Privacy Policy
What personal data uscale collects, why, who helps us process it, and your rights.
1. Who is responsible
Scaleform OÜ (registry code 17409408, Tornimäe tn 5, Kesklinna linnaosa, 10145 Tallinn, Harju maakond, Estonia) is the controller of the personal data described here. Contact us about privacy at privacy@uscale.ai.
When you use uscale to film your own product, the data inside that product (for example names or emails visible on screen) is processed on your behalf. For that data you are the controller and we act as your processor.
2. What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Email address, your first and last name, workspace name, sign-in times | To create your account, sign you in with a one-time link, and know who we are making videos for |
| Sign-up questions (optional) | Your company or brand name, how you heard about uscale, your company's size and industry, your role, what you want to make, and anything you tell the director | To make your first video for the right people and understand who uses uscale; you can skip them |
| Product access | Product URLs and repositories, logins you give us, saved browser sessions after you sign in through our streamed browser | To open and film the product you chose. Logins and sessions are stored encrypted (AES-256-GCM) |
| Your content | Screen recordings and screenshots of your product, uploaded logos and files, reference videos, chat messages with the director, facts you tell us | To plan, write, design and render your videos |
| Generated output | Scripts, narration audio, captions, videos, post copy | To deliver your videos and keep previous versions |
| A call from our marketing agent | When you ask for a call on uscale.ai/marketing-agent: your name, business name, type of business, city, state, mobile number, email, your website if you give it, what you need help with, your time zone, the page and ad that brought you, and your consent with its time. When the agent calls: the call audio, a transcript and what you told us about your business. When a call is booked: its time and format | To call and text you about your request, including with automated technology and an AI voice, to book and prepare your intro call, and to see which pages and ads work. Reply STOP to any text, or tell the agent on a call, and we won’t contact you again |
| Technical and usage | IP address, browser type, server and job logs, records of AI requests and their cost, product analytics events (pages and features used, with your consent for cookies) | To run, secure, debug and improve the Service and to account for usage |
We use PostHog, hosted in the EU, to measure how uscale.ai and the app are used and to receive error reports. Until you choose in the cookie bar, visits are counted without cookies or other identifiers stored on your device. If you choose "Allow", PostHog sets first-party analytics cookies on uscale.ai so that pages and later visits can be connected; if you choose "Decline", counting stays cookieless. Outside the United States, only if you choose "Allow", we also load the Meta pixel to measure the results of our ads on Facebook and Instagram. If you visit from the United States, we load it without asking first, under US opt-out rules; you can opt out at any time with "Do not sell or share my info" at the bottom of every page, and we treat a Global Privacy Control signal from your browser as an opt-out. We work out whether you visit from the United States from your IP address on our own server, using DB-IP's IP-to-country data (IP Geolocation by DB-IP, CC BY 4.0); the address is not stored for this. The pixel sets Meta's cookies and tells Meta that a page was visited, a sign-up was started or completed, the sign-up questions were answered (not the answers themselves), a purchase was started, a video was started, or a call booking was opened or made, and, on the marketing agent pages, that you asked for a call, that the agent’s call with you took place and that a meeting was booked (not what was said), in the browser that saw the ad. Some of these events are sent from your browser and some from PostHog's servers. When you book a call, the booking link carries your browser type and Meta's cookie identifiers through our booking provider, so that the booked call can be reported in the same way. With them Meta receives the page address, your IP address and browser type, Meta's own cookie identifiers and, when you have an account, book a call or ask the marketing agent for one, your email address in hashed (one-way scrambled) form, so that Meta can match the event to an ad it showed. We do not send Meta your name or anything you make with uscale. Preference cookies (uscale_analytics, uscale_consent_v) remember your choice for a year; clear them in your browser to choose again. When you are signed in, we link usage events, such as videos generated and credits bought, to your account to run and improve the Service. The app keeps your sign-in session in your browser's local storage. Fonts are loaded from Google Fonts and some scripts from the jsDelivr network, which receive your IP address when your browser fetches them.
3. Legal bases
- Contract (GDPR Art. 6(1)(b)): providing the Service you signed up for.
- Legitimate interests (Art. 6(1)(f)): keeping the Service secure, preventing abuse, fixing faults and improving quality.
- Legal obligation (Art. 6(1)(c)): keeping accounting records when you buy something.
4. AI and your content
Your content is sent to AI model providers to write, design and check your videos. We do not use your content to train AI models, and the providers we use do not train their models on data sent through their business APIs under their terms.
5. Who we share data with
We use these service providers (processors). They may only use the data to provide their service to us.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers that run uscale, film products and render videos | Germany |
| Supabase, Inc. | Database, sign-in and file storage | United States (AWS) |
| Anthropic, PBC | AI models for planning, writing, design and quality checks, and the AI assistant that answers in the chat on our website | United States |
| Crisp IM SAS | The chat on our website: the messages you send there and anything you share in them, such as your email address | France (EU) |
| Slack Technologies, LLC | Notifications to our team, including the messages sent in the chat on our website | United States |
| OpenAI, L.L.C. | AI models used to draft animation code | United States |
| ElevenLabs, Inc. | Voiceover and sound generation, and the voice, recording and transcript of the marketing agent’s calls | United States |
| Twilio Inc. | The phone line for the marketing agent’s calls and texts | United States |
| AtlasCloud and Higgsfield AI | AI video clips used as cutaways, only when your video uses them | United States / other |
| Apify Technologies s.r.o. | Downloading a reference video from a social link you give us, and reading a public social profile you give us | Czech Republic |
| PostHog, Inc. (PostHog Cloud EU) | Website and product analytics, error reports | EU (Germany) |
| Google LLC (Google Maps) | The map on the marketing agent pages; when the map loads, Google receives your IP address and browser details | United States |
| Meta Platforms Ireland Limited | Measuring the results of our ads on Facebook and Instagram (the Meta pixel), only after you allow cookies | Ireland / United States |
| Attio Ltd | Customer records: your name, email, company and website, your answers to the sign-up questions, and calls you book with us | United Kingdom / United States |
| Cal.com, Inc. | Booking a call with us, when you choose to | United States |
| Google (Workspace, Fonts) | Email for support and privacy requests; web fonts | United States / EU |
We also look up public information such as GitHub repositories and product logos by name when your video needs them. We do not sell personal data. We may disclose data if the law requires it or to protect the rights and safety of our users or others.
6. Transfers outside the EU
Some providers are in the United States. Where a transfer is not covered by an adequacy decision, including the EU–US Data Privacy Framework for certified providers, we rely on the European Commission's standard contractual clauses.
7. How long we keep data
- Account data, your content and videos: for as long as your account exists. When you delete a project or your account, we delete its data within 30 days, and backups are overwritten on a rolling basis afterwards.
- Logins and saved sessions: until you remove them or delete the project.
- Logs and usage records: usually up to 12 months.
- Accounting records: as long as Estonian law requires, currently 7 years.
8. Security
Data is sent over encrypted connections. Stored logins and browser sessions are encrypted, access to production systems is restricted, and each workspace can only see its own projects.
9. Your rights
You can ask to access, correct, delete, restrict or export your personal data, and object to processing based on legitimate interests. Write to privacy@uscale.ai. We answer within one month. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the authority in your country.
10. Changes
We will update this policy when our processing changes and show the new effective date above. If a change is material, we will tell you by email or in the app.