This Privacy Policy describes how S.C.A.L.A. AI OS ("we", "our") collects, uses, and protects your personal data.
The data controller is Alessandro Binda, Milan, Italy. Contact: [email protected].
We collect: account information (name, email), usage data (feature interactions, AI queries), billing data (processed by Stripe), and SARA WhatsApp conversation data (stored encrypted, never shared).
We process data to: provide the S.C.A.L.A. AI OS platform, improve our services, send transactional emails, and comply with legal obligations. We do NOT sell your data.
Processing is based on: contract performance (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f)), and consent where required (Art. 6(1)(a)).
All data is stored in the European Union (Hetzner, Germany). Database backups are encrypted (AES-256) before they leave our servers; the key is not stored with the off-site copies.
AI features use EU-compliant providers. Your data is never used to train third-party AI models. On-premise AI fallback is available for enterprise clients.
We share data only with: Stripe (payments), AWS SES (transactional email), and AI inference providers (Groq, Mistral, Gemini) under data processing agreements. Account and platform data is never shared for advertising purposes (Google AdSense on this website: see Cookies and analytics).
The following sub-processors are engaged in data processing on our behalf, each under a Data Processing Agreement (DPA): Twilio Inc. (USA) — VoIP and SMS services, with DPA and Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR; Amazon Web Services EMEA SARL (EU-North-1 region) — Email delivery via SES; Meta Platforms Ireland Ltd. — WhatsApp Business API; Groq Inc. (USA) — AI inference, with DPA and SCC; Mistral AI (France, EU) — AI inference. All non-EU sub-processors operate under appropriate safeguards as required by Chapter V GDPR.
If you subscribe, we process your email address, the date and time of your confirmation, a truncated IP address (last octet removed for IPv4, last 80 bits for IPv6) and the version of the consent text you saw, to send you the newsletter and to prove your consent. Legal basis: consent (Art. 6(1)(a) GDPR), given by confirming the email we send you (double opt-in). Nothing is sent before you confirm. Every email contains an unsubscribe link; after you unsubscribe we keep only your address on a suppression list so that we do not email you again. We do not track email opens. Sender and provider: AWS SES (EU region, eu-north-1). Controller: Binda Alessandro (sole proprietorship), Corso Ventidue Marzo 4, 20135 Milano, Italy, VAT IT14153960969 — [email protected].
Under GDPR you have the right to: access, rectify, erase, restrict processing, data portability, and object to processing. To exercise these rights, email [email protected].
Account data is retained for the duration of your subscription plus 30 days. You may request deletion at any time via our data deletion page.
We may update this policy. Material changes will be communicated via email to registered users.
Last updated: October 2026