Privacy Policy

This Policy covers information processed through scaleflows.ai, the ScaleFlows application, account registration and billing, support interactions, and connected services. It does not replace a merchant's privacy policy for its own customers, and it does not govern third-party services that act independently under their own notices.

3.1 Account and Business Information

• Name, email address, profile image, password and authentication information, timezone, and sign-in provider
• Business, store, workspace, role, team membership, and invitation information
• Subscription plan, billing address, tax information, payment-method metadata, invoices, discounts, and transaction status
• Support communications and feedback

Stripe processes payment card details used for ScaleFlows subscriptions. We receive payment-method and transaction information from Stripe but do not store complete card numbers.

3.2 Merchant Configuration and Content

• Customer service policies, AI instructions, autonomy and approval settings, handover rules, templates, signatures, tags, blocklists, and message flows
• Knowledge documents, text, URLs, product-specific context, internal notes, and other materials you upload or create
• Messages, drafts, attachments, translations, exports, and actions performed by users through the Service

3.3 Merchant Customer Data

Depending on the merchant's integrations and settings, we may process:

• Customer names, email addresses, postal addresses, language, identifiers, tags, marketing-consent status, and conversation history
• Support emails and messages, subject lines, message content, attachments, photos, videos, PDFs, delivery events, and metadata
• Orders, line items, products, prices, discounts, transactions, refunds, cancellations, replacements, fulfillments, tracking events, and payment-method context
• Shopify Payments and Stripe dispute information, evidence fields, status, deadlines, and outcomes
• Subscription and billing events relating to a merchant's customers where the merchant enables those integrations

3.4 Connected-Service and Credential Information

We receive store domains, account identifiers, access scopes, OAuth tokens, API credentials, webhook data, email routing details, and connection status from services you connect. Integration credentials are used to operate and maintain those connections.

3.5 Usage, Device, and Diagnostic Information

• IP address, browser and device type, operating system, timestamps, referring pages, approximate location, and session information
• Pages and features used, actions taken, plan, role, workspace identifiers, and product events
• Cookies, local storage, and similar identifiers used for authentication, preferences, analytics, support, and changelog functionality
• Application logs, API requests, performance traces, errors, crash details, and, where enabled, session replay diagnostics

We collect information directly from you, your employer or workspace owner, your device and browser, and the services you choose to connect. We also receive Merchant Customer Data from customers who contact a merchant, from ecommerce and payment platforms, email providers, tracking services, and other systems acting on the merchant's instructions.

• Create and secure accounts, authenticate users, manage roles, stores, subscriptions, and billing
• Receive, organize, draft, translate, send, and analyze customer service communications
• Retrieve and synchronize customer, order, product, fulfillment, tracking, payment, subscription, and dispute context
• Apply merchant-configured policies, approval rules, message flows, handovers, and permitted ecommerce actions
• Store and retrieve knowledge, attachments, templates, internal notes, and conversation history
• Provide operational analytics, reports, dispute tools, in-app support, onboarding, and product updates
• Monitor reliability, debug errors, measure feature usage, prevent abuse and fraud, and improve the Service
• Comply with law, respond to lawful requests, resolve disputes, and enforce our agreements

ScaleFlows uses AI and automated systems to classify and route messages, retrieve relevant knowledge, create and translate drafts, analyze text and certain attachments, identify order context, and support or carry out merchant-configured workflows.

Relevant information may be sent to AI providers to generate an output. This may include customer messages, conversation history, names and email addresses, order and product context, merchant policies and knowledge, internal notes, tracking or dispute context, and selected image or PDF attachments used for optical character recognition.

Depending on merchant settings, the Service may automatically send replies or flows and may propose or perform customer, order, refund, cancellation, replacement, address, or marketing-consent actions. Merchants control the applicable autonomy and approval settings and remain responsible for their use of these features.

We currently use Anthropic for language, classification, and vision features; OpenAI for knowledge-base embeddings; and, where configured, DeepL for translation. Providers and models may change as the Service develops.

Where UK GDPR, EU GDPR, or similar law applies and ScaleFlows acts as controller, we rely on one or more of the following legal bases:

• Contract: to create your account, provide the Service, process subscription payments, and respond to requested support
• Legitimate interests: to operate, secure, monitor, support, and improve our business and Service, prevent fraud, and communicate with business users, balanced against your rights
• Consent: where required for optional product-update subscriptions, non-essential technologies, or other activities for which we specifically request consent
• Legal obligation: to maintain required records, respond to lawful requests, and comply with tax, accounting, and other laws

Where we act as processor for Merchant Customer Data, the merchant determines the applicable lawful basis. We process that data under the merchant's instructions, our agreement with the merchant, and applicable law.

