Privacy Notice

Scallor is operated by the Scallor team based in Toronto, Canada. References to "we," "us," or "our" mean Scallor. References to "you" mean the visitor or prospective customer interacting with this site.

For privacy questions, including any request to access, correct, or delete your personal information, contact us at privacy@scallor.com.

We collect only what's needed to run this site and respond to enquiries.

• Information you provide: when you apply for early access or contact us, we collect the details you submit (e.g. name, work email, company, role-related context).
• Contact form: when you use the contact form at the bottom of the site, we collect your name, work email, your message, and the page you sent it from. We use this solely to respond to your enquiry. It does not add you to any mailing list.
• Strictly necessary cookies: small pieces of data required to run the site (security, basic routing, and remembering your cookie choice). These are always on.
• Analytics (only if you opt in): aggregated, non-identifying information about how the site is used (pages viewed, approximate location at country level, device type), via Google Analytics. We also partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve our product and site. This data is captured using first- and third-party cookies. We do not build a personal profile.
• Marketing (only if you opt in): measurement of how outbound campaigns perform. Off by default.
• Server logs: our hosting provider keeps standard request logs (IP address, timestamp, page requested, user agent) for security and abuse prevention. These are retained on a short rolling window.

• To run, secure, and improve the website.
• To respond to enquiries and applications you submit.
• To understand, in aggregate, what content is useful, only when analytics consent has been given.
• To comply with legal obligations and protect against fraud or abuse.

We do not sell your personal information. We do not share it with third parties for their own marketing purposes.

We use cookies for three purposes: strictly necessary, analytics (opt-in), and marketing (opt-in). You can review and change your choice at any time via the Cookie settings control. Necessary cookies cannot be turned off because the site cannot function without them.

We use a small number of vendors that process information strictly to deliver the website and product:

• Hosting & database: our infrastructure runs on AWS US East (N. Virginia), with Vercel providing application hosting and Supabase providing database hosting and authentication.
• Email: Resend handles delivery of transactional and contact-form emails.
• Enquiry tracking: ClickUp stores contact-form enquiries so our team can respond and track follow-up.
• Analytics: Google Analytics (Google LLC) measures aggregated site usage. See Google's Privacy Policy.
• Behavioral analytics: Microsoft Clarity records heatmaps and session replay to help us improve the site. By using our site, you agree that we and Microsoft can collect and use this data. See the Microsoft Privacy Statement.
• AI processing: product AI features run on OpenAI and Anthropic under enterprise API agreements. Both are contractually prohibited from training their models on your data.

Each vendor is bound by a data processing agreement to use information only to provide their service to us. The current, authoritative list of subprocessors is maintained on our Trust & Compliance Centre.

We keep information only as long as we need it for the purposes above. Specifically:

• Contact-form enquiries: up to 12 months after our last exchange with you.
• Application records: up to 24 months after last contact.
• Aggregated analytics (if opted in): up to 14 months.
• Server logs: a short rolling window set by our host.

Regardless of where you live, you can ask us to access, correct, or delete the personal information we hold about you. You can also withdraw your consent at any time. Email privacy@scallor.com and we will respond within a reasonable period (typically 30 days).

Canada (PIPEDA + Quebec Law 25)

Under PIPEDA and Quebec's Act respecting the protection of personal information in the private sector ("Law 25"), you have the right to access, correct, and withdraw consent for the use of your personal information, and to file a complaint with the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec if you believe your rights have been infringed. The individual responsible for the protection of personal information at Scallor can be reached at privacy@scallor.com.

United States (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we have about you, request a copy, ask us to delete it, and ask us to correct inaccuracies. We do not sell or share personal information for cross-context behavioural advertising, and we do not process sensitive personal information for purposes other than those allowed by the CCPA. To exercise any of these rights, email privacy@scallor.com. We will not discriminate against you for exercising your rights. If you have an authorised agent acting on your behalf, please include written authorisation with your request.

United Kingdom (UK GDPR + Data Protection Act 2018)

If you are in the United Kingdom, you have the right to access, rectify, or erase your personal information, restrict or object to its processing, and receive a copy in a portable format. You may also lodge a complaint with the Information Commissioner's Office (ICO) if you believe your rights have been infringed. To exercise any of these rights, email privacy@scallor.com.

Singapore (PDPA)

Under the Personal Data Protection Act 2012, you have the right to access and correct your personal data and to withdraw consent to its collection, use, or disclosure. You may also raise a concern with the Personal Data Protection Commission (PDPC). Requests can be sent to privacy@scallor.com.

Australia (Privacy Act 1988)

Under the Australian Privacy Principles, you have the right to access and correct the personal information we hold about you. If you believe we have mishandled your information, you can complain to us first, and to the Office of the Australian Information Commissioner (OAIC) if unresolved. Contact us at privacy@scallor.com.

Customer data is hosted in the United States (AWS US East, N. Virginia). Dedicated regions for Canada, the UK/EU, and Asia-Pacific are on our roadmap, prioritized by customer demand; until then, the same GDPR-grade controls are applied to all data regardless of where you are located, and the storage location is disclosed in every customer agreement. Where information moves between countries, we rely on the contractual protections in place with each vendor. Full details are on our Trust & Compliance Centre.

We use industry-standard measures (encrypted transport, least-privilege access, vendor due diligence) to protect personal information. No method of transmission or storage is 100% secure, but we work to keep risk low.

This site and product are intended for business audiences. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with information, please contact us and we will delete it.

We may update this notice as our practices evolve. The "Last updated" date at the top of the page will reflect the most recent change. If we materially change how we handle personal information, we will re-prompt for consent through the cookie banner.

Privacy questions: privacy@scallor.com.

See also our Cookie Policy, Terms of Use, and Trust & Compliance Centre.