Privacy Policy

How we handle your personal data.

Introduction

This notice relates to Scalign AS (Org no. 934 915 755, Edvard Storms gate 2, 0166 Oslo, Norway) and the Scalign service it owns and controls, including the Scalign.ai website referred to as the “Service.”

Data we collect and receive

Signup information required to complete account creation: your name and email address, received from the sign-in method you use (Google, Microsoft, SSO, or a magic link to your email).
Payment information for paying accounts.
Content and materials you store in your account, which are deleted upon account cancellation through our managed deletion process (completed within 30 days).
Data exchanged with third‑party services you choose to integrate (the Service may retrieve data from and send data to those services to provide functionality).

Customer (product) data we process

When you use the Scalign product, Scalign processes data on behalf of our customers (who act as data controllers) to deliver the service. This includes:

Meeting recordings, which are processed to produce transcripts and structured analysis. Online meetings are recorded in audio by a meeting bot or by the Scalign desktop app, and in video (camera and shared screen) as well if the workspace has enabled it. In-person meetings are recorded in audio with the desktop app. Scalign retains the transcripts, transcript metadata, and analysis, not the raw audio or video. Recording media is held by our recording sub-processor for the workspace's media retention period (30 days by default), during which it can be played back in the Service, and is then automatically deleted.
Transcripts and transcript metadata, including meeting transcripts imported from third-party recorders where that integration is enabled.
Calendar information related to meetings, read from the calendar account a user connects (Google or Microsoft) so the assistant can join scheduled meetings and link recordings to their events.
Email, where a workspace enables email sync and a user opts in: only messages exchanged with the workspace's known customer contacts, read from the mailbox the user connects (Google or Microsoft). Other mail is not retrieved. Synced email is used for account and deal insights, not to score or rate employees. Mail the user marks private in their mail client before it syncs is never stored, a user can remove any synced thread from the workspace, and a user or the workspace can block addresses and domains from sync; removal and blocking also erase what was synced. Scalign can also save a draft reply to the user's own mailbox when asked; it never sends mail.
Contact and deal data synchronised with a customer's CRM, where that integration is enabled.
Information from public web sources used to enrich company and contact records.

For online meetings, speaker attribution uses the participant identity supplied by the meeting platform. For in-person recordings, where no platform identity exists, speech is separated by voice into anonymous speaker labels within that single recording only, which the customer's user then maps to participants. Scalign does not create, store, or match voiceprints or other biometric identifiers, and no voice-derived data persists across recordings.

Data subjects include all meeting participants — including external participants who do not have a Scalign account. The customer, as data controller, is responsible for informing participants and for the lawful basis for the processing, including obtaining any consent required to record meetings.

For this product data, our customer is the data controller and Scalign is the data processor. We process it only on the customer's documented instructions and only to provide the service, as set out in our Data Processing Agreement.

This product data is stored in the EU and encrypted in transit and at rest. It is processed by the sub-processors listed on the sub-processors page, including large language model providers used to generate summaries and insights. These providers do not use the data to train their models, and transfers outside the EEA are protected by EU Standard Contractual Clauses or an applicable adequacy decision.

Google user data. Where a user connects a Google account, Scalign requests only the Google API scopes needed for the features the user enables, and uses the data received solely to provide those user-facing features. Scalign's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, never used for advertising, and never used to train AI or machine-learning models.

We do not access customer workspace content in the ordinary course of business; limited access occurs only to provide support, diagnose technical issues, or investigate security incidents, by authorised personnel and subject to confidentiality obligations.

Purposes and how we use personal data

To operate and provide the Service, including use of third‑party vendors and hosting partners for hardware, software, networking, storage, and related technology.
To provide optional integrations you enable, which require retrieving data from and sending data to the relevant third‑party services under their terms and privacy policies.
To ensure stable operation and control costs, including the ability to impose reasonable limits or require plan changes where usage is significantly above typical patterns.

Content you record or import into a workspace — including meeting recordings, transcripts, and insights derived from them — is visible to other members of that workspace by default. Visibility is governed by workspace roles (owner, admin, member) and per-recording visibility controls: individual recordings can be restricted to specific members, and recordings can be deleted in the product at any time. Recording a meeting is always optional.

Insights from synced email are shared with the workspace like meeting insights, and short quotes from email may appear as evidence in shared views. Disconnecting a mailbox stops further sync; mail already synced stays with the workspace unless a user removes the thread or a user or the workspace blocks the correspondent.

Cookies and tracking technologies

The Scalign website and the Service use cookies and similar technologies (including browser storage and analytics identifiers) to ensure proper functionality, improve user experience, and understand how the Website and Service are used.

Cookies are small text files stored on your device. Similar technologies may include local storage, session storage, pixels, and analytics identifiers.

We use the following categories of technologies:

These technologies are required for core functionality, security, and reliability of the Website and Service. They do not track users across unrelated websites.

Sentry is used for error monitoring and diagnostics. Its purpose is to maintain service reliability and detect technical issues. Sentry does not use persistent storage on the user’s device. Data is processed within the EU, with infrastructure located in Frankfurt, Germany.

