Privacy policy
How Scale collects, uses and protects personal data. Version 2026-11-03 (3 November 2026).
1. Who is responsible
Each firm using Scale controls the project data it enters and decides who can see it. Scale's publishers process that data on the firm's behalf to run the service, and are responsible for account data (your name, email and sign-in details).
2. What we collect
- Account details: your name, work email and the workspaces you belong to. If you sign in with Google or Microsoft, we receive your name, email address and an account identifier from them — nothing else.
- Project data your firm enters: projects, reports, photos, drawings, documents, contacts of parties, contractors and workers.
- Mail, if you connect a mailbox: messages are read live from your mailbox to show them and build summaries. They are not stored by Scale. Your mailbox password or sign-in token is stored encrypted.
- Sign-in history: when you sign in or out, failed attempts and lockouts, with your network address and browser — so you and your firm can spot misuse. Your email is stored masked (r***@firm.com); after 90 days only a shortened address and the browser name remain.
- Activity and access logs: who changed which record and when, admin actions, exports, API calls and automated jobs. Logs never contain passwords, card numbers or secrets.
- Your consent: when you agreed to this notice and which version.
3. How we use it
Only to provide the service: signing you in, showing your firm's data to the people your firm allows, sending notices inside the app, and keeping the service secure. We do not sell personal data, show advertising, or use your data to train AI models. We collect only what each feature needs.
Legal basis: providing the service you or your firm signed up for (contract), keeping it secure (legitimate interest), records the law requires (legal obligation), and your consent to this notice. AI features are off by default: they send only the material you choose to the AI provider, and only where your firm's admins have switched them on.
4. Google user data
If you connect a Gmail or Google Workspace mailbox, Scale asks Google for your name, your email address and permission to read, send and manage mail in that mailbox. It uses that access only to show your mail inside Scale, send mail you write there, and sort your mail by project for your own Mail Summary. Messages are read live and not stored; the Mail Summary is worked out on Scale's server and no outside AI service sees your mail. The access token is stored encrypted and deleted when you disconnect the mailbox or delete your account. You can also remove access at any time from your Google Account (Security → Third-party connections).
Data from Google is never sold, used for advertising, used to train AI models, or read by people, except with your permission, for security, or where the law requires. Scale's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. How it is protected
- Data is stored in India (Mumbai) and sent only over encrypted connections. Pages are served through Cloudflare's network from the location nearest to you, which may be outside India; nothing is stored there apart from short-lived request logs.
- Each firm's data is kept separate by access rules in the database itself.
- Personal details such as phone numbers, emails, addresses, GSTIN and PAN are encrypted with each firm's own key.
- Passwords are stored only as one-way hashes. Two-step sign-in, automatic sign-out and account lockout are available.
6. Who else handles it
Service providers that run Scale under contract:
- Supabase — database, file storage and sign-in (Mumbai, India).
- Cloudflare — website hosting, delivery and protection (served from the nearest location; short-lived request logs only).
- Microsoft Azure — stores the service's own keys (Key Vault, Central India); no personal data.
- Google — receives what you send through the website's early-access and sales forms (our mailbox is hosted by Google).
- Razorpay — payments, for firms on a paid plan. Scale never sees or stores card numbers.
Only if you or your firm choose to use them:
- Google or Microsoft — if you sign in with them, or connect a Gmail or Outlook mailbox; your own mail provider if you connect another mailbox.
- The AI provider (currently Anthropic) — only where your firm has switched AI features on, and only the material you choose; processed outside India and not used to train models.
- Zoom, Google Meet or Microsoft Teams — if your firm schedules virtual meetings through them.
- Meta (WhatsApp) — if your firm links a WhatsApp number to file site messages.
- A GSTIN lookup service — if your firm switches on online GSTIN checks; it receives the GSTIN only.
7. How long we keep it
Only as long as needed. A clean-up runs every night:
| Data | Kept for | Then |
|---|---|---|
| Notifications | 6 months (your firm can change this) | deleted |
| AI engineer conversations | 1 year (your firm can change this) | deleted |
| Worker identity after a project is closed | 3 years (your firm can change this) | name, phone and ID document removed; attendance totals kept |
| Sign-in history | 1 year | deleted; after 90 days only a shortened network address and the browser name are kept |
| API call log | 90 days | deleted |
| Data access log (exports, automations, AI assistant) | 2 years | deleted |
| Expired or accepted invitations | 30 days | deleted |
| Encrypted database backups | 30 days | deleted |
| Workspace exports | 7 days | deleted |
| A deleted workspace | 30 days after the owner asks | everything deleted, including files |
| Activity log | 7 years (your firm can set 1–7) | deleted |
| Your account | until you delete it | deleted immediately when you ask |
8. Your rights
Most of these you can do yourself, any time, under Your account → Privacy:
- See and take your data: download everything Scale holds about you as one file.
- Delete your account: your account and personal data are deleted straight away; records you created for a firm stay with the firm without your name.
- Correct your details: in your profile, or ask your firm.
- Withdraw consent: by deleting your account; your firm's admins can switch AI features off at any time.
For project data (for example, as a worker, client or contractor), contact the firm first, as it controls that data; firms can export, correct or erase it. You may also nominate someone to act for you. For anything else, or to raise a grievance, write to us at the address below. We respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India (or, in the EU, your data protection authority).
9. Cookies
Only what the service needs: cookies that keep you signed in (and sign you out after inactivity), remember that you agreed to this notice, and remember your language. No advertising, analytics or tracking cookies, so there is nothing to opt out of.
10. Changes to this notice
When this notice changes in a way that matters, you'll be shown the new version and asked to agree before you continue.
Privacy and grievance contact: [email protected] · See also Acceptable use & intellectual property