Privacy policy

The short version

Scaffle learns about your business from what you hand it, keeps that knowledge in a memory you can read line by line, and uses it to answer you. Five things worth knowing up front:

• We don’t sell or look at your data, we don’t run ads, and we don’t use your business’s material to train AI models.
• Every tool you connect is read-only. Scaffle can look; it cannot send, post, or change anything.
• You can read every fact Scaffle holds about your business, fix it, and delete it.

Who we are

Scaffle makes the software at scaffle.ai and decides what happens to the information described here, which makes us the controller of it. We’re a small alpha-stage company in the United States. One inbox handles all of this, and a person reads it: admin@scaffle.ai.

What we collect

• Your account: the email address you sign up with, and your name if you give one. Your password is held by our authentication provider and we never see it. You can also start anonymously and use Scaffle without giving us an email at all, in which case we hold no contact details for you until you claim the account.
• What you tell Scaffle about the business: its name and sector, website addresses you point it at, documents you upload, notes you type, and your answers to its questions. Files are turned into text in your browser before they reach us.
• Your conversations: the full transcript of each chat and each scheduled run. When a tool opens something to answer you — a message in a connected mailbox, say — that content is used for the answer and is not written into the transcript we keep.
• Memory: the plain-language facts Scaffle records about your business. Each one carries where it came from: your upload, your edit, a connected tool, a page it read, or something it noticed.
• Notes from the desktop companion: short written notes about what was on your screen, if you turn observation on. The section below covers exactly how that works.
• Usage figures: for each run, the model used, the token counts, and the cost. No prompt or reply text goes in that ledger. It exists so budgets hold and bills stay predictable.
• Forms on this site: the early-access form takes your name, email, company, role, sector, website, and whatever you write in the note. The feedback form takes your message, the page you were on, and your email if you leave one.
• Errors: when something breaks, our error monitoring provider records the technical details of the failure. It’s configured not to send personal information along with them.

What we don’t collect

No analytics, no tracking pixels, no advertising networks, no session recording. We don’t buy information about you from anyone. We don’t take payment details, because there is nothing to pay for yet. Our hosting providers keep the ordinary server logs any site needs to stay up and fend off abuse, and we don’t build profiles out of them.

What we do with it

We use your information to run Scaffle for you: researching the site and documents you point it at, building the memory of your business and keeping it current, answering your messages, running the scheduled work you set up, and metering usage against your plan. The forms on this site are how we get in touch about the alpha and how we find out what’s broken.

That is the whole list. We don’t sell your information, we don’t hand it to anyone who sells advertising, and we don’t use your business’s material to train AI models.

Connected tools, and Google user data

Scaffle can connect to tools your business already runs on, such as Gmail. Every connection is optional and read-only. Scaffle asks only for permission to look, so it cannot send, edit, delete, or post anything in a connected tool. The keys for a connection are encrypted before they are stored, using a key we keep outside the database.

Disconnecting in the app tells the provider to revoke our access and deletes the stored keys. We keep a record that the connection existed and which account it pointed at, so the sources on your memory page still make sense. Anything Scaffle already learned stays in your memory until you delete it there.

When you connect Gmail, Scaffle uses it for one thing: running the product for you. In the background it counts, and stores only those counts: how much came in this week, how much you sent, how big the unread pile is. When you ask about your inbox, or a scheduled briefing goes looking, it can search your mail and open specific messages. Message content is used to produce that answer or that briefing and is not retained afterwards. What stays is whatever it concluded about your business, in plain language on your memory page, where you can correct it or delete it.

We do not use Google user data for advertising. We do not sell it. We do not use it to train AI models. Message content goes to our AI model providers only so they can produce the answer or the briefing you asked for. No person at Scaffle reads your Google data unless you ask us to or the law requires it. You can cut off access whenever you like by disconnecting in the app, or from your Google account’s security settings. Scaffle’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Screen capture in the desktop app

The desktop companion can watch your screen and turn what it sees into short written notes. It stays off until you turn it on, and one toggle stops it everywhere.

