Privacy Policy

Scalecom is operated by PHILECOM LTD, a company registered in England and Wales under company number 17038467.

Registered address: Office 17375, 182–184 High Street North, East Ham, London, E6 2JA, United Kingdom.

For all privacy enquiries, contact us at [email protected]. PHILECOM LTD is the data controller for personal data processed through the Scalecom platform (scalecom.pro).

We collect the following categories of personal data:

Account & Identity Data

• Full name and email address (collected at registration)
• Password (stored as a one-way bcrypt hash — we never see your plain-text password)
• Profile information you choose to provide

Usage & Technical Data

• IP address and approximate geolocation (country, city) at login
• Browser type, operating system, and device type
• Pages visited, features used, and actions performed within the platform
• Session timestamps and login history

Shopify Store Data

• Shopify store URL and OAuth access tokens (required to connect your store)
• Product listings, images, descriptions, variants, and pricing imported through the platform
• Shopify collection and order data where accessed during product operations

Payment Data

• Subscription plan and billing history
• Payment card details are processed and stored exclusively by Stripe — we never receive or store your full card number

Team & Collaboration Data

• Email addresses of team members you invite
• Role assignments and activity logs for team operations

We use your data for the following purposes:

• Providing and maintaining the Scalecom platform and all its features
• Authenticating your identity and securing your account
• Processing payments and managing your subscription via Stripe
• Connecting to your Shopify store and performing product operations on your behalf
• Generating AI-powered content using the OpenAI API (product data is sent to OpenAI servers for processing)
• Sending transactional emails such as password resets, team invitations, and billing receipts
• Monitoring and improving platform performance, reliability, and security
• Complying with our legal obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes.

As a UK-registered company, we process your data under the UK GDPR. Our legal bases are:

• Contract: Processing necessary to perform our service agreement with you (account management, platform features, billing)
• Legitimate interests: Platform security, fraud prevention, service improvements, and session analytics — balanced against your rights
• Legal obligation: Retaining financial records as required by UK law
• Consent: Sending optional marketing communications (you may withdraw consent at any time)

We share data with the following trusted sub-processors to deliver our service. All processors are bound by data processing agreements:

• Stripe Inc. — Payment processing and subscription management (US/EU, Standard Contractual Clauses apply)
• OpenAI, L.L.C. — AI content generation via the OpenAI API (product text is sent for processing; US-based)
• PostgreSQL database hosted on our VPS — Account and product data storage
• Redis (in-memory cache) — Temporary caching of session and product data

• Account data is retained for the lifetime of your account plus 90 days after deletion
• Product and import data is retained while your account is active; you may delete it at any time from your dashboard
• Payment records are retained for 7 years to comply with UK financial regulations
• Session and activity logs are retained for 12 months
• Team member invitation data is deleted within 30 days of expiry or acceptance

You have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — correct any inaccurate or incomplete data
• Right to erasure ('right to be forgotten') — request deletion of your account and associated data
• Right to restriction — ask us to limit how we process your data in certain circumstances
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — for any processing based on your consent (e.g. marketing emails)

To exercise any right, email us at [email protected]. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

If you choose to connect Google Ads or Google Merchant Center to a Shopify store in Scalecom, you will be asked to authorise that store-specific connection through Google's standard OAuth 2.0 consent screen. Each Shopify store can use a different Google account. Scalecom will only receive access to the scopes you approve.

What we access

• Google Ads (scope: https://www.googleapis.com/auth/adwords) — read-only per-product Performance Max metrics: impressions, clicks, cost, conversions, conversion value and computed ROAS, grouped by full Merchant Center offer identity, campaign and date, for the last 30 to 90 days.
• Google Merchant Center (scope: https://www.googleapis.com/auth/content) — read-only product feed statuses (disapproved, pending, warnings) so we can highlight products whose feed problems are hurting ad performance.

What we do NOT do

• We never create, edit, pause or delete Google Ads campaigns, ad groups, ads, keywords, bids, budgets or assets.
• We never share Google user data between Scalecom customers or with any third party.
• We never sell Google user data.
• We never use Google user data to train AI models, whether our own or those of our sub-processors.
• We never use Google user data for advertising to end users, or for any purpose beyond providing the Scalecom features you enabled.

How we store and protect it

• Google Ads and Google Merchant Center OAuth refresh tokens are encrypted at rest using AES-256-GCM before being written to our PostgreSQL database.
• The Scalecom Google Ads developer token is held only in server-side environment variables — it is never sent to a browser.
• Google credentials, Merchant Center diagnostics, and cached Google Ads metrics are scoped to the selected Shopify store; there is no cross-store or cross-merchant aggregation.
• When you disconnect Google Ads or Google Merchant Center in Scalecom, or delete your Scalecom account, the stored refresh token and all cached Google metric rows for your connection are deleted.
• You may also revoke Scalecom's access at any time from your Google Account security settings at https://myaccount.google.com/permissions.

Scalecom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use cookies for authentication and session management. For full details, please read our Cookie Policy.

We take the security of your data seriously. Measures we have in place include:

• All data transmitted over HTTPS (TLS 1.2+)
• Passwords hashed with bcrypt (12 rounds)
• JWT tokens with 7-day expiry and secure cookie settings
• Shopify OAuth tokens encrypted at rest
• Database access restricted to application servers only
• Regular security reviews and dependency updates

Some of our third-party processors (notably OpenAI and Stripe) are based in the United States. Transfers to the US are carried out under the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) as appropriate. By using Scalecom, you acknowledge these transfers.

Scalecom is not directed at individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you by email. Continued use of the platform after changes are posted constitutes your acceptance of the updated policy.

For any questions about this Privacy Policy or how we handle your data, contact PHILECOM LTD at:

Email: [email protected]
Post: Office 17375, 182–184 High Street North, East Ham, London, E6 2JA, United Kingdom