Privacy Policy

1The distinction that governs everything below

For operators — the businesses that license SCAIL — we are the business / controller. We decide what to collect and why, and this policy describes it.

For consumers — the clients of those businesses, whose credit reports, addresses, dates of birth and dispute histories live inside an operator’s workspace — we are a service provider / processor. We hold that data on the operator’s instructions and do not decide what happens to it.

If you are a consumer working with a credit repair company that runs on SCAIL, your relationship is with that company, not with us. Ask them for their privacy policy and send privacy requests to them. If you reach us instead, we will refer you to them and help them respond — see section 7.

2What we collect from operators

Account — name, business name, work email, phone, password (hashed, never stored in readable form), chosen subdomain.
Billing — plan, subscription status, invoice history, and a payment-method token. We never see or store your full card number; it goes directly to our payment processor.
Usage — pages visited in the app, features used, AI volume consumed, timestamps, IP address and browser/device information, and error logs.
Support — what you write to us, and what you ask the in-app assistant.

3What sits in an operator's workspace

On the operator’s instructions, the platform stores the material a credit repair engagement generates. It is sensitive, and worth naming plainly: consumer names, postal and previous addresses, dates of birth, the last four digits of Social Security numbers, employers, telephone numbers and email addresses; credit reports and scores from all three bureaus; tradelines, balances, payment histories, collections and public records; dispute letters, bureau responses and certified-mail tracking; uploaded identity and address documents; and messages between an operator and their client.

We access it to run the service, to fix a fault, to prevent abuse, or when an operator asks us for support. We do not sell it, we do not share it for advertising, and we do not use it to market to consumers.

4Why we use it

To provide the platform and the features an operator’s plan includes.
To bill, and to collect what is owed.
To secure the service — authentication, abuse and fraud prevention, audit logging.
To support operators when they contact us.
To improve the product using aggregated, de-identified statistics that identify nobody.
To meet legal obligations and respond to lawful requests.

We do not sell personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined by the California Consumer Privacy Act.

5Who else touches it

The platform runs on a small set of vendors, each with a defined job. The current list, with what each one receives, is maintained in the Data Processing Addendum. In summary: cloud hosting, the database and file storage, the AI provider that drafts letters and analyses, payment processing, transactional email, SMS delivery, certified-mail dispatch, PDF rendering, and credit-report retrieval where an operator has enabled it.

We also disclose information when the law requires it, to enforce our agreements, or as part of a merger or sale of assets — in which case notice is given and this policy continues to apply until replaced.

6Cookies and what the website actually does

The marketing site at scailapp.com runs no advertising trackers, no analytics pixels and no third-party cookies. It loads a webfont from Google Fonts, which necessarily reveals your IP address to Google in order to serve the file. It stores your chosen colour scheme in your browser’s local storage so the site and the app agree; that value never leaves your device.

The application sets strictly necessary cookies to keep you signed in and to protect the session. There is nothing to opt out of because there is nothing optional being set.

7Your rights

Depending on where you live — California’s CCPA/CPRA, other US state privacy laws, and the GDPR where it applies — you may have the right to know what we hold, to get a copy, to correct it, to delete it, to limit the use of sensitive information, and not to be discriminated against for asking.

Operators: email privacy@scailapp.com. We will verify you through your account and respond within 45 days.

Consumers: send your request to the credit repair company you are working with. They control your data; we act on their instruction. If you contact us directly we will pass the request to them promptly and support them in fulfilling it, but we cannot delete or hand over their records on our own initiative.

You may use an authorised agent, and we may ask for proof of that authority.

8How long we keep it

Operator account and billing records are kept while the account is open and afterwards for as long as tax, accounting and legal obligations require. Workspace data is kept while the workspace is active and for 30 days after cancellation, then deleted from production; encrypted backups age out within 90 days. Security and audit logs are kept for up to 12 months.

9Security

Data is encrypted in transit and at rest. Access is scoped per workspace at the database level so one operator cannot reach another’s records. Credentials that must be stored are encrypted with a separate key. Staff access is limited to those who need it, and is logged.

No system is perfect. If a breach affects your data we will notify affected operators without undue delay, and support them in notifying consumers where the law requires it.