Scaladly

Sign in

Privacy Policy

Last updated: 2026-10-24

1. Data Controller

Gustavo Rodrigues Carvalho (individual), Brazil.

Contact for privacy requests: suporte@scaladly.com

2. Legal Framework and Data Subject Rights

This privacy policy is governed by Brazil's General Data Protection Law (LGPD - Lei 13.709/2018). Data subjects have the following rights regarding their personal data:

  • Confirmation of the existence of data processing;
  • Access to the data;
  • Correction of incomplete, inaccurate, or outdated data;
  • Anonymization, blocking, or deletion of unnecessary or excessive data;
  • Data portability to another service provider;
  • Information about the sharing of data with public and private entities;
  • Revocation of consent;
  • The right to file a complaint with the National Data Protection Authority (ANPD).

3. What Information We Collect

We collect and process the following information:

  • Account data: Name, email address, password hash, locale/theme/avatar preferences, and subscription plan details of Scaladly users.
  • Authentication data: Cookies and session information (JWT access and refresh cookies, locale cookie).
  • Technical logs: IP addresses and access logs for security and performance monitoring.
  • Data processed by our modules (on your behalf): Information related to your marketing campaigns, automation rules, integration credentials (such as webhooks and platform secrets), tracking data (click and conversion events), and market/keyword research data. We only process features that are active and available in your current plan.

4. Purposes and Legal Bases

We process your data for the following purposes:

  • To provide, maintain, and improve the Scaladly platform and its modules.
  • To manage your account, authentication, and subscription.
  • To ensure the security and integrity of our services.

The legal bases for processing include the performance of a contract (providing the service to you), compliance with legal obligations, and our legitimate interests in operating a secure and reliable platform.

5. Data Retention and Security

We retain your personal data for as long as your account is active or as needed to provide you the services, comply with our legal obligations, resolve disputes, and enforce our agreements. All sensitive information, including third-party API credentials, is encrypted at rest. We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or alteration.

6. Sub-processors and International Transfers

To provide our services, we may use trusted third-party sub-processors (such as our hosting providers and Google APIs). This may involve the international transfer of data. Any such transfers are conducted in compliance with applicable data protection laws, ensuring an adequate level of protection.

7. Google API Use

Scaladly uses the Google Ads API (OAuth scope https://www.googleapis.com/auth/adwords). Currently, Scaladly uses a single, Scaladly-owned Google Ads account via the Keyword Planner to show aggregated keyword and market research data (e.g., search volumes, competition, bid ranges) within the app. No Google user data of Scaladly users is accessed for this functionality.

In the future, users may optionally connect their own Google Ads account via Google OAuth. In such cases:

  • Scaladly will access only the data necessary for the features you choose to use (e.g., keyword planning, account, and campaign data).
  • OAuth tokens will be stored encrypted on our servers and used exclusively to provide the requested feature.
  • You can revoke access at any time through your Google account settings (https://myaccount.google.com/permissions) and by disconnecting the account within the Scaladly app.
  • Upon revocation, disconnection, or upon your request, the tokens and related Google data will be deleted.

Google Trends data may be integrated in the future under the same privacy principles.

Limited Use Policy

Scaladly's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Furthermore:

  • We do not sell data obtained from Google APIs.
  • We do not use this data for advertising purposes (including retargeting or personalized ads).
  • We do not transfer this data to third parties, except as strictly necessary to provide or improve user-facing features, for security purposes, or to comply with the law.
  • Humans do not read this data unless you grant explicit consent, it is necessary for security or abuse investigation, to comply with applicable law, or if the data is aggregated and anonymized for internal operations.

8. Tracking Module and Visitor Data

When Scaladly customers install the Tracking module's tracker script (public/tracker/v1.js) on their own landing pages, the script performs the following actions:

  • Before consent is granted, nothing is persisted to the device (no cookies or persistent IDs). The script only reads ad click parameters from the URL (such as gclid, wbraid, gbraid, utm_*, and subid), generates a random in-memory click ID, and decorates outbound affiliate links with these parameters.
  • When consent is granted by the visitor, the script stores a random visitor ID in localStorage and a session ID along with the captured parameters in sessionStorage.
  • It sends click and visit events to Scaladly, carrying the consent state. If consent is not granted, full user agents are not stored.
  • The hop link (/r) used for tracking redirects sets no cookies and uses no persistent visitor ID.
  • Click tracking logs are retained for 13 months, after which they are deleted or anonymized if tied to a conversion.

For these visitors, the Scaladly customer acts as the data controller, and Scaladly processes the data on the customer's behalf as an operator or processor (under LGPD, GDPR, etc.). Customers are solely responsible for informing their visitors about this tracking and obtaining any consent required by applicable laws (such as GDPR, ePrivacy, or LGPD) before loading the tracker script.

Scaladly truncates IP addresses before storage (IPv4 to /24, IPv6 to /48) and does not send IP addresses or user identifiers (such as email, phone number, whether hashed or not) of European Economic Area (EEA) visitors to Google.

9. Children's Privacy

Scaladly is a B2B service and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.

10. How to Request Deletion or Changes

To exercise your rights, including requesting the deletion of your account and associated data, please contact us at suporte@scaladly.com.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.