Legal

Privacy Policy

Effective date: September 24, 2026  ·  Company: Scalata AI Inc  ·  Website: https://scalata.ai

At Scalata AI Inc, your privacy is important to us. This Privacy Policy explains how we collect, use, and protect your information when you use our website (scalata.ai) and the Scalata AI app — on Android and on the web at chat.scalata.ai.

01Information we collect

On our website (scalata.ai)

Information you provide

When you fill out a form, request a demo, or contact us, we collect personal information such as:

  • Name
  • Email address
  • Phone number
  • Any other information you choose to share

Information we collect automatically

We use Google Analytics to collect anonymized data including:

  • Device type and browser
  • Pages visited and time spent on site
  • General location based on IP address

In the Scalata AI app (Android and chat.scalata.ai)

When you use the Scalata AI app, we collect:

  • Account information — your name, email address and user ID
  • Approximate location — the city and country derived from your IP address when you sign in, used for security and to show your list of active sessions
  • Your content — chats and messages, files you upload, your knowledge base, and photos you attach to chats
  • Finance watchlists you create
  • Data from connectors you choose to connect — for example Gmail or Outlook email, Google or Outlook calendar, Google Drive, Slack, Notion, CRMs, databases, brokerage accounts such as Robinhood or Webull, and WHOOP health and fitness data
  • Purchase history — records of your subscriptions and payments, processed by Stripe
  • In-app analytics — how you interact with the app's features
  • Diagnostics — device model, operating system version, app version, and, if you choose to send one, a screenshot attached to a shake-to-report bug report

We do not collect your device's advertising ID, we do not show ads, and we do not sell your personal data.

02How we use your information

We use your information to:

  • Respond to your inquiries
  • Send automated or personalized email replies
  • Analyze and improve our website performance
  • Maintain internal records
  • Provide the Scalata AI app — run your account, generate the assistant's responses, and carry out the requests you make, including on connected accounts
  • Process payments and keep billing and tax records
  • Keep your account secure — detect and prevent fraud and abuse, and show you where you are signed in
  • Diagnose faults and improve the app

03Scalata app: connected accounts and Google user data

This section applies to the Scalata assistant at chat.scalata.ai, where you can connect your own third-party accounts (Google Workspace, Microsoft 365, Slack, Jira, HubSpot, GitHub and others) so the assistant can work with your data on your behalf.

What we access

We access third-party data only through per-user authorization, only for the connectors you choose to connect, and only the items you ask the assistant to act on. From Google, with your permission, this may include:

  • Gmail — messages, attachments, labels and contacts
  • Google Drive — file metadata and file content
  • Google Calendar — calendars, events and availability
  • Google Cloud Storage — bucket and object listings, and object content
  • Your basic Google profile (name, email address) when you sign in with Google

How we use it

Solely to carry out the request you make in your session — for example summarising an email, finding a document, creating a calendar event, or uploading a file. We do not use it for advertising, profiling, credit or lending decisions, or resale.

What we share, and with whom

To fulfil your request, the relevant content may be processed by service providers acting on our behalf, under contract and solely on our instructions:

  • AI model providers — to generate the assistant's response to your request
  • Sandboxed code-execution providers — only when you ask the assistant to run code on your data
  • Cloud hosting and storage providers — to store your chats, uploaded files and knowledge-base content
  • Operational monitoring and diagnostics providers — to keep the service reliable and investigate faults

These providers are bound to use the data only to deliver their service to us, and do not use it to train their own models. This list reflects our current providers and may change as our services evolve; we will keep this page up to date. We do not sell your data, and we do not transfer it to data brokers, advertisers, or any party for advertising purposes.

How we protect it

  • Authorization tokens for connected accounts are encrypted at rest using AES-256-GCM
  • All traffic is served over HTTPS using TLS 1.2 or higher
  • Access is scoped per user — the assistant can never exceed the permissions your own account already holds
  • Each connector's individual operations can be reviewed, restricted or disabled from within the app

Retention and deletion

  • Connector tokens are retained until you disconnect that connector, which deletes them immediately
  • Chats, uploaded files and knowledge-base content are retained until you delete them, or delete your account
  • Deleting your account removes your chats, messages, uploaded files, knowledge-base content and connected accounts
  • You can revoke Scalata's access at any time from your Google Account permissions page

Limited Use and AI/ML

Scalata’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Workspace data is used only to provide the user-facing features you invoke, within your session. It is never used to develop, improve or train generalised AI or machine-learning models, and is never transferred to any service that would use it for such training.