When it takes a look, the image goes to a vision model that runs locally on your computer, which writes a sentence or two about what was on screen. The image is never written to disk or to our database. It exists in memory for the length of that one request and is then gone. If the model judges the screen personal or sensitive (banking, medical, passwords, private messages), the note is thrown away and nothing is kept.

Every note is listed on the privacy page inside the app. Delete any one of them, or clear the lot. A deleted note is out of the database and out of Scaffle’s memory.

Who else handles it, and where

Scaffle runs on a short list of service providers, each getting only what its job requires: hosting, a managed database, an authentication provider, AI model providers that receive your prompts and the material Scaffle is reasoning over, a web-reading service for the pages you point it at, transactional email, bot detection on the sign-in forms, and error monitoring. When a business signs up, a notice carrying the business name and the owner’s name and email goes to our internal team chat so a human sees it. If you import a skill from a public code repository, we fetch it from that repository’s host. The security page names our current providers, and you can always email us to ask.

Beyond that, we disclose your information only when the law requires it, and we’ll tell you when that happens unless we are barred from doing so. If Scaffle is ever bought or merged, your data moves with the business, and this policy travels with it until you are told otherwise.

We store and process your data in the United States, and we route model requests to providers serving from the United States. If you use Scaffle from anywhere else, your information is transferred here.

How long we keep it

We keep what you give us for as long as your account is open. There is no timer on any of it: nothing expires by itself and nothing is quietly archived. Early-access and feedback submissions stay until you ask us to remove them.

Deletions are real. Delete a memory fact or a screen note and it leaves the database on the spot. Delete a document and Scaffle stops using it immediately, and its record clears when your account does. Ask us to close your account and we delete what it holds.

Your controls

• See what we hold. The memory page lists every fact and document Scaffle has about your business, each with its source. The privacy page in the app lists every screen note. Your conversations are all in the app.
• Correct it. Edit any fact in place on the memory page. Your version replaces the old one and is marked as yours.
• Delete it. Delete facts, documents, and screen notes yourself, or clear all the notes at once. Disconnect any tool from the connectors page.
• Take it with you. Download any conversation as Markdown from the chat. There is no one-click export of everything yet, so email us and we’ll put a copy together.
• Close the account. Email us. Closing an account is a job we do by hand today rather than a button in the app. We’ll confirm it’s done within 30 days, and usually much sooner.
• Complain. Tell us and we’ll take it seriously. If you live somewhere with a data protection authority, you can complain to them as well, and you don’t have to come to us first.

These are open to everyone, wherever you live. We’ll ask you to write from the address on the account so we don’t hand your business’s data to a stranger, and we won’t treat you any differently for asking.

California and other US state rights

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California and other US state privacy laws. We never have. There is no opt-out for us to offer you, because there is nothing to opt out of.

If your state has a privacy law, it likely gives you the right to know what we hold, get a copy, correct it, delete it, and not be treated worse for asking. The controls above are how you use those rights, and email covers anything the app doesn’t. If we ever turn a request down, reply to our answer and someone else here will look at it again.

Security

What we do: connection keys are encrypted before storage with a key kept outside the database. Each account’s data is walled off inside the database itself, so one account’s queries cannot reach another’s. Your chats, documents, and email content are never written into our application logs. Everything travels over an encrypted connection.

What we don’t have: security certifications. Scaffle is an alpha-stage company with a small team. If something goes wrong with your data, we will tell you what happened and what we did about it.

Cookies and what sits in your browser

Your sign-in session and your light-or-dark choice live in your browser’s local storage. Answers you type into a questionnaire are held there too, so a refresh doesn’t cost you the work. We use no tracking cookies and no third-party analytics on this site. Our bot-detection provider sets what it needs to tell people from bots on the sign-in and sign-up forms.

Children

Scaffle is a tool for running a business. It isn’t meant for anyone under 16 and we don’t knowingly collect information from them. If you think a child has given us something, email us and we’ll delete it.

Changes to this policy

If this changes in a way that matters, we’ll update this page, change the date at the top, and email active accounts. Wording fixes get the new date and nothing more.