Privacy Policy

Scope and Roles

This Policy applies to information collected through the Services where we act as a data controller (or "business" under some U.S. privacy laws). For example, we act as a controller for affiliate enrollment, attribution, commission calculations, and payout administration.

This Policy does not apply to third-party websites, applications, or services that you may access through the Services (for example, Stripe). Those third parties process information under their own terms and privacy policies.

Information We Collect

Information you provide

• Account information: email address, authentication credentials, and optional profile details (e.g., name, company, website).
• Affiliate program information: affiliate code, referral settings you configure, eligibility status, and communications with us.
• Support & communications: information you include when contacting support.

Information collected automatically

• Usage and log data: IP address, user agent, device/browser metadata, pages viewed, timestamps, referring/exit URLs, and interactions with the Services.
• Referral and attribution data: referral codes, landing pages, timestamps, and attribution tokens/cookies used to calculate conversions and commissions (see “Cookies and Referral Tracking” below).
• Security data: signals used to prevent fraud, abuse, and unauthorized access (e.g., suspicious login patterns).

Information from third parties

• Supabase: authentication and database services for account creation, sessions, and core product data.
• Stripe (Connect payouts): payout infrastructure. Stripe receives identity and tax onboarding details directly in its own flows.
• Google OAuth (sign-in): if you choose to sign in with Google, we receive basic profile details (such as your email address and name) as permitted by your Google account settings.
• Cloudflare Turnstile: bot detection on sign-in and sign-up forms. Cloudflare processes IP/device signals and returns a verification token to us.
• Google Analytics (public pages only): we may use Google Analytics 4 on our public-facing marketing pages to measure site performance and engagement (see details below).

Stripe Connect and Payout Information

If you participate in our affiliate program, payouts are handled through Stripe Connect. Stripe manages identity verification and tax onboarding in its own flows.

• We may store limited connected account metadata such as your Stripe connected account ID, onboarding status, payout eligibility, payout amounts, and transfer/payout identifiers necessary to administer commissions and payouts.
• We do not collect or store Social Security numbers, tax IDs, or verification documents in our application. Those are handled by Stripe.

Stripe processes data under its own policies. See Stripe's Privacy Policy.

Cookies and Referral Tracking

We use cookies and similar technologies for essential functionality (like authentication and security), affiliate attribution, and—on certain public marketing pages—optional analytics.

• Essential cookies: required to operate the Services (e.g., sign-in sessions, security protections).
• Affiliate attribution cookies: when a visitor uses a referral link, we may set an attribution cookie or token to credit conversions to an affiliate. The attribution window and rules may vary by program/product and are described in the affiliate dashboard and/or program materials.
• Analytics (public pages only): we use Google Analytics 4 on public-facing marketing pages to understand how visitors discover and use our site (e.g., page views, clicks, approximate region derived from IP, device/browser type). Where required by law, we only enable analytics after you provide consent via our cookie banner/preferences.

If cookies are blocked, cleared, or restricted, referral attribution may not be recorded and some features may not function properly.

How We Use Information

• Provide, operate, maintain, and improve the Services.
• Authenticate users and secure accounts and sessions.
• Attribute referrals and calculate commissions.
• Administer affiliate payouts via Stripe Connect.
• Prevent fraud, abuse, and security incidents.
• Measure and improve public marketing pages (including via Google Analytics 4 where enabled).
• Communicate with you about service updates and support.
• Comply with legal obligations and enforce our agreements.

Legal Bases for Processing (EEA/UK/Swiss)

Where required, we process personal information on the following bases: (a) contract necessity (to provide the Services you request); (b) legitimate interests (to secure, operate, and improve the Services and prevent abuse, balanced against your rights); (c) consent (for certain optional cookies/analytics where required); and (d) legal obligations.

How We Share Information

We do not sell personal information. We may share information:

• Service providers: with vendors that help us run the Services (e.g., Supabase for auth/database, Stripe for payouts, Cloudflare Turnstile for bot protection, identity providers like Google OAuth, hosting/logging providers, and Google Analytics on public pages where enabled).
• Compliance and protection: to comply with law, respond to lawful requests, protect rights and safety, and prevent fraud or security incidents.
• Corporate transactions: in connection with a merger, acquisition, financing, reorganization, or sale of assets.
• With your direction: when you ask us to share information or connect services.

We maintain a list of key subprocessors and can provide it upon request where required.

International Transfers

We may process information in the United States and other countries where we or our service providers operate. If you are located in the EEA/UK/Switzerland, we rely on recognized transfer mechanisms (such as Standard Contractual Clauses and, where applicable, the UK Addendum) to protect transfers.

Data Retention

We retain personal information as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary depending on the type of data and why we collected it.

• Account data: typically retained while your account is active and as needed afterward for legitimate business purposes.
• Affiliate attribution and commission records: retained as needed for program administration, accounting, audit, and dispute handling.
• Payout/accounting records: retained as required by applicable financial and tax laws.
• Security logs: retained for a limited period to detect and prevent abuse and maintain platform security.

When information is no longer needed, we delete or de-identify it, subject to legal and legitimate business needs.

Security

We implement reasonable administrative, technical, and physical safeguards designed to protect information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for activity under your account.

Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal information, and to request data portability. You may withdraw consent where we rely on consent (for example, optional analytics cookies where required).

To exercise rights, email legal@scalemode.tools. We may verify your identity before acting on a request.

U.S. State Privacy (including California)

Certain U.S. states provide additional rights related to access, deletion, correction, and portability. Some states also provide a right to appeal if we deny a privacy request. To appeal, reply to our decision email or write to us with “Privacy Appeal” in the subject line.

We do not sell personal information. If our use of certain tools is considered “sharing” for cross-context behavioral advertising under applicable law, you may submit an opt-out request by contacting us or by using a legally recognized opt-out preference signal (such as Global Privacy Control) where applicable.

Global Privacy Control; Do Not Track

Where required by applicable law, we honor Global Privacy Control (GPC) signals as a request to opt out of certain data uses. We do not respond to browser “Do Not Track” signals due to a lack of consistent industry standards.

Children’s Privacy

The Services are not intended for minors. We do not knowingly collect personal information from minors. If we learn we collected personal information from a minor, we will delete it.

Contact

ScaleModeTools LLC
Mailing address for legal notices only (c/o Registered Agent):
South Carolina Registered Agent LLC
6650 Rivers Ave. STE 100
Charleston, SC 29406 USA
Email legal@scalemode.tools
Please do not send general correspondence or returns to the Registered Agent address.