Privacy Policy

This Privacy Policy explains how Ascendant Labs Pte. Ltd., a private limited company incorporated in Singapore ("ScaleDM", "Ascendant Labs", "we", "our", or "us"), collects, uses, processes, stores, and protects personal data when you access or use:

• The ScaleDM web application and website at https://scaledm.io (the "Web App");
• The ScaleDM mobile application for Apple iOS / iPadOS ("iOS App");
• The ScaleDM mobile application for Android ("Android App");
• The ScaleDM backend services, APIs, short-link redirect service (scaledm.io/l/*), and webhook processors; and
• The ScaleDM AI connectors and Model Context Protocol (MCP) server endpoints integrated with artificial intelligence platforms (such as ChatGPT, Claude, and Muse) (collectively, the "Service").

We are committed to respecting your privacy and complying with global privacy laws, including the Singapore Personal Data Protection Act 2012 ("PDPA"), the European Union General Data Protection Regulation ("GDPR"), the United Kingdom Data Protection Act 2018 ("UK GDPR"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA / CPRA").

1. Who This Privacy Policy Applies To

• Connected Account Owners ("Users"): Creators, influencers, businesses, and brand representatives who connect an Instagram Professional (Business or Creator) account to ScaleDM via our Web App, iOS App, Android App, or an AI connector.
• Interacting Audience Members ("Commenters" or "Recipients"): Individuals who comment on a connected Instagram post or Reel, or who reply to or mention a connected Instagram Story, triggering an automated reply or direct message.
• Website Visitors: Anyone visiting https://scaledm.io or accessing tracked short links (scaledm.io/l/*).

2. Information We Collect

A. Your ScaleDM Identity and Connected Social Accounts

ScaleDM uses Firebase Authentication for Google and passwordless email sign-in. We store your Firebase user identifier, verified email address, and available display name to manage your ScaleDM account and workspace. Apple sign-in will be offered when configured.

When you connect Instagram professional accounts or Facebook Pages to ScaleDM, authorization occurs directly on Meta's official login portal. We never receive, process, or store your Instagram password. Upon your authorization, Meta grants us access to:

• Account Profile Data: Your Instagram account ID, username (handle), full name, profile picture URL, account category/type (Business or Creator), follower count, and media/post count.
• OAuth Access Token: An encrypted API authorization token provided by Meta that enables ScaleDM to read comments and send messages on your behalf. All access tokens are secured with dedicated AES-256-GCM encryption prior to database persistence.

B. Your Automation Configurations and Message Content

We store the automation settings and content you create in the Service:

• Triggers: The posts, Reels, or Stories you designate, and the keyword triggers or match rules you configure (e.g., exact match, contains words, or any comment);
• Reply & Message Templates: The public comment reply text, private direct message copy, quick reply choices, interactive buttons, and destination URLs you set up;
• Uploaded Images: Any images or graphics you upload to include in direct messages. Uploaded media is temporarily stored in our secure Google Cloud Storage bucket solely to allow Instagram's servers to fetch and deliver the image to the recipient. Uploaded images are permanently deleted when you delete the automation or your account.

C. Information from Interacting Audience Members (Commenters)

When a public user interacts with your connected Instagram account by commenting on a designated post or replying to a Story:

• Interaction Data: We receive real-time webhooks from Meta containing the commenter's Instagram Scoped ID ("IGSID"), Instagram username, comment text, media identifier, and interaction timestamp;
• Delivery & Verification Records: We record operational event logs, including whether the public reply was posted, whether the private DM was sent, whether the user passed the optional "Follow-Gate" check (verified in real time via Meta's Graph API), and whether the user tapped an interactive button;
• Link Click Metrics: When a recipient taps a tracked link (scaledm.io/l/{id}), we record the click event and timestamp, and immediately redirect them to your target destination;
• AUTOMATED 30-DAY RETENTION & PURGE: All granular commenter interaction records, individual message delivery logs, and commenter IDs are automatically and permanently purged from our database after 30 days. Only anonymized cumulative statistics (such as total DMs sent and total clicks) are retained with the automation record.
• No Monitoring of General DMs: ScaleDM does NOT read, inspect, intercept, or store any of your general or private direct messages outside of the specific automated interaction flow initiated by your triggers. Ordinary user conversations are completely ignored.