We do not sell personal information or Merchant Customer Data for money. We disclose information as needed to operate the Service in the following circumstances:

• Infrastructure and authentication: providers such as Supabase, Vercel, Railway, and Redis hosting providers
• AI and language services: Anthropic, OpenAI, and, where configured, DeepL
• Payments and commerce: Stripe, Shopify, and connected ecommerce or payment services
• Email and communications: Postmark, Google Gmail, Microsoft 365, merchant-selected SMTP providers, and notification channels
• Tracking and address services: providers such as 17TRACK, ParcelPanel, 57track, and Google Address Validation where the relevant feature is enabled
• Product support and analytics: Featurebase, Mixpanel, DataFast, Vercel Analytics and Speed Insights, Sentry, and optional scheduling providers such as Cal.com
• Professional advisers, auditors, insurers, authorities, and courts where reasonably necessary or legally required
• A buyer, investor, or successor in connection with a proposed or completed financing, merger, reorganization, acquisition, or asset transfer

Some providers act as our processors, while connected services may also act as independent controllers under their own privacy notices. The providers actually used depend on your settings, integrations, and the features available to you.

We use Featurebase for in-app support, feedback, and changelog features. Confirmed account users may be identified to Featurebase using their user ID, email address, name, and profile image and may be subscribed to product changelog communications. You can use available unsubscribe controls or contact us if you do not wish to receive optional product-update emails.

We retain information for as long as reasonably necessary to provide and secure the Service, maintain business and tax records, comply with law, resolve disputes, and enforce agreements. The period depends on the type of information, the merchant's instructions, account status, legal requirements, and operational or security needs.

Disconnecting Shopify, Stripe, an email provider, or another integration stops future access through that connection but does not automatically erase previously synchronized messages, orders, attachments, analytics, or other historical records.

An owner may permanently delete a store using available settings. This removes the store's workspace and associated tenant data from active systems. Limited information may remain in backups, security and audit logs, billing records, legal holds, or third-party systems until their applicable retention periods expire.

You may delete certain knowledge documents, avatars, and other content through the Service. Account-level access, correction, export, or deletion requests may be sent to privacy@scaleflows.ai. We will assess and respond to requests under applicable law and, for Merchant Customer Data, may refer the request to the relevant merchant.

ScaleFlows and its providers may process information in the United Kingdom, European Economic Area, United States, Singapore, and other countries where they operate. These countries may have different data protection laws from your country.

Where required, we use recognized transfer safeguards such as adequacy regulations or decisions, the UK International Data Transfer Addendum or Agreement, European Commission Standard Contractual Clauses, or another lawful transfer mechanism.

We use technical and organizational measures designed to protect information, including authenticated access, role-based workspace permissions, tenant data separation, private attachment storage, limited-duration signed attachment links, application-level encryption for stored integration credentials, request validation, and signed webhook verification where supported.

No online service can guarantee absolute security. You are responsible for protecting credentials, assigning appropriate user roles, securing connected accounts, and promptly reporting suspected unauthorized access.

Depending on your location and subject to legal exceptions, you may have rights to:

• Access personal information and receive information about its processing
• Correct inaccurate or incomplete information
• Request deletion, restriction, or portability
• Object to processing based on legitimate interests
• Withdraw consent without affecting earlier lawful processing
• Complain to a data protection authority

To exercise a right concerning information ScaleFlows controls, contact privacy@scaleflows.ai. We may need to verify your identity. If your request concerns data controlled by a merchant, contact that merchant first; we will assist it as required by our agreement and applicable law.

UK residents may complain to the Information Commissioner's Office at ico.org.uk. EEA residents may contact their local supervisory authority. You will not be discriminated against for exercising an applicable privacy right.

We use cookies, local storage, and similar technologies for authentication and security, interface preferences, product analytics, performance monitoring, error diagnostics, support, and changelog functionality. These technologies may be operated by providers including Supabase, Mixpanel, DataFast, Vercel, Sentry, and Featurebase.

Mixpanel may associate product events with your account, email, role, plan, and workspace when you are signed in. Sentry may receive diagnostic and interaction information, including session replay data where enabled. For more information and available controls, see our Cookie Policy.

The Service is intended for businesses and authorized users aged 18 or over. It is not directed to children, and we do not knowingly create accounts for children. Merchant Customer Data may incidentally concern a minor where a merchant lawfully provides customer support; the merchant remains responsible for the lawful collection and use of that data.

We may update this Policy to reflect changes to the Service, providers, law, or our data practices. We will publish the revised version and update the date above. Where required, we will provide additional notice or obtain consent before a material change takes effect.

For privacy questions, requests, or complaints, contact: