier. |
| Technical and usage data | IP address, browser and device type, pages and features used, timestamps, error reports and performance traces. We use this to keep the Service secure and working. |
We do not ask for, and ask you not to upload, sensitive categories of data such as health, biometric, financial-account or government-identifier data. We do not collect payment card details, because the beta is free.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and secure your account, verify your phone or email with a passcode | Performance of a contract with you (GDPR Art. 6(1)(b)); necessary to provide a service you requested (DPDP s. 7 / consent); contractual necessity (PDPL Art. 4). |
| Run the Service: store your profile, generate drafts, schedule and publish approved posts | Performance of a contract (GDPR Art. 6(1)(b)); your consent given at sign-up (DPDP s. 6); contractual necessity (PDPL Art. 4). |
| Publish to Instagram or Facebook | Performance of a contract, on your explicit per-post approval. |
| Keep an audit record of approvals and publishing | Legitimate interests in accountability and dispute resolution (GDPR Art. 6(1)(f)); legal obligation where applicable. |
| Prevent abuse, fraud and unauthorised access; rate-limit and scan uploads for malware | Legitimate interests in security (GDPR Art. 6(1)(f)); permitted processing for security (DPDP / PDPL). |
| Diagnose faults and improve reliability using error reports and metrics | Legitimate interests in maintaining a working service. |
| Send service messages, such as approval reminders and security notices | Performance of a contract. |
| Send product news or marketing email | Your consent, which you can withdraw at any time. |
| Comply with law and respond to lawful requests | Legal obligation. |
Where we rely on consent, you can withdraw it at any time — see your rights. Withdrawing consent does not affect processing already carried out, and may mean we can no longer provide part of the Service.
4. How AI processing works
To draft a caption or generate an image, we send our AI providers a prompt built from your business profile, brand voice, the relevant passages retrieved from your knowledge base, and your instructions. The provider returns a draft to us, and we show it to you.
- Redaction is on by default. Our systems strip personal identifiers — email addresses, phone numbers, tokens, passcodes — from prompts and from logs before they leave our systems, unless there is a lawful reason to include them.
- No training on your data. Our AI providers are engaged under terms that permit them to process your content only to return a result to us, and that prohibit using it to train their models. We do not use your content to train models either.
- Retention at our providers is short. Prompts and outputs are not retained by them beyond what is needed to serve the request and meet their own abuse-monitoring obligations.
- You decide what is published. A draft only becomes a post when you approve it.
7. Where your data lives, and international transfers
Your workspace data — profile, documents, media, posts and channel tokens — is stored in AWS Asia Pacific (Mumbai) — ap-south-1, India. Media is delivered through a global content delivery network using signed, expiring URLs.
Some of our providers process data outside that region, as noted in the table above. Depending on where you are, that may be a cross-border transfer:
- From the EEA or UK: we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum or IDTA where applicable) with each recipient, together with encryption in transit and at rest and access controls. You can request a copy of the safeguards from privacy@scaleup.app.
- From India: transfers are made to countries not restricted by the Central Government under s. 16 of the DPDP Act, and we will stop transfers to any country later restricted.
- From the UAE: transfers are made either to jurisdictions recognised as providing adequate protection, or under contractual safeguards permitted by Articles 22 and 23 of the PDPL.
8. How long we keep it
We keep personal data only as long as we need it for the purpose it was collected, then delete it on the schedule below.
| Data | Retention |
|---|---|
| Account and sign-in records (email, phone, linked Google identity) | For as long as your account is open, then deleted within 30 days of closure |
| Business profile, brand voice, goals | Life of the workspace, then deleted within 30 days of closure |
| Knowledge documents and their extracted chunks and embeddings | Until you delete the document; chunks and embeddings are removed immediately and the stored file is purged within 30 days |
| Posts, drafts, revisions and media assets | Life of the workspace; deleted posts are purged within 30 days |
| Channel connections and access tokens | Until you disconnect the channel or the token is revoked, then deleted immediately |
| One-time passcode attempt counters | 7 days |
| Raw AI request/response logs (redacted copies are kept in the run record) | 30 days |
| Audit events (who approved, edited or published what) | 7 years — this is our record of your approvals and cannot be edited or deleted |
| Operational and error logs | Up to 90 days |
| Encrypted database backups | Up to 35 days, after which deleted data disappears from backups too |
Deleted records also persist for a short period in encrypted backups. Backups roll off on a 35-day cycle, after which the data is gone from them too.
9. How we protect it
- Encryption in transit (TLS) and at rest for databases, object storage and backups.
- Channel access tokens are encrypted with a dedicated managed key, separately from the rest of the database.
- Every workspace is isolated at the database level, with row-level security enforcing the boundary on every read and write, and per-workspace prefixes in object storage.
- Personal identifiers are stripped from application logs and AI prompts by default; secrets are never logged.
- Uploaded files are scanned for malware, and generated images are screened for unsafe content.
- Least-privilege access for our staff, secrets held in a managed secrets store, and an append-only audit trail of significant actions.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant regulator — the Data Protection Board of India, your EEA or UK supervisory authority, or the UAE Data Office — within the timeframes those laws require.
10. Your rights
Whichever law applies to you, you can ask us to do the following, free of charge, by emailing privacy@scaleup.app from your registered address:
- Access — get a copy of the personal data we hold about you, and a summary of how it is processed and who it has been shared with.
- Correct — have inaccurate or incomplete data corrected, completed or updated.
- Delete — have your data erased where we no longer need it, or where you withdraw the consent it rests on.
- Withdraw consent — as easily as you gave it, for anything based on consent.
- Object or restrict — object to processing based on legitimate interests, or ask us to pause processing while a dispute is resolved (EEA/UK and UAE).
- Portability — receive your data in a structured, commonly used, machine-readable format, or have it sent to another provider where technically feasible (EEA/UK and UAE).
- Nominate — nominate another individual to exercise your rights if you die or become incapacitated (DPDP Act, s. 14).
- Complain — see grievance redressal below.
We respond within 30 days. We may need to verify your identity first, and we may keep data we are legally required to retain — such as audit records of approvals — even after other data is deleted. Under the DPDP Act you are also expected to provide accurate information and not to file false or frivolous complaints.
11. Deleting your data and disconnecting Meta
To delete your ScaleUp workspace and everything in it:
- Email privacy@scaleup.app from your registered email address, or from the address linked to your account, with the subject “Delete my account”.
- We confirm your identity and the request, then queue the deletion.
- Your workspace content is deleted within 30 days, and disappears from encrypted backups within a further 35 days.
- We retain only audit records of approvals and publishing, and anything the law requires, as set out in the retention table above.
You can also delete individual items at any time in the app — knowledge documents, media and posts — without closing your account.
12. Children
ScaleUp is a business tool and is not directed at children. We do not knowingly collect personal data of anyone under 18. If you believe a child has provided us data, contact privacy@scaleup.app and we will delete it. Under the DPDP Act we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
13. Changes to this policy
We update this policy as the Service changes. The version and effective date at the top of this page tell you which version is current. For material changes — a new purpose, a new category of data, or a new class of recipient — we will notify you in the app or by email before the change takes effect, and where the law requires it we will ask for your consent again.
14. Contact and grievance redressal
For any privacy question or request, or to complain about how we handle your data, write to our Grievance Officer:
Grievance Officer
ScaleUp
Business Bay, Dubai, United Arab Emirates
grievance@scaleup.app
We acknowledge complaints within 7 days and aim to resolve them within 30 days, as required by the DPDP Act and the Information Technology (Intermediary Guidelines) Rules.
If you are not satisfied with our response, you can complain to the Data Protection Board of India, to your local supervisory authority in the EEA or UK, or to the UAE Data Office, depending on where you are.
Also read our Terms of Service.