Privacy Policy

1. Who we are

ScaleShift Agency is operated by [REVIEW: full legal entity name], a company incorporated in India (“we”, “us”). We take your privacy seriously and handle personal data in line with India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Information Technology Act, 2000.

2. What personal data we collect

In short, we collect:

• Your account details — name, work email, phone (if you provide it), and your role in your workspace.
• What you create in the app — leads, accounts, campaigns, notes, and similar workspace content.
• How you use the app — login and session information, and an activity log of actions taken in your workspace, kept for security.
• Anonymised usage analytics — only with your consent, to help us improve the product.

We don't intentionally collect sensitive personal data (financial account details, health information, and the like). If you upload such data as workspace content, you're responsible for having a lawful basis to do so.

3. Why we use your data

We use personal data to:

• run the service you signed up for and provide support;
• keep your account and our platform secure;
• send you product and marketing updates (only with your consent — you can unsubscribe any time);
• meet our legal and tax record-keeping obligations.

Where we rely on your consent (for analytics or marketing), you can withdraw it at any time from Settings → Privacy & Data.

4. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it, and then delete or anonymise it. Different data types have different retention periods (for example, billing records are kept longer to meet tax law). The full retention schedule is set out in our Data Processing Addendum, available on request (see section 9).

When you delete your account, we immediately anonymise your profile and revoke your sessions; a minimal record of the deletion is retained to meet our legal obligations.

5. Who we share your data with

We share personal data only with service providers who help us run the platform, strictly for that purpose and under written agreements. Our main providers are:

• Google Cloud Platform — hosting and database.
• Google Vertex AI — AI model inference (your inputs are not used to train Google's models).
• SendGrid — sending transactional and (with consent) marketing email.
• Sentry — error reporting, with personal-data scrubbing enabled.
• Google Analytics 4 — anonymised analytics, with your consent.

The exact data each provider processes, where it is stored, and our cross-border transfer safeguards are detailed in our Data Processing Addendum (section 9). We never sell your personal data.

6. Security

We protect your data with reasonable security practices, including encryption in transit and at rest, strict access controls, tenant-level data isolation, and secure password storage. If a personal data breach affects you, we will notify you and the Data Protection Board of India as required by law.

7. Children

The service is for businesses and is not intended for anyone under 18. We do not knowingly collect children's personal data.

8. Cookies

We use only the cookies needed to keep you signed in and protect the service, plus an analytics cookie that is set only with your consent. We don't use cookies for advertising.

9. Your rights

Under the DPDP Act, you can:

• access a summary of the data we hold about you;
• correct inaccurate data;
• delete your data and account;
• nominate someone to act for you if you can't;
• withdraw consent where we relied on it.

The fastest way to access, export, or delete your data is Settings → Privacy & Data. Business customers can request our full Data Processing Addendum (with detailed retention, sub-processor, and cross-border terms) by writing to privacy@scaleshift.in.

10. Grievance Officer

As required by the DPDP Act and the IT Act, our Grievance Officer is [REVIEW: full name], reachable at grievance@scaleshift.in. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you're not satisfied with our response, you may approach the Data Protection Board of India.

11. Changes to this policy

We may update this policy from time to time. We'll announce material changes in-app and by email at least 30 days before they take effect.