D. Mobile Device, Technical, and Diagnostic Information

• Push Notification Tokens: If you grant permission in the iOS App or Android App, we collect your Apple Push Notification service (APNs) device token or Google Firebase Cloud Messaging (FCM) registration token to deliver essential operational notifications (such as token expiration alerts or high-volume automation notifications). You can revoke notification permissions at any time in your device settings.
• Device Permissions (Photos / Media): In our iOS and Android mobile apps, you may grant permission to access your photo library (via NSPhotoLibraryUsageDescription on iOS and the system photo picker on Android) strictly when you choose to upload an image for a direct message or attach a screenshot to an in-app bug report. We do NOT access your camera, scan your photo library, or collect photos without your explicit manual selection.
• App Install Measurement (Android): The Android app includes the Meta SDK, which reports app installs and basic app-open events, with your device's advertising ID, to Meta so we can measure advertising performance. The SDK starts automatically when the Android release app opens. It may also report supported automatic app events, device information, SDK crash logs and diagnostics. You can reset or delete your advertising ID in Android settings. See optional advertising measurement for the information shared and your controls.
• Feedback and Diagnostics: When you submit in-app feedback, we receive your message, optional screenshot, app build version, mobile operating system version (iOS/Android), device hardware model, and recent error diagnostic traces.
• Server and Security Logs: Our Google Cloud hosting environment automatically logs standard web request details, including IP address, user-agent string, HTTP request method, and timestamp, retained for up to 30 days solely for security monitoring, DDoS mitigation, and debugging. We also record first-party counts of landing-page views and AI setup-link clicks, with a provider category inferred from an allowlisted referral domain or campaign source. These event payloads contain no persistent visitor identifier, full referrer URL, query string, chat content, or access token and are used to understand integration discovery and usage.
• Client-Side Storage: Mobile session credentials use iOS Keychain or encrypted Android storage. Web sessions use Secure HttpOnly cookies. Device-local drafts and privacy choices may use preferences or browser storage. Consented web ad-click identifiers may remain in session storage for that browser tab.

3. How We Use Information

Ascendant Labs uses your data strictly for legitimate operational purposes:

• Fulfilling Automations: To monitor comments, verify trigger keywords, post public replies, and transmit automated direct messages through Meta's official Instagram Graph API;
• Reporting and Analytics: To display conversion rates, follow verification stats, message delivery counts, and link click metrics in your dashboard;
• Service Reliability & Rate Pacing: To pace message delivery, prevent API rate-limit violations, and ensure compliance with Meta's developer limits;
• Account Administration & Security: To authenticate your sessions, maintain system security, detect fraud or abuse, and verify account integrity;
• Customer Support: To investigate bug reports, resolve technical errors, and answer your support inquiries;
• Legal Compliance: To comply with applicable laws, respond to lawful governmental requests, and enforce our Terms of Service.

Advertising measurement

Web registration measurement is off by default. If you opt in on the web, we send Meta a registration event after your first successful Instagram account connection. The event can include your hashed email and account ID, IP address, browser or device information, and advertising identifiers. Hashing does not make this information anonymous. Meta uses these data to match conversions to ads and measure advertising performance; this may constitute cross-context advertising sharing under applicable law. Messages, comments, recipients and automation content are not included.

On the web, optional Meta cookies (_fbp and _fbc) and an ad-click ID may be used after opt-in. In the Android app, the Meta SDK reports installs and app opens, plus supported automatic events and device information, as described above. The Android app does not send registration events.

Declining web measurement does not affect app features. Withdraw web measurement using Privacy choices on the web. Withdrawal stops future collection on that device and, when it reaches our server, cancels pending events. It cannot recall events already transmitted. Offline choices synchronize when you return online and reopen the app or privacy controls. Global Privacy Control is treated as a decline on the web.

Pending event delivery is retried for at most 24 hours. Identifying payloads are cleared after delivery, permanent rejection, withdrawal, or expiry. A minimal registration record is kept to prevent duplicates until you delete your ScaleDM workspace. Legacy temporary device signals expire through automatic cleanup. See Meta's privacy policy for Meta's processing and privacy controls.

Advertisements and Sponsored Content

ScaleDM is provided as a free service. To cover operating costs and maintain free access for all creators, we may display commercial advertisements, sponsored recommendations, or partner links within our web and mobile applications. We do not share your private direct messages, automations, comment logs, or audience contact information with advertisers. Any advertising partners are strictly prohibited from accessing your Instagram message contents or automation data.

