Privacy Policy

How we collect and use personal data when you visit our website, create an account, work with us as a client or receive our emails, and the rights you have under the GDPR.

Last updated: 26 October 2026

1. Controller

The controller responsible for processing your personal data is:

SIA ScaleUp
Registration number: 40203791621
VAT number: LV40203791621
Registered address: Indrānu iela 4-20, Rīga, LV-1012, Latvia
Email: [email protected]

For any privacy question or to exercise your rights, write to [email protected]. We are a small company and have not appointed a data protection officer, as the GDPR does not require one for our processing; the address above reaches the person responsible.

2. What we collect and why

Data	Purpose	Legal basis (GDPR)
Account data: name, email, password (stored only as a secure hash), account type, your confirmation that you are 18 or older, and the version of the Terms you accepted	Creating and running your account, confirming your email with a code	Art. 6(1)(b), contract
Profile details you add: company, role, phone, website, team size	Understanding your situation and contacting you	Art. 6(1)(b), contract
Requests and their chats, survey answers, example emails you share, email designs you make	Assessing your needs, preparing demo workflows, running the features you use	Art. 6(1)(b), contract and steps before entering one
Meeting bookings	Scheduling and holding meetings with you	Art. 6(1)(b), steps before entering a contract
Contact form messages and emails	Answering your enquiry	Art. 6(1)(f), our legitimate interest in replying; Art. 6(1)(b) where it concerns a contract
Business contact data: name, work email address, company, role	Sending business-to-business emails about our services (see section 7)	Art. 6(1)(f), our legitimate interest in direct marketing
Technical data: IP address, browser type, time of access, security logs	Running the website securely, preventing abuse, enforcing usage limits	Art. 6(1)(f), legitimate interest in security
Visit statistics: pages viewed (without query strings), referring site, browser, device type, country (no cookies, no IP address, no city kept)	Understanding how the website is used and improving it, including how many visitors sign up	Art. 6(1)(f), legitimate interest in improving our website
Contract, invoicing and payment data for paying clients (bank transfer details)	Delivering services, invoicing, bookkeeping	Art. 6(1)(b), contract; Art. 6(1)(c), legal obligation

You are not required to provide personal data, but without the data marked as required we cannot create an account or reply to you. We do not sell your data, and we do not use it for advertising or to train AI models.

3. Automations we build and run for clients

When we build or run an automation for a client, it handles the client’s own data, such as the emails their customers send them. For that data the client is the controller and we act as their processor (Art. 28 GDPR): we use it only to provide the automation, on the client’s instructions and under a data processing agreement that forms part of our contract with them. If you have written to one of our clients and want to exercise your rights, please contact that company; we will help them answer you.

Client automations run either on our own servers in Rīga, Latvia (Unijas iela 8c) or, if the client chooses, on web hosting in the EU that we set up for them.

4. AI assistants and automated decision-making

Parts of your account use an AI assistant: the request chat (including the follow-up to the Overview survey), the email design assistant and “Generate similar designs”. It is always marked as an AI assistant. The AI model is provided by Anthropic, PBC (Claude), as our processor. Anthropic does not use this data to train its models and deletes it within 30 days.

Before a message reaches the AI, your name, email address, phone number, company, website and the names of your automations are replaced by placeholders automatically, and so are email addresses, phone numbers, links, bank account numbers and personal codes in the text. The real details are put back only in what you and our team see.
Names of other people you mention, such as your customers, cannot always be recognised. Please describe the situation instead of sharing their details.
Your account details, the “Add more details” text of your email design and your uploaded images are not sent to the AI.
There are daily limits on how much each account can use the AI.
A request you send in is only passed to an automation’s improvement pipeline after a person at ScaleUp2Sell has read and approved it.

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. Every request is read and handled by a person.

