Privacy Policy

1. Who we are

Scalephant is a marketing automation platform operated from the European Union. For the personal data in your account, we are the data controller.

For privacy matters, write to support@scalephant.io. We answer within 30 days.

2. What we collect about you

Account data: your e-mail address, name, language, password (stored only as an argon2id hash), and two-factor secret if you turn two-factor authentication on. We need this to give you an account, so the legal basis is performance of our contract with you, Article 6(1)(b) GDPR.

Organisation data: the organisations you belong to, your role in each, and invitations you send or receive. Same legal basis.

Billing data: your Stripe customer and subscription identifiers, your plan, your credit balance and the ledger of credits granted and used. Payment processing is handled entirely by Stripe. We never see or store card numbers.

Usage and audit records: sign-ins, security changes, administrative actions, and every action taken through the service — by you, by an API key you created, or by the platform's own automation — with timestamps and the originating IP address. We keep these to run the service securely and to be able to explain what happened to an account and to an ad budget, which is our legitimate interest, Article 6(1)(f) GDPR.

Technical logs: request metadata such as the time, the route, the response status and a correlation identifier, plus errors. Same legal basis.

3. What we process on your behalf

When you connect an advertising account and build campaigns, we process data on your instructions as your processor. You remain the controller of it, and of the relationship with the advertising platform. This is what that covers:

We use your organisation's identifiable campaign data to provide the service on your instructions, not as another customer's campaign material, and we do not sell it. The shared-learning feature described in the Terms may use only genuinely anonymous general aggregate patterns to improve advertising optimization for all users, without a separate participation setting. The service automatically refreshes anonymous aggregate patterns in separate observation windows when contributor and dominance safeguards pass; insufficient data produces no shared result. No raw customer material or individual performance figures are included. Personal source data and the processing needed to anonymize it remain subject to the GDPR; accepting the Terms does not by itself establish a legal basis for every use of personal data. Account, authentication, billing and operational source data are not anonymous merely because a shared pattern omits identifiers.

• Advertising account connections: the access and refresh tokens Google and Meta issue when you authorise us, the account identifiers, and the scopes granted. Tokens are encrypted at rest with a key held outside the database and are never shown back to you.
• Campaign data: your products and offers, targeting, budgets, ad copy, the ready-made ads, logo and images you add yourself and the crops you choose for them, images and video we generate, and the campaigns, ad sets and ads created from them at the platforms.
• Performance data: impressions, clicks, spend, conversions and the other figures the platforms report, synchronised hourly and kept per day per campaign.
• Conversion data from your website, if you install our tracking snippet: described in section 4.
• Agent API keys: if you issue one, we store only a SHA-256 hash of it and the scopes you granted. The key itself is shown once, at creation, and cannot be recovered afterwards.

4. Your website's visitors

If you install the Scalephant tracking snippet on your own website, it records a visit and a conversion so that your advertising can be measured. For that data you are the controller and we are your processor. Telling your visitors about it, and obtaining consent where the law requires it, is your responsibility, not ours — you decide what the snippet is installed on.

The snippet follows the consent banner your site runs: it reads the visitor's choice from Google Consent Mode, the IAB Transparency and Consent Framework, Cookiebot or CookieYes. Where the visitor has not agreed to advertising storage, the snippet fires no advertising pixel, and we keep the conversion only as a count: without the visitor identifier, without the click identifiers, and without passing it to any advertising platform. A visitor whose browser is set to a European time zone is treated the same way when your site has no consent banner we can read. The consent signals are passed to Google with each conversion we send there.

The snippet collects: a random visitor identifier it stores in the browser's local storage, the page address, the campaign parameters in the link the visitor arrived through (utm_source, utm_medium, utm_campaign, utm_content) and the advertising click identifiers (gclid, wbraid, gbraid, fbclid), the event type, and where you report one, the order value and currency. Our server additionally records the IP address and browser user agent of the request.

Where the visitor's consent allows it, the snippet also reads the e-mail address typed into a form on your site and turns it into a one-way SHA-256 hash in the visitor's browser; the address itself never leaves the page. If your own server reports a conversion, it may send the customer's e-mail address and telephone number, which our server hashes the moment they arrive and never stores in readable form. We pass these hashes only to Google, for enhanced conversions, and only for a Google Ads account whose owner has accepted Google's customer data terms.

It does not collect names, readable e-mail addresses or telephone numbers, other form contents or page contents, and it never reads a cookie set by anyone else; it reads the visitor's consent choice only through the consent banner's own interface. The visitor identifier is random: it is not derived from anything about the person, and it is not shared between websites.

