ScaleAxis
Log inBook audit

Legal

Privacy policy

Effective September 7, 2026 · Last updated September 7, 2026

1.1 This Privacy Policy describes how ScaleAxis LLC ("ScaleAxis") collects, uses, discloses, and protects personal information.

1.2 Two distinct roles. ScaleAxis operates in two capacities:

  • As a "Business" / "Controller" for personal information we collect directly through our marketing website (scaleaxis.ai), product website (app.scaleaxis.ai), sales process, support interactions, and from prospective and current Customers.
  • As a "Service Provider" / "Processor" for Customer Data processed on behalf of our Customers when they use the Service. Our Customers are the Controllers of that data, and our handling is governed by our Data Processing Addendum (Document 4). If you are an end-user, contact, or recipient whose data was uploaded by a Customer, please direct privacy requests to that Customer.

As of January 1, 2026, twenty US states have enacted comprehensive consumer privacy laws in effect or coming into effect during 2026: California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Delaware (DPDPA), Florida (FDBR), Indiana (ICDPA, effective Jan. 1, 2026), Iowa (ICDPA), Kentucky (KCDPA, effective Jan. 1, 2026), Maryland (MODPA, applicable Apr. 1, 2026), Minnesota (MCDPA), Montana (MCDPA), Nebraska (NDPA), New Hampshire (NHPA), New Jersey (NJDPA), Oregon (OCPA), Rhode Island (RIDTPPA, effective Jan. 1, 2026), Tennessee (TIPA), Texas (TDPSA), Utah (UCPA), and Virginia (VCDPA). We comply with all applicable provisions and provide the rights described below to consumers in those states. We also monitor and will update this Policy to reflect any subsequent state enactments (e.g., the Oklahoma Consumer Data Protection Act announced in 2025).

3.1 Information you provide: name, email, phone, business name, role, account credentials, billing information (handled by Stripe), support communications.

3.2 Information collected automatically: IP address, device and browser data, log data, cookies and similar trackers (see Cookie Policy), product-usage analytics.

3.3 Information from third parties: referrers, integration partners (e.g., GoHighLevel, HubSpot if Customer authorizes), enrichment providers.

3.4 AI prompts and outputs (when interacting with our marketing/sales chatbots or AI-assisted account flows).

3.5 No sensitive categories are knowingly collected through our marketing activities. We do not knowingly collect data of minors under 18.

We use personal information to: (a) provide, secure, operate, and improve the Service; (b) communicate about service, billing, and product updates; (c) market our products (subject to opt-out); (d) comply with legal obligations; (e) detect and prevent fraud, abuse, and security incidents; (f) for analytics and research (aggregated and de-identified where possible); and (g) establish, exercise, or defend legal claims.

We disclose personal information to Sub-processors (listed in Document 8): Vercel, Supabase, Stripe, Twilio, Resend, OpenRouter, Anthropic, Sentry, Upstash, and Cloudflare. Where Customer connects an integration, we also disclose to Google, Microsoft, or Zoom for that integration only. We may also disclose to professional advisors, in connection with corporate transactions, and as required by law or to respond to lawful process.

ScaleAxis does not sell personal information for money or other valuable consideration. ScaleAxis does not share personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. We have not engaged in such sale or sharing in the preceding twelve months and have no plans to do so.

We do not knowingly process sensitive personal information for purposes that require the right-to-limit notice under the CCPA/CPRA or sensitive-data consent under VCDPA/CPA/CTDPA/UCPA-style laws.

Subject to verification and applicable law, consumers in the states listed in Section 2 have the right to:

  • Access / Know what personal information we have collected.
  • Delete personal information (subject to legal-retention exceptions).
  • Correct inaccurate personal information.
  • Portability: receive personal information in a portable format.
  • Opt out of targeted advertising, sale, sharing, and certain profiling (we do not engage in these, but the right is preserved).
  • Limit use of sensitive personal information (we do not engage in qualifying uses).
  • Non-discrimination for exercising rights.
  • Appeal a denial (per VCDPA-model statutes).

How to exercise rights: email privacy@scaleaxis.ai. We will respond within 45 days (extendable by another 45 days where permitted), and we will verify your identity using information already in our possession.

Authorized agents. California residents may designate an authorized agent. We require written authorization signed by the consumer and verification of the consumer's identity directly with us, consistent with 11 CCR § 7063.

9. Global privacy control / opt-out preference signals

Effective January 1, 2026, the CCPA requires businesses to honor opt-out preference signals such as the Global Privacy Control ("GPC"). Even though we do not sell or share personal information for cross-context behavioral advertising, we recognize GPC signals received from a consumer's browser as a valid request to opt-out and will visibly indicate that the request was honored, consistent with the California Privacy Protection Agency's regulations effective Jan. 1, 2026.

The categories of personal information we collect, our purposes, our retention periods, and the categories of recipients are described in this Policy. The retention period for each category is the shorter of (a) the period necessary to provide the Service and any related legal/tax/audit/regulatory purpose, and (b) seven (7) years following the end of the customer relationship.

The Service is not directed to, and we do not knowingly collect personal information from, individuals under 18. If we learn we have collected such information, we will delete it.

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, multi-factor authentication for administrative access, and routine security reviews. No system is completely secure, and we make no guarantee that unauthorized access will never occur. For Customer Data, see the Technical and Organizational Measures schedule of the DPA.

The Service currently serves U.S. customers and processes data in the United States. As we expand, we will adopt the legal mechanisms required by applicable laws (such as Standard Contractual Clauses for EEA/UK transfers).

When you interact with AI Features (or with AI-assisted marketing/sales workflows), your prompts and the generated outputs are sent to Anthropic via API for inference. Customer Data is not used by ScaleAxis or by Anthropic to train any AI model. Anthropic's Commercial Terms state that "Anthropic may not train models on Customer Content from Services." See the AI / Automated Processing Disclosure (Document 10) for details.

See our Cookie Policy (Document 7).

By providing your mobile number and opting in, you consent to receive SMS messages from ScaleAxis OS or the business using ScaleAxis OS to contact you. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time and HELP for help. Mobile opt-in information and consent are not shared with third parties or affiliates for marketing or promotional purposes.

For incidents affecting California residents, we will notify affected residents within thirty (30) calendar days of discovery and the California Attorney General within fifteen (15) calendar days of notifying consumers if more than 500 California residents are affected, consistent with California SB-446 (effective Jan. 1, 2026). Notice in other jurisdictions will be in accordance with applicable law.

We will post material changes to this Policy with at least thirty (30) days' advance notice, except where a shorter period is required by law.