Dasar Privasi

This policy explains what Scaleboard ("we", "us") collects when you use Scaleboard (the "Service"), why, and the choices you have. It is written to meet the Personal Data Protection Act 2010 of Malaysia (PDPA) and the data policies of the advertising platforms we connect to.

1. What we collect

Account information

• Your name, email address and password (stored only as a one-way hash), and two-factor or passkey settings if you turn them on.
• Your organizations, workspaces, team members, roles and invitations.

Advertising data you connect

When you connect an ad account, you sign in with the platform and grant read-only access. We then read:

• Meta (Facebook and Instagram), with the ads_read permission: your ad accounts, campaigns, ad sets and ads, their creatives (images, video thumbnails, ad copy and headlines) and daily performance metrics.
• TikTok for Business: the advertisers you authorize, their ads, video covers and images, and daily performance metrics.
• Google Ads, with the adwords scope and your Google email address: the Google Ads accounts you can access, their ads, YouTube video IDs and titles, images and daily performance metrics.
• From the Meta Ad Library, when you ask us to, public ads of brands you follow.

We never create, edit, pause or pay for ads, and we never post anything on your behalf. Access tokens are encrypted at rest.

Content you add

Report settings, naming conventions, notes, alert rules, AI chat messages, and inspiration you save (links, uploaded images and videos). When you save a link we fetch the public page to show its title and preview image.

Billing information

Payments are processed by Stripe. We receive and keep your Stripe customer and subscription IDs, plan and payment status. We never see or store your full card number.

Technical information

Server logs (IP address, browser and pages requested) for security and troubleshooting, and essential cookies that keep you signed in and protect forms. We do not use advertising or cross-site tracking cookies.

2. How we use it

• To provide the Service: syncing your ads, grouping creatives, calculating metrics, reports, sprints, leaderboards, alerts and share links.
• To provide AI features you use: tagging creatives, analysing reports, answering chat questions and breaking down saved inspiration.
• To send emails you need: invitations, alerts you set up, security and billing messages.
• To bill you, keep the Service secure, prevent abuse, and meet legal obligations.

We do not sell your data, use it for advertising, or use your advertising data to build profiles of people who see your ads.

3. AI processing

AI features are powered by Google's Gemini API. When you use them, the relevant creative images, ad copy, report metrics and your chat messages are sent to Google to generate the answer. We do not use your data to train AI models.

4. Google user data

Scaleboard's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Ads data only to show you reports and insights inside the Service, we do not transfer it to others except as needed to provide those features (for example AI processing as described above), as required by law, or as part of a merger with notice to you, and our staff do not read it unless you ask us to for support, or it is needed for security or legal reasons.

5. Who we share data with

• Service providers that run the Service for us: hosting and database, email delivery, Google (Gemini AI) and Stripe (payments). They may only use the data to provide their service to us.
• The advertising platforms you connect, when we call their APIs on your behalf.
• People you choose: members and guests you invite, and anyone who opens a share link you create. You can turn a share link off at any time.
• Authorities, when required by law.

Some providers process data outside Malaysia. When they do, we rely on their contractual and security commitments to protect it.

6. How long we keep it

• Disconnecting an ad account deletes the ads, creatives and metrics we synced from it.
• Deleting your account deletes your user profile and the organizations you own, with all their workspaces and data.
• Billing records are kept as long as tax law requires.
• Backups are overwritten on a rolling basis and kept no longer than 30 days.

See Data deletion for step-by-step instructions.

7. Security

Data is encrypted in transit (HTTPS), platform tokens are encrypted at rest, access is limited by organization roles, and we support two-factor authentication and passkeys.

8. Your rights

Under the PDPA you can ask to access or correct your personal data, and withdraw consent to its processing (which may mean closing your account). Most data can be viewed, corrected or deleted directly in the Service. For anything else, email privacy@usescaleboard.com; we answer within 21 days.

9. Children

The Service is for businesses and is not meant for anyone under 18.

10. Changes

We will post changes here and update the date above. If a change is significant, we will tell account owners by email before it applies.

11. Contact

Scaleboard, Kuala Lumpur, Malaysia. Email: privacy@usescaleboard.com.