Vercel / Infrastructure Services are used for website delivery, performance optimization, and service security. These services may rely on transient technical mechanisms necessary for operation, but do not involve intentional persistent storage on the user’s device. Vercel Web Analytics provides aggregate page-view counts without cookies or persistent identifiers. Data is handled within the EU.

These technologies are always active as they are necessary for the operation and security of the Service.

These technologies help us understand how visitors and users interact with the Website and Service, measure usage patterns, and improve product performance.

They are only activated after you provide consent via the cookie banner.

Google Analytics is used for website traffic measurement, aggregated usage statistics, and performance insights. It relies on cookies and analytics identifiers to function. Data processing may involve transfers or processing outside the EU/EEA, depending on Google’s infrastructure and configuration.

Mixpanel is used for product usage analytics, feature interaction analysis, and service improvement. It uses browser-based storage mechanisms such as local storage and identifiers. With your consent, Mixpanel also records a sample of sessions (session replay, with all on-screen text and inputs masked) and heatmaps of clicks and scrolls. Data is processed within the EU using Mixpanel’s EU instance. Our servers also send Mixpanel workspace-level usage counts, without personal identifiers.

These providers may collect information such as:

Pages visited
Device and browser information
Approximate location derived from IP
Interaction and usage events
Session and engagement metrics

When you first visit the Website, you will be presented with a cookie banner requesting your consent for non-essential technologies. In the Service, you are asked during onboarding whether to share usage data, and you can change your choice at any time under Settings → Account. You may:

Accept all cookies
Reject non-essential cookies
Adjust your preferences

You can withdraw or modify your consent at any time through the cookie settings interface or your browser settings.

The lifespan of cookies and identifiers varies depending on purpose. Some cookies expire when you close your browser, while others may remain for longer periods.

Details about specific cookies may be provided in the cookie banner or preferences center.

Lawful bases for processing

We rely on the following legal bases under the GDPR:

Legitimate Interest (Article 6(1)(f) GDPR)

To operate, secure, and maintain the Website and Service, including essential technical functionality, error monitoring, fraud prevention, and infrastructure security.

Consent (Article 6(1)(a) GDPR)

For analytics, performance, and tracking technologies that are not strictly necessary, including Google Analytics and Mixpanel. These technologies are only activated after you provide explicit consent.

Performance of a Contract (Article 6(1)(b) GDPR)

To provide the Service, manage user accounts, process payments, and fulfill contractual obligations.

Recipients and disclosure

Third‑party vendors and hosting partners that support operation of the Service (hardware, software, networking, storage, and related technology).
Third‑party services and platforms you choose to integrate with, under those third parties’ terms and privacy policies.

Scalign's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Security

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These measures include access controls, encryption in transit and at rest using AES-256, monitoring, and security hardening practices appropriate to the nature of the Service.

Access to customer data

Scalign processes Customer data primarily through automated systems to provide the functionality of the Service.

We do not access or review Customer workspace content in the ordinary course of business.

In limited situations, access to Customer data may be required to:

Provide support requested by the Customer
Diagnose or resolve technical issues
Investigate security incidents or Service malfunctions

Any such access:

Is performed only by authorized personnel with a legitimate business need
Is limited to the data reasonably necessary for the specific purpose
Is subject to confidentiality obligations and access controls

Where technically feasible, such access is logged and protected by internal security procedures.

International data transfers

Customer data is stored and primarily processed in the EU. Some sub-processors process data outside the EEA, notably in the United States (for example AI inference). Such transfers rely on the EU Standard Contractual Clauses, the UK Addendum where applicable, or an adequacy decision, supported by transfer impact assessments and encryption. Locations are shown on the sub-processors page.

Where integrations are enabled, personal data may be retrieved from or sent to those third‑party services in accordance with their terms and privacy policies.

Retention

Deleted content is held for a short grace period so an accidental deletion can be undone: a deleted meeting recording is permanently erased after 24 hours, and a deleted workspace after 14 days. Within that window you can ask us to restore it, or to erase it sooner.
Synced email is kept for as long as the workspace exists, like transcripts, until a user removes the thread or a user or the workspace blocks the correspondent, or until deleted on request.
Audio and video is kept by our recording sub-processor for the workspace's media retention period (30 days by default) and then deleted, even if the recording itself is not; erasing a recording or workspace deletes it sooner. The transcript and analysis are unaffected.
If you cancel your account, your content is deleted through our managed deletion process, completed within 30 days. Deleted data ages out of encrypted backups within 42 days.
Scalign may delete accounts that have been inactive for an extended period (at least 90 consecutive days with no login and no API/integration activity). Before deleting an inactive account, we will send notice to the account owner at least 14 days in advance. Paid subscriptions are not deleted for inactivity.

Children

The Service is intended only for professional users who are at least 18 years old; Scalign does not knowingly collect or process personal data of individuals under 18.

Your rights

Rights under GDPR (access, rectification, erasure, restriction, objection, portability) can be exercised by contacting Scalign at: hello@scalign.ai

You also have the right to lodge a complaint with your local data protection authority if you believe your rights under data protection law have been infringed.

Changes

We may update this Privacy Notice from time to time. We will notify you of any material changes by posting the updated notice on our website or by contacting you directly.