Privacy Policy

Notice at Collection (summary)

This summary is for visitors to scailapp.com and operators who sign up. The sections below have the detail.

• What we collect. Visitors: the link or ad that brought you here (campaign tags, ad click id, referring page), your IP address and browser details in server logs, and your cookie choices. If you sign up or request a resource: name, work email, phone, business name, plan, payment-method token and usage in the app (section 2).
• Why. To run the service, bill, secure it, support you, and measure our own advertising (section 4).
• Who gets it. The vendors listed on the Subprocessors page. We do not sell personal information. Ad measurement with Meta can count as “sharing” under California law, and you can turn it off (section 6).
• How long. Section 8.
• Your choices. Your Privacy Choices on every page, Global Privacy Control honored automatically, and the Cookie Policy. Rights requests: privacy@scailapp.com (section 7).
• Who we are. Scail Capital LLC, 2390 Red Hill Ave, Santa Ana, CA 92705. SCAIL is software; it is not a credit repair organization and does not repair credit.

1The distinction that governs everything below

For operators — the businesses that license SCAIL — we are the business / controller. We decide what to collect and why, and this policy describes it.

For consumers — the clients of those businesses, whose credit reports, addresses, dates of birth and dispute histories live inside an operator’s workspace — we are a service provider / processor. We hold that data on the operator’s instructions and do not decide what happens to it.

If you are a consumer working with a credit repair company that runs on SCAIL, your relationship is with that company, not with us. Ask them for their privacy policy and send privacy requests to them. If you reach us instead, we will refer you to them and help them respond — see section 7.

2What we collect from operators

• Account — name, business name, work email, phone, password (hashed, never stored in readable form), chosen subdomain.
• Billing — plan, subscription status, invoice history, and a payment-method token. We never see or store your full card number; it goes directly to our payment processor.
• Usage — pages visited in the app, features used, AI volume consumed, timestamps, IP address and browser/device information, and error logs.
• Support — what you write to us, and what you ask the in-app assistant.

3What sits in an operator's workspace

On the operator’s instructions, the platform stores the material a credit repair engagement generates. It is sensitive, and worth naming plainly: consumer names, postal and previous addresses, dates of birth, the last four digits of Social Security numbers, employers, telephone numbers and email addresses; credit reports and scores from all three bureaus; tradelines, balances, payment histories, collections and public records; dispute letters, bureau responses and certified-mail tracking; uploaded identity and address documents; and messages between an operator and their client.

We access it to run the service, to fix a fault, to prevent abuse, or when an operator asks us for support. We do not sell it, we do not share it for advertising, and we do not use it to market to consumers.

4Why we use it

• To provide the platform and the features an operator’s plan includes.
• To bill, and to collect what is owed.
• To secure the service — authentication, abuse and fraud prevention, audit logging.
• To support operators when they contact us.
• To improve the product using aggregated, de-identified statistics that identify nobody.
• To meet legal obligations and respond to lawful requests.

We do not sell personal information. Nothing in an operator’s workspace — and nothing about any consumer whose file is in one — is ever shared for advertising. The one exception to “no advertising” is narrow and described in section 6: when a business signs up for SCAIL, we tell Meta that a signup (and later, its first payment) happened so we can measure our own ads. Under the California Consumer Privacy Act that can count as “sharing” for cross-context behavioral advertising, and you can switch it off in one click (section 6).

5Who else touches it

The platform runs on a small set of vendors, each with a defined job. The current list, with what each one receives, is maintained in the Data Processing Addendum. In summary: cloud hosting, the database and file storage, the AI provider that drafts letters and analyses, payment processing, transactional email, SMS delivery, certified-mail dispatch, PDF rendering, and credit-report retrieval where an operator has enabled it.

Named vendors. Vercel (hosting), Supabase (database, sign-in and file storage), Stripe (SCAIL’s own billing), Resend (email), Twilio and Sendblue (text messaging), Anthropic (AI drafting and the Halo assistant), Lob and LetterStream (printing and mailing letters), PDFShift (PDF rendering), Calendly (booking), ElevenLabs (voice), Meta (ad measurement, section 6) and, where an operator enables them, SmartCredit/ConsumerDirect, Google and Microsoft. What each receives is on the Subprocessors page, which is the current list.

We also disclose information when the law requires it, to enforce our agreements, or as part of a merger or sale of assets — in which case notice is given and this policy continues to apply until replaced.

None of the above applies to text messaging data. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and text messaging originator opt-in data and consent are not shared with any third parties under any of the categories in this section. See section 12.

6Cookies and what the website actually does

The marketing site at scailapp.com serves its fonts from its own servers, so no font request goes to Google. It stores your chosen color scheme in your browser’s local storage so the site and the app agree; that value never leaves your device. Every cookie, pixel and embed the site uses is listed, with its purpose and lifetime, in the Cookie Policy.

How you found us. On your first visit the site sets a first-party cookie (scail_attr, 90 days) holding the campaign tags in the link you followed (utm_source and similar), any ad click id (fbclid, gclid), the page that sent you, and the page you landed on. No name, email or IP address is in it. If you sign up, it is copied onto your workspace record so we know which channel brought you.

Meta (Facebook / Instagram) ads. The marketing site and the signup page load the Meta Pixel, which sets Meta’s _fbp/_fbc cookies and reports page views to Meta. When a business creates a workspace, and again when it first pays, we send Meta a matching event through Meta’s Conversions API with the signup email and phone number hashed (SHA-256), the browser and click ids above, and the plan and amount. We use this only to measure and improve our own ads. The pixel runs only on scailapp.com, never inside the operator app or any client portal, and no workspace or consumer data is ever sent.

