Privacy Policy
What personal data uscale collects, why, who helps us process it, and your rights.
1. Who is responsible
Scaleform OÜ (registry code 17409408, Tornimäe tn 5, Kesklinna linnaosa, 10145 Tallinn, Harju maakond, Estonia) is the controller of the personal data described here. Contact us about privacy at privacy@uscale.ai.
When you use uscale to film your own product, the data inside that product (for example names or emails visible on screen) is processed on your behalf. For that data you are the controller and we act as your processor.
2. What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Email address, your first and last name, workspace name, sign-in times | To create your account, sign you in with a one-time link, and know who we are making videos for |
| Sign-up questions (optional) | Your company or brand name, how you heard about uscale, your company's size and industry, your role, what you want to make, and anything you tell the director | To make your first video for the right people and understand who uses uscale; you can skip them |
| Product access | Product URLs and repositories, logins you give us, saved browser sessions after you sign in through our streamed browser | To open and film the product you chose. Logins and sessions are stored encrypted (AES-256-GCM) |
| Your content | Screen recordings and screenshots of your product, uploaded logos and files, reference videos, chat messages with the director, facts you tell us | To plan, write, design and render your videos |
| Generated output | Scripts, narration audio, captions, videos, post copy | To deliver your videos and keep previous versions |
| A call from our marketing agent | When you ask for a call on uscale.ai/marketing-agent: your name, business name, type of business, city, state, mobile number, email, your website if you give it, what you need help with, your time zone, the page and ad that brought you, and your consent with its time. When the agent calls: the call audio, a transcript and what you told us about your business. When a call is booked: its time and format | To call and text you about your request, including with automated technology and an AI voice, to book and prepare your intro call, and to see which pages and ads work. Reply STOP to any text, or tell the agent on a call, and we won’t contact you again |
| Technical and usage | IP address, browser type, server and job logs, records of AI requests and their cost, product analytics events (pages and features used, with your consent for cookies) | To run, secure, debug and improve the Service and to account for usage |
We use PostHog, hosted in the EU, to measure how uscale.ai and the app are used and to receive error reports. Until you choose in the cookie bar, visits are counted without cookies or other identifiers stored on your device. If you choose "Allow", PostHog sets first-party analytics cookies on uscale.ai so that pages and later visits can be connected; if you choose "Decline", counting stays cookieless. Outside the United States, Australia and New Zealand, only if you choose "Allow", we also load the Meta pixel to measure the results of our ads on Facebook and Instagram. If you visit from the United States, Australia or New Zealand, we load it without asking first, under the opt-out rules that apply there; you can opt out at any time with "Do not sell or share my info" at the bottom of every page, and we treat a Global Privacy Control signal from your browser as an opt-out. We work out whether you visit from one of these countries from your IP address on our own server, using DB-IP's IP-to-country data (IP Geolocation by DB-IP, CC BY 4.0); the address is not stored for this. The pixel sets Meta's cookies and tells Meta that a page was visited, a sign-up was started or completed, the sign-up questions were answered (not the answers themselves), a purchase was started, a video was started, or a call booking was opened or made, and, on the marketing agent pages, that you opened the request for a call or asked for one, that the agent’s call with you took place and that a meeting was booked (not what was said), in the browser that saw the ad. Some of these events are sent from your browser and some from PostHog's servers. When you book a call, the booking link carries your browser type and Meta's cookie identifiers through our booking provider, so that the booked call can be reported in the same way. With them Meta receives the page address, your IP address and browser type, Meta's own cookie identifiers and, when you have an account, book a call or ask the marketing agent for one, your email address in hashed (one-way scrambled) form, so that Meta can match the event to an ad it showed. We do not send Meta your name or anything you make with uscale. Preference cookies (uscale_analytics, uscale_consent_v) remember your choice for a year; clear them in your browser to choose again. When you are signed in, we link usage events, such as videos generated and credits bought, to your account to run and improve the Service. The app keeps your sign-in session in your browser's local storage. Fonts are loaded from Google Fonts and some scripts from the jsDelivr network, which receive your IP address when your browser fetches them.
3. Legal bases
- Contract (GDPR Art. 6(1)(b)): providing the Service you signed up for.
- Legitimate interests (Art. 6(1)(f)): keeping the Service secure, preventing abuse, fixing faults and improving quality.
