Privacy Notice

Who is responsible for data

ScalePointer.io LLC, 447 Broadway, New York, NY 10013, USA, operates Engagement. Contact hello@scalepointer.com for privacy questions, requests or security concerns. We decide how account, security, support and billing information is used to operate our business. For client and project content uploaded on a Customer’s instructions, the Customer determines its purposes and we act as its processor or subprocessor, as applicable.

Your service provider or client administrator controls your membership and the content shared with you. Ask that organization about its own privacy practices and client-data requests. If a request concerns content we process for it, we will direct the request to the responsible Customer and assist as required. We do not treat every uploaded record as our own business data.

Information we handle

Account information includes your name, email, password hash, optional profile photograph, verification status, memberships and roles. We store session and verification-token hashes. Profile images are resized and metadata is removed. Invitation senders supply recipient email addresses and names before recipients create accounts.

Workspace content can include client contact details, projects, tasks, comments, dates, status changes, time records, files and exports. Task audit entries can record actor identity, action, changed values, UTC timestamps and the IP address supplied by our trusted production proxy. We also process operational logs, security and rate-limit information, email delivery records, and support messages.

Billing records include Stripe customer, checkout and subscription identifiers, purchased capacity, billing state and invoice links. Stripe hosts payment collection; our app does not store full payment-card numbers or card security codes. Agreement records include your account, the documents and acknowledgement text accepted, version and content fingerprint, server timestamp, acceptance context, and, when available, IP address and browser user agent.

Purposes and legal grounds

We use account and billing information to provide the service, verify identity, administer subscriptions and communicate with you. Where applicable, this processing is necessary to perform our agreement. Our legitimate business interests include preventing abuse, securing and maintaining the service, troubleshooting, handling support and establishing or defending legal claims. We use financial and related records to meet legal obligations where required.

Customers are responsible for the lawful basis for their client and project content. We process it under their documented instructions and the Data Processing Addendum. Signup acceptance does not enroll you in promotional email. Necessary verification, invitation, security, billing and service notices are transactional. We do not sell personal information, use client content for targeted advertising, or train general-purpose AI models on it.

Service providers and international processing

Amazon Web Services provides production hosting, PostgreSQL storage on EC2, S3 file storage, key management, transactional email through SES, and operational logs through CloudWatch. The configured application and project-file region is US East (Northern Virginia), us-east-1. Authorized operations and support access may occur from other countries; this service does not promise exclusive US-person access or selectable data residency.

Stripe processes payment and subscription information under its applicable terms and privacy notice (stripe.com/privacy). It may act independently for fraud prevention, payment-network and regulatory purposes. It does not need the contents of your uploaded project files. Message recipients’ email services and the Customer’s own downloaded copies are outside our hosting environment.

We disclose information to authorized workspace members, necessary contracted providers, and public authorities where legally required, and as reasonably necessary to protect rights and security. A corporate transaction may involve data subject to applicable confidentiality and privacy requirements. If a transfer needs a specific legal mechanism, such as EU standard contractual clauses or a UK addendum, contact us to arrange the required terms before transferring that data; this notice alone is not that mechanism.

Retention and deletion

Project-specific content has a 90-day lifetime from project creation on every plan. At the deadline access ends and deletion processing removes project records, task audits and files, with failed storage deletions retried. Earlier authorized deletion is possible. Export your records and file archives before the deadline. Paying or archiving does not extend it. We do not offer a restoration or backup service.

Account and profile information, workspace/client directory data and subscription records are separate from project retention and remain while the relationship continues. Contact us to close an account or request deletion; some records may need to remain for outstanding billing, security, legal obligations or disputes. We assess the applicable need and retention period when handling the request rather than promising that every record disappears with a project.

Production app and worker logs have a configured 30-day CloudWatch retention period. Expired login and email tokens are cleaned up by scheduled maintenance. Agreement evidence, billing records and support correspondence may remain as necessary to administer the relationship, demonstrate acceptance or comply with law. These are not retained as copies of project content. Copies exported by customers, recipients’ emails and Stripe’s own required records are controlled by those recipients.

Cookies and local storage

The app uses a necessary first-party session cookie, sp-session, to keep you signed in. A normal session lasts up to seven days; a password-recovery session lasts up to 15 minutes. Signing out revokes sessions. Browser storage may retain interface preferences. Any public demonstration uses separate, clearly identified demo state.

Engagement offers optional first-party usage analytics. It runs only after you choose Allow analytics and respects Do Not Track and Global Privacy Control. We store your choice and, if allowed, a random browser identifier in local storage. We record broad page categories, visit times and, when signed in, your account identifier to understand service usage. We do not collect page contents, query strings or advertising identifiers for analytics. Visit records are removed after 90 days without activity. You can decline or withdraw through Usage privacy at any time; withdrawal stops future collection and removes the browser identifier. Existing account and billing records remain necessary to operate the service independently of this choice. The separate corporate website and Stripe-hosted pages have their own notices.

Your choices, rights and security

You can update your profile and verify an email change in the app. Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing, and complain to your local data-protection authority. Contact hello@scalepointer.com. We verify identity and authority before disclosing or changing data and respond within the applicable legal time limit. Do not send passwords or unnecessary sensitive documents in a request.

Our safeguards include encrypted network connections, encrypted production disks and S3 objects, role-based permissions, tenant access checks and protected administrative access. Encryption does not prevent authorized users from accessing or exporting data. No security measure eliminates all risk. Report suspected vulnerabilities privately to hello@scalepointer.com; do not exploit them or include other customers’ content.

Engagement is intended for adults using it for business. Do not create accounts for children or upload children’s personal data. We will update this notice when practices materially change and make the current version available in the app.