Privacy Policy

01Our role

• •Controller of account, authentication, billing, communication and website browsing data.
• •Processor of the data your organization sends or connects: code from authorized repositories, AI Workspace messages and files, and AI tool telemetry. In these cases we follow the instructions of your organization, which is the controller, and our contract with it.

02Data we process

• •Account and organization: name, work email, organization, role and preferences.
• •Authentication: credentials managed by Amazon Cognito and MFA factors. We do not store passwords.
• •Billing: data processed by Stripe. We never receive or store card numbers.
• •Usage and security: technical records, IP address, audit events and policy decisions.
• •Authorized repositories: code is cloned temporarily for analysis and deleted at the end; findings, file paths, lines and measurements remain.
• •AI Workspace: messages, files and responses, stored encrypted only when they are part of the history you keep; usage and cost of each call, without the content.
• •AI telemetry: counts, tokens and cost read from the sources your organization connects. Never prompts or responses.
• •Website: what you enter in contact forms.

03Purposes and legal bases

• •Providing the contracted service (performance of a contract): account, code analysis, AI Workspace, agents, compliance and support.
• •Security, fraud prevention and continuity (legitimate interest): technical records, audit and abuse protection.
• •Improving the product (legitimate interest): aggregated platform usage metrics, without customer content.
• •Legal and tax obligations (compliance with a legal obligation): billing and tax documents.
• •Product communications (legitimate interest or consent, as applicable), with an unsubscribe option in every message.

04Artificial intelligence

• •We do not use customer data to train ScaleQuality models.
• •Diagnosis and agents use Amazon Bedrock. The AI Workspace managed catalog is routed by OpenRouter to the provider that runs the selected model. Every call to that catalog forbids use of the data for training, and the organization's AI Protection rules apply before it reaches the provider; the provider's retention applies, always without training.
• •With your own connections, the provider acts under the contract between it and your organization.
• •Messages and attachments are encrypted on the server and accessible only to the person who created them, within the organization. The server processes the content to run the feature; this is not end-to-end encryption.
• •AI output may contain errors and should be reviewed by people before relevant use.

05Sharing

We share data only with the sub-processors listed in the Trust Center, to the extent needed to provide the service, and with authorities when the law requires it. We do not sell personal data.

06International transfer

ScaleQuality's infrastructure runs on AWS in us-east-1 (United States). AI inference takes place in the United States or in the model provider's region, as described in the Trust Center. Transfers rely on contractual clauses with each supplier, encryption in transit and at rest, and minimization of the data sent, under article 33 of Brazil's LGPD.

07Retention

• •Conversations and attachments: until you delete them. Deleting removes the content from active storage immediately.
• •Database backups: 7 days. They may contain rows already deleted, always encrypted, until they expire.
• •AI Workspace logs: 30 days, without message content.
• •Billing data: for the period required by law.
• •After cancellation, deletion from active storage and the keeping of legal records and backups follow the type of data and the request.

08Security

Encryption in transit and at rest, isolation by organization, role-based access control, MFA and an audit trail. The controls are described in detail in the Trust Center.

09Your rights

Under article 18 of the LGPD you may request confirmation and access, correction, anonymization, blocking or deletion, portability, information about sharing, withdrawal of consent and review of automated decisions. People in the European Union have equivalent rights under the GDPR.

Write to privacy@scalequality.io. When we act as processor, we forward the request to the controlling organization and support its response. You may also petition Brazil's National Data Protection Authority (ANPD).

10Cookies

We use essential cookies only: the session cookie, valid for 1 hour, and the language cookie, valid for 1 year. We do not use advertising cookies or third-party analytics tools. Contact forms hosted by Tally may use their own cookies.

11Children

ScaleQuality is a service for businesses and is not intended for anyone under 18.

12Contact and data protection officer

For privacy questions, data subject requests or to reach the data protection officer: privacy@scalequality.io. Postal address: ScaleQuality, Inc., 7345 W Sand Lake Rd, Suite 210, Orlando, FL 32819, United States. We handle requests within the applicable legal deadlines.

13Changes

We announce relevant changes by email or in the application before they take effect. The date of the latest review is at the top of this page.