Privacy Policy

This explains what data Scalerra processes, why, on what legal basis, and the controls you have over it.

Effective July 19, 2026

1. Who we are

Scalerra (operated by Scalerra Solutions, Serbia) is the data controller for the personal data described here. For any privacy or data-protection question, contact us at support@scalerra.com.

2. What we collect

We collect only what we need to run the product:

Account data — your name, work email, and authentication credentials (passwords are stored only as salted hashes; we never see them in plain text).
Identity fuel you provide — e.g. a CV/LinkedIn export, company URL, or portfolio you choose to add so the product can prepare for your meetings.
Work data you create — accounts, opportunities, stakeholders, meetings, and notes you enter or connect.
Connected sources you authorize — calendar, email, or CRM data, only after you explicitly grant access, and only to the scope you grant.
Limited technical data — session and security logs needed to keep the service running and safe.

We do notbuy contact lists, scrape personal data about private individuals, or build profiles of people from third-party data brokers. When you point Scalerra at a specific business contact's own public page to prepare, it may summarize a likely way to approach them — an editable suggestion you control, never a hidden dossier, and never sold or shared.

3. Why we process it (legal bases)

To provide the service you asked for — performance of a contract (Art. 6(1)(b) GDPR).
To keep it secure and prevent abuse — our legitimate interests (Art. 6(1)(f) GDPR).
With your consent — for connecting optional sources like calendar or email (Art. 6(1)(a) GDPR). You can withdraw consent at any time.

4. AI processing

Scalerra uses AI models to prepare insights and draft suggestions. Your content may be sent to model providers (OpenAI, Anthropic, Google) via the Vercel AI Gateway purely to generate your result. Your data is never used to train our models or any provider's foundation models. See our AI Use & Limitations page for detail on accuracy, oversight, and the EU AI Act.

5. Who can see your data

If you work solo, your workspace is yours alone. If you join a team, the output of your work becomes visible to your manager so they can help you win — your shared-deal work state, your drafts and briefs, your skills read, and the debrief and summary of your practice sessions. What a manager never sees is the process behind that output: the raw practice transcript, your private personality read, your own private notes, or any record of your activity, logins, or clicks. We never sell your data.

6. Subprocessors

We rely on a small set of vetted providers who process data on our behalf:

Vercel Inc. — Application hosting, edge network, deployment.
Supabase — Managed Postgres database, authentication, file storage.
Vercel AI Gateway — Routing prompts to underlying AI model providers.

7. Where data is processed

Processing and storage take place on the infrastructure of our vetted hosting providers, Vercel and Supabase. Where data is transferred outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.

8. How long we keep it

We keep your data for as long as your account is active. When you delete your account, we delete or irreversibly anonymize your personal data, except where we must retain limited records to meet legal obligations.

While your account is active, some data is additionally trimmed on a schedule:

Raw practice transcripts — removed after 6 months; the debrief conclusions you keep are retained.
Daily orientation lines — kept for 180 days.
Evidence signals — kept for 18 months (their influence on suggestions decays long before that).
Notifications you have read — removed after 90 days; unread notifications are kept.
Usage and audit records (AI usage metering, audit log) — kept for 365 days.

Deleting your account removes all of the above immediately — the schedules only apply to active accounts.

9. Your rights

You can access, correct, export, or delete your data, and object to or restrict certain processing. We provide in-product export and deletion tools, and you can reach us at support@scalerra.com. See Your GDPR Rights for the full list and how to exercise them.

10. Changes

If we make a material change, we will update this page and ask you to review and re-accept before you continue using the app.

This document is provided for transparency and is being finalized with legal counsel. It is not legal advice.

2. What we collect

We collect only what we need to run the product:

Account data — your name, work email, and authentication credentials (passwords are stored only as salted hashes; we never see them in plain text).

Identity fuel you provide — e.g. a CV/LinkedIn export, company URL, or portfolio you choose to add so the product can prepare for your meetings.

Work data you create — accounts, opportunities, stakeholders, meetings, and notes you enter or connect.

Connected sources you authorize — calendar, email, or CRM data, only after you explicitly grant access, and only to the scope you grant.

Limited technical data — session and security logs needed to keep the service running and safe.

3. Why we process it (legal bases)

To provide the service you asked for — performance of a contract (Art. 6(1)(b) GDPR).

To keep it secure and prevent abuse — our legitimate interests (Art. 6(1)(f) GDPR).

With your consent — for connecting optional sources like calendar or email (Art. 6(1)(a) GDPR). You can withdraw consent at any time.

4. AI processing

5. Who can see your data

8. How long we keep it

While your account is active, some data is additionally trimmed on a schedule:

Raw practice transcripts — removed after 6 months; the debrief conclusions you keep are retained.

Daily orientation lines — kept for 180 days.

Evidence signals — kept for 18 months (their influence on suggestions decays long before that).

Notifications you have read — removed after 90 days; unread notifications are kept.

Usage and audit records (AI usage metering, audit log) — kept for 365 days.

Deleting your account removes all of the above immediately — the schedules only apply to active accounts.