The short version
Scalple is a self-hosted platform. Your database data stays on your infrastructure — we never see it. We collect only what is necessary to run your account and maintain a security audit trail. You have full GDPR rights over your personal data. Contact us at [email protected] for any data request.
1. Who We Are
Scalple is a software product developed and distributed by RedDotIndustries SRL, a company registered in Romania. For the purpose of this Privacy Policy, RedDotIndustries SRL acts as the data controller for data collected through the Scalple platform itself (e.g. account information, usage logs).
Contact details:
- Company: RedDotIndustries SRL, Romania
- Product enquiries: [email protected]
- Data protection enquiries: [email protected]
When Scalple is deployed by your organisation and used to access your organisation's databases, your organisation is the data controller for the personal data within those databases. Scalple acts as a data processor on your organisation's behalf in that context. Your organisation's privacy policy governs that data.
2. Data We Collect
Scalple collects the minimum data necessary to operate the platform. The categories of personal data we collect are:
Account and identity data (collected at login): - Full name - Email address - Profile image (if provided by your identity provider) - Group memberships (synchronised from your organisation's identity provider)
Authentication data:
- Session tokens (stored server-side in PostgreSQL, never as standalone cookies)
- Login timestamps and session durations
- OAuth/OIDC tokens exchanged with your identity provider (validated server-side and never persisted in plaintext)
Operational and audit data:
- All database queries executed through Scalple, including timestamps, affected collections, and query filters
- Script execution records: who ran which script, when, and with what result
- File operations: uploads and downloads via the platform
- IP addresses and user-agent strings associated with each request
- GDPR-related actions: DSR submissions, breach notifications drafted, RoPA entries created
Technical data:
- Request IDs for correlation across system components
- Error logs (without PII from your production databases)
We do not collect: - The raw personal data contained in your organisation's databases (that data stays within your infrastructure) - Payment information (handled by our payment processor independently) - Data from your databases beyond what is necessary to return query results
3. Legal Basis for Processing (GDPR Art. 6)
We process your personal data on the following legal bases:
Contractual necessity (Art. 6(1)(b)): Account data, session data, and operational data are processed to perform the licence agreement and deliver the platform functionality you or your organisation contracted for.
Legitimate interests (Art. 6(1)(f)): Audit log data (who queried what, when) is processed to maintain the security and integrity of the platform, detect misuse, and support compliance audits. This processing is necessary for the security-critical nature of the platform and does not override your fundamental rights.
Legal obligation (Art. 6(1)(c)): Where applicable law requires us to retain records (e.g. for tax or contractual compliance purposes), we process data on this basis.
Consent (Art. 6(1)(a)): Where you have accepted the End User Licence Agreement and this Privacy Policy, this constitutes consent for processing described in those documents. You may withdraw consent by terminating your account, subject to retention obligations below.
4. How Long We Retain Your Data
We retain personal data only as long as necessary for the purposes described:
| Data category | Retention period | Reason |
|---|---|---|
| Account data (name, email) | Duration of active account + 90 days | Account management |
| Session tokens | Session duration (max 8 hours) | Authentication |
| Audit logs | Minimum 5 years | Regulatory compliance, security |
| GDPR DSR records | 5 years from fulfilment | GDPR accountability (Art. 5(2)) |
| Breach incident records | 5 years | NIS2 / GDPR Art. 33 compliance |
| Script execution records | 2 years | Operational audit trail |
| File records | Until file is deleted + 30 days | File management |
| Error logs | 90 days | Debugging and security analysis |
Audit logs are immutable by design — they are append-only and cannot be modified or deleted by the application. This is a security and compliance requirement. If you request erasure of your account data (Art. 17), your audit log entries will have identifying fields anonymised rather than deleted, to preserve the integrity of the audit trail.
5. Your Rights Under GDPR (Art. 15–22)
As a data subject, you have the following rights:
Right of access (Art. 15): You may request a copy of all personal data we hold about you, including the categories of data, processing purposes, and any recipients.
Right to rectification (Art. 16): If your personal data is inaccurate or incomplete, you may request correction. Name and email updates may need to be made through your identity provider (Entra ID, Google Workspace, etc.) and will sync to Scalple on your next login.
Right to erasure (Art. 17): You may request deletion of your personal data. We will comply within 30 days, subject to legal retention obligations. Audit log entries will be anonymised rather than deleted (see retention policy above).
Right to restriction of processing (Art. 18): You may request that we restrict processing of your data while a dispute about its accuracy or our legal basis is being resolved.
Right to data portability (Art. 20): You may request your personal data in a structured, machine-readable format (JSON). This applies to data you have actively provided and that we process by automated means.
Right to object (Art. 21): You may object to processing based on legitimate interests. We will assess whether our legitimate interests override your rights in the specific circumstances.
Right not to be subject to automated decision-making (Art. 22): Scalple does not make automated decisions with legal or similarly significant effects based on your personal data.
How to exercise your rights: Submit a request to [email protected]. We will respond within 30 days. We may need to verify your identity before processing the request. There is no charge for exercising these rights.
6. How We Share Your Data
We do not sell, rent, or trade your personal data. We share data only in the following circumstances:
Within your organisation: Scalple administrators in your organisation can view audit logs, user accounts, and group memberships as part of platform administration.
Infrastructure and hosting: Your Scalple instance is hosted on infrastructure you control (self-hosted deployment on Azure, OVHcloud, Scaleway, or Hetzner). We do not operate shared cloud infrastructure where your data is stored.
Service providers: We use the following sub-processors in connection with the platform:
- Anthropic (Claude API): If AI features are enabled, query assist and explanation features send anonymised query context to Anthropic. No raw personal data from your databases is sent. This is an optional feature that can be disabled by your administrator.
Legal requirements: We may disclose data to competent authorities if required by applicable law, court order, or regulatory demand, subject to legal review.
International transfers: RedDotIndustries SRL is based in Romania (EU/EEA). If your infrastructure is hosted in the EU/EEA, no international transfer occurs for your operational data. If Anthropic AI features are enabled, data is processed by Anthropic, which operates under standard contractual clauses for EU-US transfers.
7. Security
We implement appropriate technical and organisational measures to protect your personal data:
- •All sessions are validated server-side on every request — no client-trusted tokens
- •Database connection strings are stored only in your secret manager (Azure Key Vault, HashiCorp Vault, or Kubernetes secrets) — never in the application database
- •All data access is gated by role-based access control (CASL) — field-level and record-level
- •Audit logs are append-only and cannot be modified or deleted by the application
- •Script execution is isolated in V8 isolates (isolated-vm) with hard memory and CPU limits
- •All infrastructure communications use TLS in transit
- •Worker pods executing scripts have no inbound network access
Despite these measures, no security measure is 100% effective. In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours in accordance with GDPR Art. 33.
10. Data Protection Officer
Given the current scale of our operations, we are not legally required to appoint a mandatory DPO under GDPR Art. 37. However, data protection enquiries are handled by our founder and can be directed to:
Data protection contact: [email protected]
We aim to respond to all data protection enquiries within 5 business days.
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify active users of material changes by: - Displaying an in-application notification at next login - Updating the effective date below
The current version is always available at /privacy. Continued use of the platform after the effective date of a revised policy constitutes acknowledgement of the changes.
Last updated: May 2026
Effective date: May 2026
Version: 1.0
Exercise your data rights
To submit a data access, erasure, or portability request, contact [email protected] — we respond within 30 days.