- Legal obligation (Art. 6(1)(c)): keeping accounting records when you buy something.
4. AI and your content
Your content is sent to AI model providers to write, design and check your videos. We do not use your content to train AI models, and the providers we use do not train their models on data sent through their business APIs under their terms.
5. Who we share data with
We use these service providers (processors). They may only use the data to provide their service to us.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers that run uscale, film products and render videos | Germany |
| Supabase, Inc. | Database, sign-in and file storage | United States (AWS) |
| Anthropic, PBC | AI models for planning, writing, design and quality checks, and the AI assistant that answers in the chat on our website | United States |
| Crisp IM SAS | The chat on our website: the messages you send there and anything you share in them, such as your email address | France (EU) |
| Slack Technologies, LLC | Notifications to our team, including the messages sent in the chat on our website | United States |
| OpenAI, L.L.C. | AI models used to draft animation code | United States |
| ElevenLabs, Inc. | Voiceover and sound generation, and the voice, recording and transcript of the marketing agent’s calls | United States |
| Twilio Inc. | The phone line for the marketing agent’s calls and texts | United States |
| AtlasCloud and Higgsfield AI | AI video clips used as cutaways, only when your video uses them | United States / other |
| Apify Technologies s.r.o. | Downloading a reference video from a social link you give us, and reading a public social profile you give us | Czech Republic |
| PostHog, Inc. (PostHog Cloud EU) | Website and product analytics, error reports | EU (Germany) |
| Google LLC (Google Maps) | The map on the marketing agent pages; when the map loads, Google receives your IP address and browser details | United States |
| Meta Platforms Ireland Limited | Measuring the results of our ads on Facebook and Instagram (the Meta pixel), only after you allow cookies | Ireland / United States |
| Composio, Inc. | Connections to accounts you link to uscale (Gmail, Google Calendar, Facebook, Instagram, your Meta ad account and others): it keeps the access you grant and makes the calls you approve | United States |
| Attio Ltd | Customer records: your name, email, company and website, your answers to the sign-up questions, and calls you book with us | United Kingdom / United States |
| Cal.com, Inc. | Booking a call with us, when you choose to | United States |
| Google (Workspace, Fonts) | Email for support and privacy requests; web fonts | United States / EU |
We also look up public information such as GitHub repositories and product logos by name when your video needs them. We do not sell personal data. We may disclose data if the law requires it or to protect the rights and safety of our users or others.
Text messages. If you ask for a call on uscale.ai and tick the box agreeing to calls and texts, we may text you about that request: a reminder before a call you booked, and at most one follow-up after our assistant called you. Message frequency varies, and message and data rates may apply. Reply STOP to stop texts at any time, or HELP for help (or write to privacy@uscale.ai). No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties. Our phone provider (Twilio) only delivers the messages for us.
6. Transfers outside the EU
Some providers are in the United States. Where a transfer is not covered by an adequacy decision, including the EU–US Data Privacy Framework for certified providers, we rely on the European Commission's standard contractual clauses.
7. How long we keep data
- Account data, your content and videos: for as long as your account exists. When you delete a project or your account, we delete its data within 30 days, and backups are overwritten on a rolling basis afterwards.
- Logins and saved sessions: until you remove them or delete the project.
- Logs and usage records: usually up to 12 months.
- Accounting records: as long as Estonian law requires, currently 7 years.
8. Security
Data is sent over encrypted connections. Stored logins and browser sessions are encrypted, access to production systems is restricted, and each workspace can only see its own projects.
9. Your rights
You can ask to access, correct, delete, restrict or export your personal data, and object to processing based on legitimate interests. Write to privacy@uscale.ai. We answer within one month. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the authority in your country.
Deleting data from connected accounts (Facebook, Instagram, Google and others)
If you connected Facebook, Instagram, a Meta ad account or another account to uscale, you can remove our access and your data at any time:
- Disconnect it in the uscale app under Channels & connections, or remove "uscale" from the account itself (on Facebook: Settings & privacy, Settings, Business integrations).
- To have the data we read from it deleted, write to privacy@uscale.ai from the email address of your uscale account, or delete your uscale account. We delete it within 30 days and confirm by email.
10. Changes
We will update this policy when our processing changes and show the new effective date above. If a change is material, we will tell you by email or in the app.