4. Legal Bases for Processing (EEA / UK GDPR)

If you are located in the European Economic Area ("EEA") or United Kingdom ("UK"), we process your personal data under the following legal bases pursuant to Article 6 of the GDPR:

• Performance of a Contract (Art. 6(1)(b) GDPR): Processing is necessary to provide the Service, execute automations, and manage your account pursuant to our Terms of Service.
• Legitimate Interests (Art. 6(1)(f) GDPR): Processing is necessary for our legitimate interests in securing our platform, preventing spam and abuse, monitoring infrastructure performance, and improving product features, provided such interests are not overridden by your privacy rights.
• Consent (Art. 6(1)(a) GDPR): Where you have provided affirmative consent, such as for receiving push notifications or granting photo library access. You have the right to withdraw consent at any time.
• Legal Obligation (Art. 6(1)(c) GDPR): Processing is necessary to comply with applicable statutory, tax, or legal mandates.

5. Artificial Intelligence Connectors (MCP, ChatGPT, Claude, Muse)

If you choose to connect ScaleDM to an external AI platform (such as ChatGPT via OpenAI Apps, Claude via Anthropic, or Muse) through our Model Context Protocol (MCP) server or OAuth endpoints:

• Data returned by ScaleDM tools (such as your account username, media captions, comment counts, or automation rules) is transmitted directly to that AI platform solely to execute the specific prompt or workflow you initiated.
• ScaleDM does not operate third-party large language models (LLMs). The handling of data transmitted to third-party AI platforms is governed by their respective privacy policies and terms of service.
• We require explicit user confirmation before any write tool (creating, updating, or deleting an automation) is executed via an AI connector.

6. Third-Party Service Providers and Data Sharing

We share personal data only with trusted infrastructure providers (sub-processors) who are bound by strict data processing agreements and confidentiality obligations:

• Meta Platforms, Inc. (United States / Ireland): Our primary integration partner. All automated comment replies and direct messages are transmitted via Meta's Instagram and Facebook Graph APIs and Webhooks. If you opt in, registration measurement data is also sent through Meta's Conversions API; web measurement uses the Meta Pixel.
• Google Cloud Platform (United States): Our primary hosting, compute, database, and cloud storage provider. Our production infrastructure runs on Google Cloud Run, Google Cloud Firestore, Google Cloud Storage, and Google Cloud Tasks located in the us-central1 region (Iowa, USA).
• Google Firebase (United States): Used for delivering push notifications via Firebase Cloud Messaging (FCM) to Android devices.
• Google Analytics for Firebase (United States): Used on our website and in the iOS and Android apps to understand how ScaleDM is used. It receives page and screen views, a few product events (such as creating an automation or signing up), device and browser information, approximate location from IP address, and a random app or browser identifier. It does not receive your messages, comments, recipients or automation content.
• Legal and Regulatory Authorities: We may disclose data if required to do so by law, subpoena, court order, or search warrant, or if we believe in good faith that such disclosure is strictly necessary to protect the safety, rights, or property of Ascendant Labs, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of company assets, personal data may be transferred as part of the transaction, subject to the recipient assuming the commitments of this Privacy Policy.

7. International Data Transfers

ScaleDM is operated by Ascendant Labs Pte. Ltd. in Singapore, and our primary servers and databases are hosted on Google Cloud Platform in the United States.

If you are accessing the Service from the European Union, the United Kingdom, Switzerland, or other regions with laws governing data collection and transfer, please be aware that your personal data will be transferred to, stored, and processed in the United States and Singapore. Where we transfer personal data originating in the EEA or UK to countries that have not received an adequacy decision, we implement appropriate safeguards, including the European Commission's standard contractual clauses ("SCCs") and the UK International Data Transfer Addendum, to ensure your personal data remains protected to global standards.

8. Data Security and Storage

We implement rigorous technical and organizational security measures to protect your information against unauthorized access, destruction, loss, alteration, or disclosure:

• Token Encryption: All Instagram OAuth access tokens are encrypted at rest using industry-standard AES-256-GCM encryption with separate cryptographic key management.
• Encryption in Transit: All data transmitted between your devices, our servers, Google Cloud, and Meta APIs is encrypted using modern TLS 1.3 / HTTPS protocols.
• Encrypted Device Storage: Session tokens and sensitive state are stored in the secure iOS Keychain on iOS devices and in protected storage on Android devices.
• Access Control: Administrative access to production databases and cloud environments is strictly restricted to authorized engineering personnel using multi-factor authentication (MFA) and least-privilege principles.

9. Data Retention and Deletion

• Account Data: Retained for as long as your ScaleDM account remains active and connected.
• Audience Interaction Logs: Automatically purged after 30 days on a continuous rolling schedule.
• Uploaded Images: Retained only while the associated automation remains configured. When you delete the automation or your account, associated image files are immediately deleted from Google Cloud Storage.
• Diagnostic & Server Logs: System logs and crash diagnostics are automatically deleted after 30 days.