• The visitor identifier and the events attached to it: kept as part of your conversion records, see section 12.
• The IP address and user agent: kept only on the delivery row for a conversion that is on its way to Meta, and erased as soon as that delivery succeeds, is refused for good, or expires — seven days at the outside.
• The e-mail and telephone hashes: kept only on the delivery row for a conversion that is on its way to Google, and erased in the same way — seven days at the outside.
• Attribution diagnostics, which record that a click identifier was missing rather than what it was: 30 days.
• Conversion candidates, the suggestions the settings page makes about which page counts as a conversion: 30 days.

5. What we send to the advertising platforms

Google and Meta are not our processors. They are independent controllers with their own terms and their own privacy policies, and your relationship with them is your own. We send them what your campaigns need in order to run, on your instruction.

To Meta's Conversions API, for a conversion you have asked to forward: the event name and time, an event identifier used to deduplicate it against the browser pixel's report, the page address, the order value and currency where you report one, the click identifier from the ad, and the visitor's IP address and browser user agent. Meta requires the last two; without one of them it refuses the event. To Google Ads: the conversion time, an order identifier, the value and currency, exactly one click identifier, the visitor's consent choices, and, for enhanced conversions where section 4 allows it, the SHA-256 hashes of the e-mail address and telephone number. Google receives no IP address and no user agent from us.

Apart from those hashes, which go only to Google and only for a Google Ads account whose owner has accepted Google's customer data terms, we never send an advertising platform a customer list, an e-mail address, a telephone number, or any other contact detail. Readable contact details never leave our service.

6. Google user data

When you connect a Google Ads account, you sign in with Google and grant Scalephant three permissions. Google Ads (adwords) lets us create and manage the campaigns you ask for and read how they perform. Data Manager (datamanager) lets us send your website's conversions to a conversion action in that same Google Ads account, so that Google can measure and optimise your campaigns. Your e-mail address is used only to show which Google account is connected.

Through Data Manager we send only what section 5 lists for Google: the conversion time, an order identifier, the value and currency, exactly one click identifier, the visitor's consent choices and, for enhanced conversions, the SHA-256 hashes of the e-mail address and telephone number, and only to the accounts you have connected. We do not upload customer lists or readable e-mail addresses or telephone numbers, and we do not read data back through that permission.

We use data received from Google only to provide the features you see in Scalephant. We do not sell it, do not use it for advertising other than your own campaigns, and do not use it to develop or train generalised AI or machine-learning models. Nobody at Scalephant reads it except with your permission, for security, to comply with the law, or as aggregated and anonymised data for our internal operations.

Who we share Google user data with. We share, transfer or disclose data received from Google only with the following, and only to provide the features you use: Google itself, because campaign changes go to your Google Ads account and conversions go to its conversion action; the other members of your Scalephant organisation, who see the same campaigns; Railway, our hosting provider, which stores the encrypted connection tokens and campaign data for us in the EU; the AI providers in section 8 (Anthropic, OpenAI and Google's Gemini), which may receive a campaign's aggregate performance totals such as impressions, clicks, cost and conversions when we write ads or explain results, as our processors whose business API terms do not allow them to train their models on it; and public authorities, where the law requires it. Click identifiers, order identifiers and other conversion data are never sent to an AI provider. We share Google user data with no one else.

Scalephant's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove the connection at any time on the Ad accounts page in Scalephant, which deletes the stored tokens, or in your Google Account's third-party access settings.

7. Retargeting audiences

Where you turn retargeting on, we ask the platform to create an audience of people who have visited your site, defined by a rule — the pages visited and a look-back window — and the platform builds it from its own pixel data. We name the audience, set its rule and its retention window, and attach it to a campaign.

We do not upload members to it. Nobody's e-mail address, hashed or otherwise, is sent from Scalephant to an advertising platform.

8. Artificial intelligence

We use Anthropic, OpenAI and Google's Gemini through their business APIs to write ad copy, generate images and video scripts, research a market, and explain what your campaigns are doing. They act as our processors for that.

What reaches them is your business content and aggregate numbers: product and offer descriptions, brand voice, existing ad copy, the campaign's performance totals, and the research questions asked about a market. No visitor identifier, no IP address, no conversion event and no contact detail is ever included in a prompt.

