Privacy Policy

This explains what data Scalerra processes, why, on what legal basis, and the controls you have over it.

Effective October 9, 2026

1. Who we are

Scalerra (operated by Scalerra Solutions, Serbia) is the data controller for the personal data described here. For any privacy or data-protection question, contact us at privacy@scalerra.ai.

2. What we collect

We collect only what we need to run the product:

Account data — your name, work email, and authentication credentials (passwords are stored only as salted hashes; we never see them in plain text).
Identity fuel you provide — e.g. a CV/LinkedIn export, company URL, or portfolio you choose to add so the product can prepare for your meetings.
Work data you create — accounts, opportunities, stakeholders, meetings, and notes you enter or connect.
Connected sources you authorize — calendar, email, or CRM data, only after you explicitly grant access, and only to the scope you grant.
Limited technical data — session and security logs needed to keep the service running and safe.
Contact-form enquiries — the name, work email, company and message you send us through the public contact form, with the page it was sent from. Stored only with your tick on that form, read only by the Scalerra team, and used only to reply.

We do not buy contact lists, scrape personal data about private individuals, or build profiles of people from third-party data brokers. When you point Scalerra at a specific business contact's own public page to prepare, it may summarize a likely way to approach them — an editable suggestion you control, never a hidden dossier, and never sold or shared.

3. Why we process it (legal bases)

To provide the service you asked for — performance of a contract (Art. 6(1)(b) GDPR).
To keep it secure and prevent abuse — our legitimate interests (Art. 6(1)(f) GDPR).
With your consent — for connecting optional sources like calendar or email (Art. 6(1)(a) GDPR). You can withdraw consent at any time.

4. AI processing

Scalerra uses AI models to prepare insights and draft suggestions. Your content may be sent to model providers (OpenAI, Anthropic, Google) via the Vercel AI Gateway purely to generate your result. Your data is never used to train our models or any provider's foundation models. See our AI Use & Limitations page for detail on accuracy, oversight, and the EU AI Act.

5. Who can see your data

If you work solo, your workspace is yours alone. If you join a team, the state of your work becomes visible to your manager so they can help you win — the shared deals you are working, how far each has moved, how many messages or briefs you have prepared and when, the titles of documents you have shared, and your readiness per product. What a manager never sees is the material behind that state: the text you wrote, pasted or had drafted, the body of a brief or proposal, the raw practice transcript or its summary, your private personality read, your own private notes, or any record of your activity, logins, or clicks. We never sell your data.

6. Subprocessors

We rely on a small set of vetted providers who process data on our behalf:

Vercel Inc. — Application hosting, edge network, deployment.
Supabase — Managed Postgres database, authentication, file storage.
Vercel AI Gateway — Routing prompts to underlying AI model providers.
Cloudflare, Inc. — Bot protection (Turnstile) on the public sign-in and contact forms.
Upstash — Rate limiting, AI usage gating, and security telemetry (Redis).
PostHog — Product analytics — a pseudonymous account identifier and low-cardinality funnel events; no free text and no customer records.
Resend — Transactional email delivery (the daily brief and contact notifications) — recipient address and message body.
Apollo.io — Company (firmographic) search for prospecting — company criteria only, never a person's details.
Tavily — Public news search about the companies in your book — a company name or website, nothing about a person.
Serper — Public news search about the companies in your book (alternative provider) — a company name or website.

7. Where data is processed

Processing and storage take place on the infrastructure of our vetted hosting providers, Vercel and Supabase. Where data is transferred outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.

8. How long we keep it

We keep your data for as long as your account is active. When you delete your account, we delete or irreversibly anonymize your personal data, except where we must retain limited records to meet legal obligations.

While your account is active, some data is additionally trimmed on a schedule:

Raw practice transcripts — removed after 6 months; the debrief conclusions you keep are retained.
Daily orientation lines — kept for 180 days.
Evidence signals — kept for 18 months (their influence on suggestions decays long before that).
Notifications you have read — removed after 90 days; unread notifications are kept.
Usage and audit records (AI usage metering, audit log) — kept for 365 days.

Deleting your account removes all of the above immediately — the schedules only apply to active accounts.

Enquiries sent through the public contact form are kept while we handle them and for 24 months after they are closed, then deleted — whether or not you ever open an account.

9. Your rights

You can access, correct, export, or delete your data, and object to or restrict certain processing. We provide in-product export and deletion tools, and you can reach us at privacy@scalerra.ai. See Your GDPR Rights for the full list and how to exercise them.

10. Changes

If we make a material change, we will update this page and ask you to review and re-accept before you continue using the app.

This document is provided for transparency and is being finalized with legal counsel. It is not legal advice.

2. What we collect

We collect only what we need to run the product:

Account data — your name, work email, and authentication credentials (passwords are stored only as salted hashes; we never see them in plain text).

Identity fuel you provide — e.g. a CV/LinkedIn export, company URL, or portfolio you choose to add so the product can prepare for your meetings.

Work data you create — accounts, opportunities, stakeholders, meetings, and notes you enter or connect.

Connected sources you authorize — calendar, email, or CRM data, only after you explicitly grant access, and only to the scope you grant.

Limited technical data — session and security logs needed to keep the service running and safe.

Contact-form enquiries — the name, work email, company and message you send us through the public contact form, with the page it was sent from. Stored only with your tick on that form, read only by the Scalerra team, and used only to reply.

3. Why we process it (legal bases)

To provide the service you asked for — performance of a contract (Art. 6(1)(b) GDPR).

To keep it secure and prevent abuse — our legitimate interests (Art. 6(1)(f) GDPR).

With your consent — for connecting optional sources like calendar or email (Art. 6(1)(a) GDPR). You can withdraw consent at any time.

4. AI processing

5. Who can see your data

6. Subprocessors

We rely on a small set of vetted providers who process data on our behalf:

Vercel Inc. — Application hosting, edge network, deployment.

Supabase — Managed Postgres database, authentication, file storage.

Vercel AI Gateway — Routing prompts to underlying AI model providers.

Cloudflare, Inc. — Bot protection (Turnstile) on the public sign-in and contact forms.

Upstash — Rate limiting, AI usage gating, and security telemetry (Redis).

PostHog — Product analytics — a pseudonymous account identifier and low-cardinality funnel events; no free text and no customer records.

Resend — Transactional email delivery (the daily brief and contact notifications) — recipient address and message body.

Apollo.io — Company (firmographic) search for prospecting — company criteria only, never a person's details.

Tavily — Public news search about the companies in your book — a company name or website, nothing about a person.

Serper — Public news search about the companies in your book (alternative provider) — a company name or website.

8. How long we keep it

While your account is active, some data is additionally trimmed on a schedule:

Raw practice transcripts — removed after 6 months; the debrief conclusions you keep are retained.

Daily orientation lines — kept for 180 days.

Evidence signals — kept for 18 months (their influence on suggestions decays long before that).

Notifications you have read — removed after 90 days; unread notifications are kept.

Usage and audit records (AI usage metering, audit log) — kept for 365 days.

Deleting your account removes all of the above immediately — the schedules only apply to active accounts.

Enquiries sent through the public contact form are kept while we handle them and for 24 months after they are closed, then deleted — whether or not you ever open an account.