10. Your Rights and How to Delete Your Data

We believe in full user sovereignty over data. You have multiple ways to access, export, or permanently delete your data:

• In the ScaleDM App (Web, iOS, Android): Navigate to Settings → Delete Account. Confirming deletion immediately and permanently deletes your account record, encrypted tokens, active automations, uploaded images, and activity logs from our databases.
• In Instagram App Settings (Instant Revocation & Callback): Go to your Instagram app → Settings and privacy → Website permissions → Apps and websites, find ScaleDM, and tap Remove. Instagram immediately sends an automated deauthorization and data deletion webhook to our servers (/webhooks/deauthorize and /data-deletion), and we immediately purge all data associated with your account.
• Online Data Deletion Portal: You can check your deletion status or initiate deletion anytime at our public portal: https://scaledm.io/delete-data.
• By Email: You may email us at support@scaledm.io with the subject "Data Deletion Request" and your Instagram handle. We will process your request and confirm deletion within thirty (30) days.

11. Jurisdiction-Specific Disclosures

A. California Residents (CCPA / CPRA Disclosures)

The California Consumer Privacy Act (as amended by the California Privacy Rights Act, "CCPA/CPRA") requires specific disclosures for California residents:

• Categories of Personal Information Collected: Identifiers (Instagram username, account ID, IP address, device tokens), Internet/Electronic Network Activity (interaction logs, link click metrics), Commercial Information (automation settings), and Inferences (engagement analytics).
• Sources: Directly from you, automatically from your device/browser, and from Meta Platforms via authorized APIs.
• Business Purposes: Providing the Service, customer support, platform security, and fraud prevention.
• Disclosures for Business Purposes: Disclosed to cloud service providers (Google Cloud) and API infrastructure partners (Meta).
• Sale and Advertising Sharing: We do NOT sell your personal information. Meta measurement may constitute sharing under applicable privacy laws. Web measurement can be declined or withdrawn through Privacy choices. Android measurement starts automatically and respects the device advertising ID settings. Contact us to exercise applicable privacy rights. We have not sold personal information in the preceding 12 months.
• Your CCPA Rights: You have the right to request: (1) disclosure of personal information collected; (2) deletion of your personal information; (3) correction of inaccurate personal information; and (4) non-discrimination for exercising your CCPA rights. To exercise these rights, email support@scaledm.io.

B. European Economic Area (EEA) and UK Residents (GDPR Rights)

Under the GDPR and UK GDPR, you have the following rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you;
• Right to Rectification: You can request that we correct inaccurate or incomplete data;
• Right to Erasure ("Right to be Forgotten"): You can request the permanent deletion of your data;
• Right to Restriction of Processing: You can request that we restrict processing under certain conditions;
• Right to Data Portability: You can receive your data in a structured, commonly used, machine-readable format;
• Right to Object: You can object to processing based on legitimate interests;
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local Data Protection Supervisory Authority (such as the ICO in the UK or the relevant DPA in EU Member States).

C. Singapore Residents (PDPA Rights)

Under the Singapore Personal Data Protection Act 2012 ("PDPA"), you have the right to request access to and correction of your personal data held by us, as well as the right to withdraw your consent to our continued collection, use, or disclosure of your personal data at any time. We fulfill our data protection obligations in Singapore in strict compliance with the PDPA.

12. Children's Privacy

The Service is strictly designed for adult commercial creators, businesses, and professionals aged 18 and older. We do not knowingly solicit, collect, or process personal data from children under the age of 13 (or under 16 in certain jurisdictions). If we discover that personal data of a child under 13 has been collected without verifiable parental consent, we will take immediate steps to delete that information. If you believe a child has provided us with personal information, please contact us immediately at support@scaledm.io.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect operational changes, product enhancements, or updates to legal requirements. We will indicate the date of the most recent revision at the top of this document. If we make material changes, we will provide prominent notice through the Web App, iOS App, Android App, or via email prior to the changes taking effect. We encourage you to review this policy periodically.

14. Contact Us and Data Protection Inquiries

If you have questions, comments, or requests concerning this Privacy Policy, or wish to exercise any of your data protection rights, please contact our Data Protection Team at:

Ascendant Labs Pte. Ltd.
Singapore
Website: https://scaledm.io
Privacy & Data Protection Inquiries: support@scaledm.io
Data Deletion Portal: https://scaledm.io/delete-data
Instagram: @scaledm.io