If you bring your own ads and images, two more things can reach these providers. They are sent only when you have chosen that Scalephant complements your own content, or when you ask for new content based on your own. Your own ads are sent to the text model as examples of your tone, marked as material to learn from rather than instructions. Your own images are sent only if an owner or admin of your organisation has allowed it in the service. Then one of your reviewed images in the campaign is sent to OpenAI's image model as a reference when we make new images. The permission covers OpenAI only, can be withdrawn at any time, and every change to it is recorded in the audit log. Without it, images are made from your product description alone. Automatic optimisation never sends your own ads or images. Anything made from your own material stays a draft until you have reviewed it.

Everything an AI writes is a draft. Copy is validated against the platforms' rules and against a claim check before it can run, and the service records which model produced what, so an ad can always be traced back.

9. Cookies

We set one cookie on this site: the session cookie scalephant.session_token, which keeps you signed in. It is httpOnly, Secure and SameSite=strict, and it is strictly necessary, so it needs no consent. Sessions last seven days and end after 24 hours of inactivity.

Your language choice is kept in your browser's local storage, not in a cookie.

We do not use analytics, advertising or tracking cookies on this site. If that ever changes we will ask for your consent first. The tracking snippet described in section 4 runs on your website, not on this one, and sets no cookie there either.

10. Who processes data on our behalf

We use a small number of processors, each under a data processing agreement:

The current list, with what each one processes and where, is maintained at scalephant.io/subprocessors. We announce a new processor there before it starts processing.

• Railway (hosting, application servers, PostgreSQL, Redis and the object storage bucket where creatives are kept). Data is stored in the EU, in the Amsterdam region.
• Resend (transactional e-mail: confirmations, password resets, security notices, billing notices).
• Stripe (payments and subscription management).
• Anthropic (text generation for ad copy, analysis and reports).
• OpenAI (text generation, image generation, web research about a market, and, with your permission, using your own images as references).
• Google LLC, for the Gemini API (text and image generation). This is separate from Google Ads, which is not our processor — see section 5.

11. International transfers

Your account data, your campaign data and your conversion records are stored in the European Union. Where a processor's support or infrastructure reaches outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses.

Three kinds of processing leave the EEA in the ordinary course and are worth naming: the AI providers in section 8, all of which are United States companies; the conversions forwarded to Meta and Google in section 5; and the advertising platforms themselves, which is inherent in advertising on them. Each rests on the Standard Contractual Clauses, and for transfers to the United States, on the EU-US Data Privacy Framework where the recipient is certified under it.

12. How long we keep it

• Account and organisation data: for as long as your account exists, then deleted when you delete the account.
• Deletion requests: scheduled 24 hours ahead so you can cancel, then carried out.
• Data exports: the file you request is available for seven days, then removed.
• Advertising account tokens: until you disconnect the account or delete the organisation, whichever comes first.
• Campaign timeline events: 13 months. The events that record money moving or a platform's answer: 25 months.
• Daily performance figures and conversion events: 25 months, dropped a month at a time.
• A conversion's IP address and user agent: until the delivery to Meta finishes, seven days at the outside.
• Attribution diagnostics and conversion candidates: 30 days.
• Audit and security records: 24 months.
• Billing records: seven years, as EU accounting law requires.
• The ads, logo and images you add yourself: at most for as long as the organisation exists. When the organisation is deleted with your account, its stored files, such as images and videos, are deleted too.
• Genuinely anonymous general aggregate patterns created under the shared-learning policy may be retained after account deletion. This does not extend retention of identifiable source data.

13. Your rights

Under the GDPR you can ask for access to your data, correct it, have it erased, take it elsewhere, restrict or object to processing, and withdraw consent where processing rests on consent.

Two of these you can exercise yourself, immediately: Settings → Privacy exports everything we hold about you as a JSON file, and the same page schedules the deletion of your account. Everything else: write to support@scalephant.io and we will answer within 30 days.

If you are a visitor to a website that has our snippet installed, the controller of that data is the website's operator, not us. Write to them; if you write to us instead we will pass the request on and tell you we have.

14. Security

Passwords are hashed with argon2id. Two-factor secrets, recovery codes and advertising platform tokens are stored encrypted with a key held outside the database. API keys are stored only as hashes. Traffic runs over TLS.

Every organisation's rows are isolated in the database by row-level security, so a query can only ever see the organisation it is scoped to. Administrative actions by our staff require two-factor authentication and a fresh re-entry of credentials, and they are written to the audit log.

If you find a vulnerability, please report it to support@scalephant.io.

15. Children

Scalephant is a business service and is not directed at children. We do not knowingly collect data from anyone under 18.

16. Changes

We will announce significant changes by e-mail or in the product. The date at the top always reflects the version you are reading.

17. Contact

support@scalephant.io. We answer within 30 days.