Privacy Policy

Last updated: July 12, 2026

This policy explains how ScaleTrack (“we”, “us”) handles data across the ScaleTrack web application (app.scaletrack.ai), the ScaleTrack mobile application, and the tracking service our customers install on their own websites. It applies to you if you hold a ScaleTrack account, and it describes how we process data about our customers' website visitors on our customers' behalf.

1. Data we collect from account holders

• Account data — name, email address and a hashed password (or passkey credential) when you register.
• Workspace data — the campaigns, sites, integrations, creatives, support conversations and settings you create while using the product.
• Usage data — standard server logs (IP address, user agent, timestamps) kept for security and debugging.
• Push tokens — if you enable notifications in the mobile app, we store a push token so we can deliver alerts you asked for. Tokens are removed when you sign out, when your device is deregistered by the platform, or when your workspace membership ends.

2. Data we process on behalf of our customers

Customers install ScaleTrack's measurement snippet on their own websites. Through it we process visitor events — page views, clicks, add-to-cart and checkout events, order values, and attribution identifiers (such as click IDs and browser identifiers used by Meta's Conversions API) — strictly as a processor for the customer that operates the website. The customer is the data controller for this data and is responsible for their own privacy disclosures and consent management. We do not sell this data or use it for our own advertising.

3. Cookies

The ScaleTrack application uses cookies for authentication and session management only. The marketing site (scaletrack.ai) sets no cookies. Our measurement snippet on customer sites uses first-party identifiers under the customer's domain, controlled by the customer.

4. Third-party services

We rely on a small set of processors to run the service:

• Hosting & infrastructure — Railway (application hosting), Cloudflare (edge network and static hosting), managed PostgreSQL/ClickHouse/Redis providers.
• Meta Platforms — when you connect ad accounts or use server-side conversions, campaign data and conversion events flow between ScaleTrack and Meta's APIs under your instruction.
• Shopify — when you connect a store, order and checkout webhooks flow from Shopify to ScaleTrack under your instruction.
• Expo — push notification delivery for the mobile app (Apple APNs / Google FCM downstream).
• Resend — transactional email (invitations, alerts).
• Anthropic — if you enable AI-assisted support replies, conversation text is processed to generate draft responses.

5. Retention

Account and workspace data is retained while your account is active. Tracking health snapshots are pruned after 60 days. If you delete your account or workspace, associated data is deleted from production systems within 30 days, with encrypted backups expiring on their regular cycle.

6. Your rights

You can access, correct, export or delete your account data at any time — most of it directly in the product, or by contacting us. If you are in a jurisdiction with statutory data rights (such as the EU/EEA under GDPR), we honor access, rectification, erasure, portability and objection requests.

7. Security

All traffic is encrypted in transit (TLS). Credentials are stored hashed; third-party API tokens are stored encrypted at rest. Access to production systems is restricted and logged.

8. Changes

We will post any changes to this policy on this page and update the date above. Material changes will be announced in the product.

9. Contact

Questions or requests: support@scaletrack.ai.