5. Who receives your data

The website and its database run on our own servers in Rīga, Latvia (Unijas iela 8c). We share personal data only where necessary, with these service providers, each under a data processing agreement (Art. 28 GDPR):

Microsoft Ireland Operations Ltd (Microsoft 365 (Exchange Online)): sending and receiving our email, including sign-up codes, notifications and the emails of automations we run. EU (Microsoft EU Data Boundary).
Anthropic, PBC (Claude API): the AI model behind our AI assistants and the automations we build. United States.
Cloudflare, Inc. (DNS, HTTPS and network protection (Cloudflare Tunnel)): delivering the website securely and protecting it against attacks. Worldwide network, company in the United States.
MongoDB, Inc. (MongoDB Atlas): database of the automations and dashboards we run for clients (client automations we host). EU (Stockholm, Sweden).
Hostinger International Ltd (Web hosting): hosting a client's automation on the web, when the client chooses web hosting instead of our servers (only for clients who choose web hosting). EU data centre.
Tailscale Inc. (Encrypted remote access): secure administration of our own servers. United States.

The full list with the data each one receives is on our Subprocessors page. Beyond these, data goes only to video platforms (YouTube, Vimeo) if you choose to play an embedded video, to the video-meeting service named in a meeting invitation when you join it, to our bank and accountant for invoicing, and to authorities where we are legally required to.

6. Transfers outside the EU/EEA

Some providers are based in the United States (Anthropic, Cloudflare, Tailscale) or may process data there (Microsoft). Where that happens, we rely on the EU-US Data Privacy Framework adequacy decision for certified companies, or on the EU Standard Contractual Clauses, which are part of each provider’s data processing terms. You can request a copy of the relevant safeguards from us.

7. Emails about our services

We send emails about our services to business email addresses of companies (for example info@ or [email protected]), which Latvian law allows without prior consent as long as every email lets you unsubscribe. We do not send such emails to private individuals unless they have agreed to receive them. We take business contact details from public sources, such as company websites and business registers, or from you. Every email says who it is from and has a one-click unsubscribe link. If you unsubscribe or object, we stop at once and keep only your email address on a “do not email” list, so that you are never contacted again.

8. How long we keep data

Account, profile, requests and their chats, survey answers, email designs and meetings: until you delete your account.
Inactive accounts: an account with no sign-in for 12 months is deleted, after we warn you by email 30 days before. Signing in keeps it. This does not apply to clients with a running contract or members of a client’s automation team.
Contact form messages: up to 2 years after the conversation ends.
Marketing contacts: until they unsubscribe or object; after that only the “do not email” entry.
Server and security logs: 90 days.
Visit statistics: 13 months, then deleted automatically.
Backups: 30 days, after which deleted data is gone from backups too.
Contracts, invoices and accounting records: 5 years, as Latvian accounting law requires.
Data in client automations: as set out in that client’s data processing agreement, and deleted or returned when the contract ends.

9. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you (Art. 15);
have inaccurate data corrected (Art. 16);
have your data erased (Art. 17);
restrict processing (Art. 18);
receive your data in a portable format (Art. 20);
object to processing based on legitimate interests, including direct marketing at any time (Art. 21);
withdraw consent at any time where processing is based on consent, without affecting earlier processing.

You can download your data and delete your account yourself in your account settings. For anything else, email [email protected]. We answer within one month.

You also have the right to lodge a complaint with a supervisory authority, in particular the Data State Inspectorate of Latvia (Datu valsts inspekcija), or the authority in your EU country of residence.

10. Cookies

We only use cookies that are strictly necessary for signing in, security and remembering the language you choose. Visitor statistics are collected without cookies, with Umami on our own server. See our Cookie Policy.

11. Security

Data is transmitted over encrypted connections (HTTPS), passwords are stored only as salted hashes, sign-up is confirmed with an email code, login attempts are limited, and access to personal data is limited to the people who need it for their work. If a personal data breach is likely to put your rights at risk, we report it to the Data State Inspectorate within 72 hours and tell you without undue delay where the law requires it.

12. Children

Our website and services are not intended for people under 18, and we do not knowingly collect their data.

13. Changes

We may update this policy. The date at the top shows the current version. We will notify registered users of material changes by email.