Your Privacy Choices. The Your Privacy Choices link at the bottom of every page opens a panel where you can accept or refuse measurement cookies and ad measurement at any time. If you appear to be in the European Union, the European Economic Area or the United Kingdom, the Meta Pixel and the optional cookies stay off until you choose; we work that out from your IP address at the moment of the request and do not store the address for this. We keep a record of your choice (a random id, your choices, the region and the date, not your name or IP address) so we can show we honored it.

Turning it off. If your browser sends a Global Privacy Control or Do Not Track signal, the pixel does not load and no Conversions API events are sent for your signup — you do not need to do anything else. Or opt out of ad measurement for this browser in one click (it sets a first-party scail_noads cookie for a year).

The application itself sets only strictly necessary cookies to keep you signed in and to protect the session. There is nothing to opt out of there because nothing optional is set.

6AThe SCAIL mobile app

The SCAIL app for iPhone and Android shows the same workspace as the web, so everything above applies to it. It adds only what an app needs to work:

• Sign-in. Your session is kept in your device’s secure storage (the iOS Keychain or Android Keystore). We never ask the app to store a password.
• Face ID, Touch ID or fingerprint. Checked entirely by your device. We never receive or store any biometric data; the app is only told whether the check passed.
• Notifications. If you allow them, we store a push token for your device so we can tell you about messages and progress on your file. Signing out removes it. You can turn notifications off in your phone’s settings at any time.
• Camera, photos and microphone. Used only when you choose to attach a document or record a voice note, and only for that. Nothing is captured in the background.
• No tracking. The app contains no advertising, analytics or tracking SDKs, does not track you across other apps or websites, and does not sell your information.

Deleting your account. In the app, open More → Delete my account (clients) or ☰ Menu → Account and settings → Delete my account (company staff), or, on the web, your account page. We file your request at once, stop notifications to your device, and the workspace’s team completes it within 45 days. Where the law requires a record of the work done for you to be kept — a signed service agreement, for example — that record is kept for that purpose only, as section 7 explains. You can also email info@scailapp.com to ask for deletion.

6BHalo, our AI assistant

SCAIL includes Halo, an assistant that answers questions, explains a credit file and drafts replies and letters. Halo is powered by Anthropic’s Claude models. When Halo is used, the text it needs to answer — the question or message, and the relevant parts of the credit file (for example names, accounts under dispute and their status) — is sent to Anthropic to produce the answer. Anthropic processes it for that purpose only and, under its commercial terms, does not use it to train its models.

• You choose. The SCAIL app asks for your permission before Halo is used with your information, and you can change your answer at any time in the app (Account and settings → AI and Halo) or by asking your credit-repair company.
• If you are a client and say no, Halo does not answer your messages; a person on your company’s team does, and your file is not sent to Anthropic for replies to you.
• If you work for a company and say no, Halo is turned off for you in the app.
• Nothing sends by itself. Letters and outbound messages Halo drafts for staff are not sent until a person sends them.

7Your rights

Depending on where you live — California’s CCPA/CPRA, other US state privacy laws, and the GDPR where it applies — you may have the right to know what we hold, to get a copy, to correct it, to delete it, to limit the use of sensitive information, and not to be discriminated against for asking.

Operators: email privacy@scailapp.com. We will verify you through your account and respond within 45 days.

Consumers: send your request to the credit repair company you are working with. They control your data; we act on their instruction. If you contact us directly we will pass the request to them promptly and support them in fulfilling it, but we cannot delete or hand over their records on our own initiative.

You may use an authorized agent, and we may ask for proof of that authority.

8How long we keep it

Operator account and billing records are kept while the account is open and afterwards for as long as tax, accounting and legal obligations require. Workspace data is kept while the workspace is active and for a 90-day export window after cancellation; it is then deleted or irreversibly de-identified in production within 90 days, and encrypted backups expire within a further 90 days, unless the law or a legal hold requires longer. Security and audit logs are kept for up to 12 months.

9Security

Data is encrypted in transit and at rest. Access is scoped per workspace at the database level so one operator cannot reach another’s records. Credentials that must be stored are encrypted with a separate key. Staff access is limited to those who need it, and is logged.

No system is perfect. If a breach affects your data we will notify affected operators without undue delay, and support them in notifying consumers where the law requires it.

9AFinancial-privacy laws (GLBA and the FTC Safeguards Rule)

Some of the businesses that license SCAIL may be “financial institutions” under the Gramm-Leach-Bliley Act and subject to the FTC Safeguards Rule (16 CFR Part 314). Whether an operator is covered is for that operator and its own counsel to decide. SCAIL does not decide it for them.

Where an operator is covered, our role is service provider: we hold consumer information only to provide the platform on the operator’s instructions, we use it for no other purpose, and we do not disclose it except to the subprocessors that help us provide the platform (see Subprocessors) or as the law requires. The security measures we maintain are described in section 9 and on the Security page, and the breach-notice terms are in the Data Processing Addendum.

We do not hold a SOC 2 report, ISO 27001 certification or any other third-party security certification, and nothing in this policy says otherwise. An operator that needs more than the DPA provides for its own Safeguards Rule program should ask us before relying on SCAIL for that purpose.

10Children

SCAIL is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18 as an account holder.

11Where data is processed

The platform and its subprocessors operate in the United States. If you access it from elsewhere, you understand your information is processed in the US.

12SMS / Text Messaging

SCAIL (Scail Capital LLC) uses your mobile number only to send the account notifications you opted in to receive — account setup confirmations, security alerts, reminders and support replies. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the categories of sharing described elsewhere in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

13Changes, and how to reach us

We will post any change here and update the effective date. For material changes affecting operators we will give notice by email.

Scail Capital LLC, a California limited liability company · 2390 Red Hill Ave, Santa Ana, CA 92705 · privacy@scailapp.com · legal contact legal@scailapp.com · (714) 478-7478