Privacy Policy

Business: ScaleFlow AI

Website: www.scaleflowai.net

Contact: [email protected]

Last updated: June 2026

This Privacy Policy explains how ScaleFlow AI collects, uses, stores, and protects your personal data when you visit our website or submit an enquiry. We are committed to handling your data lawfully, fairly, and transparently in accordance with the EU General Data Protection Regulation (GDPR) and Irish data protection law.

Please read this policy carefully. If you have any questions, contact us at [email protected].

1. Who We Are

ScaleFlow AI is the data controller responsible for your personal data.

Business name: ScaleFlow AI

Business address: Green Road, Carlow

Contact email: [email protected]

Website: www.scaleflowai.net

As data controller, we determine the purposes and means of processing your personal data and are legally responsible for how it is handled.

2. Information We Collect

We collect personal data only when you voluntarily provide it through our website enquiry form. This includes:

●      Full name

●      Business name

●      Email address

●      Phone number

●      Website or Facebook page URL

●      Business type and industry

We do not collect sensitive personal data (such as health information, financial details, or government ID numbers). We do not use cookies, tracking pixels, or analytics tools on our website.

3. How We Use Your Data

We use your personal data for the following purposes:

●      To respond to your enquiry about ScaleFlow AI services

●      To contact you and arrange a demonstration of our platform

●      To provide you with information about how ScaleFlow AI could work for your business

●      To send you non-marketing service updates related to your enquiry (with your consent)

●      To send you marketing and promotional messages, including special offers and product updates (only if you have explicitly ticked the marketing consent box on our form)

●      To comply with our legal obligations

4. Legal Basis for Processing (GDPR)

Under GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

●      Legitimate interests (Article 6(1)(f)): To respond to your enquiry and follow up in relation to the services you requested. We have assessed that our legitimate interests are not overridden by your rights.

●      Consent (Article 6(1)(a)): For any marketing or promotional messages. You may withdraw consent at any time by emailing us or replying STOP to any message.

●      Legal obligation (Article 6(1)(c)): Where we are required to process your data by law.

5. AI-Specific Data Handling

ScaleFlow AI uses artificial intelligence tools to power our messaging and booking service. Here is how this affects your data:

AI Processing

When our system generates automated replies to customer messages, the content of those messages may be processed by third-party AI providers (including OpenAI and ElevenLabs) solely to generate a relevant response. We do not use your personal data to train AI models.

Automated Responses

Our platform generates automated text responses on behalf of our clients' businesses. These responses are triggered by incoming messages and are designed to answer questions and facilitate bookings. No fully automated decisions are made about you as an individual that produce legal or significant effects without human oversight.

No Profiling

We do not profile individuals or make automated decisions that significantly affect you based on your personal data.

6. Third-Party Services

To operate our platform, we work with the following third-party service providers. Each provider has their own privacy policy and data processing practices:

GoHighLevel (CRM and Website Platform)

Used to store your contact details and manage enquiries. GoHighLevel is based in the United States. Data is transferred under Standard Contractual Clauses.

Privacy policy: www.gohighlevel.com/privacy-policy

OpenAI

Used to power AI-generated message responses. Message content may be processed by OpenAI servers based in the United States. OpenAI does not use API data to train its models by default.

Privacy policy: openai.com/policies/privacy-policy

ElevenLabs

Used for AI voice generation where applicable. Data may be processed on servers outside the EU.

Privacy policy: elevenlabs.io/privacy

Make (formerly Integromat)

Used to automate workflows between our tools. Data passes through Make servers during processing.

Privacy policy: www.make.com/en/privacy-notice

n8n

Used as an automation and integration tool. Data may be processed through n8n workflows.

Privacy policy: n8n.io/legal/privacy

We only share the minimum data necessary with these providers. We do not sell your data to any third party.

7. International Data Transfers

Several of our third-party providers are based in the United States, which is outside the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:

●      Standard Contractual Clauses (SCCs) approved by the European Commission

●      Transfers to providers who participate in the EU-US Data Privacy Framework where applicable

By submitting your details through our website, you acknowledge that your data may be processed in the United States or other countries outside the EEA, subject to these safeguards.

8. Data Retention

We retain your personal data for as long as necessary to provide our services or until you request deletion.

Specifically:

●      If you request a demo and do not become a client, we will retain your details until you ask us to delete them

●      If you become a client, your data will be retained for the duration of our agreement and for a reasonable period afterwards for administrative purposes

●      You may request deletion of your data at any time by emailing [email protected]

We will process all deletion requests within 30 days, unless we are legally required to retain certain records.

9. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

●      Right of access: Request a copy of the personal data we hold about you

●      Right to rectification: Ask us to correct any inaccurate or incomplete data

●      Right to erasure: Ask us to delete your personal data (right to be forgotten)

●      Right to restriction: Ask us to limit how we process your data in certain circumstances

●      Right to data portability: Receive your data in a structured, machine-readable format

●      Right to object: Object to processing based on legitimate interests or for direct marketing purposes

●      Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please email: [email protected]

We will respond within 30 days. We may need to verify your identity before processing your request.

10. Security Measures

We take the security of your personal data seriously. The following measures are in place:

●      Access to your personal data is limited to authorised personnel only (currently the business owner)

●      All data is stored within password-protected, access-controlled platforms

●      Our third-party providers (GoHighLevel, OpenAI, etc.) use industry-standard encryption and security protocols

●      We regularly review who has access to personal data

While we take all reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. If you believe your data has been compromised, please contact us immediately.

11. Automated Decision-Making and Profiling

ScaleFlow AI does not make automated decisions about individuals that produce legal or similarly significant effects without human involvement. Our AI tools generate automated message responses on behalf of client businesses, but these do not make decisions about individuals based on profiling.

12. Children's Data

Our services are intended for business owners and are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected a child's data, please contact us and we will delete it promptly.

13. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing any personal data.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page will always reflect when it was last updated. We encourage you to review this policy periodically.

Continued use of our website after any changes constitutes acceptance of the updated policy.

15. How to Complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC):

Data Protection Commission

●      Website: www.dataprotection.ie

●      Phone: +353 57 868 4800

●      Email: [email protected]

●      Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland

We would, however, appreciate the opportunity to address your concerns before you contact the DPC. Please email us first at [email protected].

16. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your data, please contact us:

ScaleFlow AI

Email: [email protected]

Website: www.scaleflowai.net

Address: Green Road, Carlow