04Service providers and recipients

We share personal data only with service providers that process it on our behalf, under contract and solely on our instructions:

  • AI model providers, to generate the assistant's responses — your messages, attachments and any connected-app content a reply needs are sent to the provider of the model in use: Google (Gemini), Anthropic (Claude) and OpenAI (GPT). They process it only to answer you and do not use it to train their models
  • Google Cloud — hosting and storage for our website and app
  • Stripe — payment processing
  • Resend — sending email
  • ipwho.is — looking up the approximate location of an IP address at sign-in
  • Sandboxed code-execution providers — only when you ask the assistant to run code
  • Google Analytics — website analytics, subject to your cookie choices

Your data is processed in the United States. We do not sell or rent your personal information, and we do not share it for advertising.

05Cookies

We use cookies to:

  • Improve your browsing experience
  • Track analytics
  • Remember preferences

You can control cookie settings through your browser, or through the cookie preferences on our site. See our Cookie Policy for details.

06Payments

Payments for Scalata AI subscriptions are processed by Stripe. We keep a record of your purchases, but we do not store your full card details.

07Data retention

We keep your account data for as long as your account is open. When you delete your account, we immediately delete your account, sessions, chats, messages, folders, shared chat links, uploaded files, knowledge base, finance watchlists and connected apps.

Some records are kept after deletion:

  • Security audit log — kept for up to 1 year to protect against fraud and abuse
  • Usage analytics — deleted automatically after 180 days
  • Payment records — held by Stripe for as long as tax and accounting law requires

Connector tokens are deleted as soon as you disconnect that connector.

For step-by-step instructions and the full list of what is deleted and kept, see Delete your account.

08Your rights

You have the right to:

  • Request access to your data
  • Ask us to correct or delete it
  • Withdraw your consent

In the Scalata AI app you can delete your account yourself from Settings → Account → Delete account, and export your chats from Settings.

To exercise any of your rights for the Scalata AI app, email support@scalata.ai from the email address registered to your account. For our website, email info@scalata.ai.

We respond to requests within one month.

09EU, EEA and UK users

If you are in the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing of your personal data.

Data controller

Scalata AI Inc, 295 Madison Avenue, New York, NY 10017, is the controller of your personal data. Contact: support@scalata.ai (Scalata AI app) or info@scalata.ai (website).

Legal bases

We rely on the following legal bases:

  • Contract — to provide the service you signed up for, including your account, chats, files and the assistant's responses
  • Legitimate interests — to keep the service secure, prevent fraud and abuse, and improve the service through analytics and diagnostics
  • Consent — for the optional connectors you choose to connect and for non-essential cookies. You can withdraw consent at any time by disconnecting a connector or changing your cookie preferences
  • Legal obligation — to keep tax and billing records

Your rights under the GDPR and UK GDPR

  • Access — get a copy of your personal data
  • Rectification — have inaccurate data corrected
  • Erasure — have your data deleted
  • Restriction — ask us to limit how we use your data
  • Portability — receive your data in a structured, machine-readable format
  • Objection — object to processing based on legitimate interests
  • Withdraw consent — at any time, without affecting processing that took place before
  • Not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you

To exercise these rights, contact us as described under Your rights. We respond within one month.

You also have the right to lodge a complaint with your local data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ico.org.uk).

International transfers

We process your data in the United States. Where we transfer personal data out of the EU, EEA or UK, we rely on the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Agreement or Addendum.

10Security

We use technical and organizational measures to protect your data and prevent unauthorized access.

11Updates to this policy

We may update this policy occasionally. Any changes will be reflected on this page with an updated date.

12Contact us

If you have any questions about this policy:

Scalata AI Inc
295 Madison Avenue, New York, NY 10017
Scalata AI app: support@scalata.ai
Website: info@scalata.ai
scalata.ai