Privacy Policy

1. Introduction

Scalista UG (haftungsbeschränkt), located at Endenicher Str. 153, 53115 Bonn, Germany, is committed to protecting your personal data. This privacy policy outlines how we collect, use, and protect your information when you use our website and services.

2. Data Controller

Email: info@scalista.eu
Phone: +49 179 5316650

3. Data Protection Officer

Enrique Lehner
Email: admin@scalista.eu

4. Categories of Data, Purposes, and Recipients

We collect and process the following data:

• User Data (Name, Email): Account management and contract fulfillment. Recipients: Stripe, Vercel, Google, and Google OAuth 2.0.
• Payment Data: Billing processes via Stripe. Recipient: Stripe.
• Usage and Analytics Data: Page visits, explicit product actions, account identifiers, and technical context used to understand and improve our website and service. Processor: PostHog Cloud EU (PostHog, Inc.).
• Attribution Data: Landing page, referrer, UTM parameters, and advertising click identifiers used to measure which campaigns lead to a paid subscription. Recipients: PostHog Cloud EU and, for consented Google ad clicks, Google Ads.
• Device Data (Cookies, IP): Session management, security, consent, and, with consent, analytics and campaign attribution. Recipients: Our infrastructure and PostHog Cloud EU.

5. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contractual Necessity: To fulfill our obligations under the terms of service, including account administration and billing. Optional analytics is not sent to PostHog on this basis.
• Legal Obligations: To comply with legal requirements.
• Legitimate Interests: For narrowly scoped service security, fraud prevention, and operational reliability where our documented balancing assessment permits it. Optional analytics is not processed on this basis.
• Consent: For product analytics, account-linked analytics events, campaign attribution, session replay for signed-in users, and sharing advertising click identifiers for conversion measurement.

6. Data Transfers

Analytics data is sent to PostHog's EU Cloud infrastructure. Some providers, including PostHog, Google, Stripe, and Vercel, may also process data outside the European Economic Area. Where required, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

7. Data Retention

We retain your personal data only as long as necessary for the stated purpose and any legal, accounting, or reporting requirements. The ac_attr attribution cookie expires after 90 days. Consent preferences remain for up to 12 months, and product analytics events and any separately consented session replay recordings are retained for up to 12 months. Billing records may be kept longer where tax or commercial law requires it.

8. Cookies and Tracking

Our website uses browser storage for the following purposes:

• Necessary Cookies: For technical functions (e.g., session cookies).
• Consent Preference: ac_consent and ac_consent_evidence store your separate choices for product analytics, advertising attribution, and session replay, with a policy version and decision time.
• Campaign Attribution: ac_attr stores first-touch and last-touch campaign information for 90 days, only after consent.
• Product Analytics: After consent, PostHog uses local browser storage to connect visits and explicit product events. Before a choice, after decline or withdrawal, or when consent evidence is stale or invalid, no client or account-linked server analytics event is sent to PostHog.
• Session Replay: Is a separate, optional PostHog Cloud EU purpose. It may be enabled only for signed-in users who selected it and only after an internal deployment approval; form inputs and page text are masked. It can be selected independently from product analytics and is disabled on the public marketing site.

If you consented to advertising attribution, a Google click identifier may be sent to Google Ads after a paid subscription so Google can measure that conversion. We do not load a Google Analytics or Google Ads browser tag.

You can accept, reject, change, or withdraw each optional purpose at any time above. Withdrawing advertising attribution removes the attribution cookie. Withdrawing product analytics stops product events without changing your separate replay choice. These choices do not affect necessary cookies or server-side records required to provide your account and subscription.

9. Automated Decision-Making

We do not engage in automated decision-making with legal or similarly significant effects as described in Article 22 of the GDPR. Authentication checks may be automated, but manual review is always possible.

10. Children and Adolescents

Our services are not directed to individuals under 16 years of age. We do not knowingly collect data from children under 16 without verifiable parental consent, in accordance with Article 8 of the GDPR.

11. Security

We implement appropriate technical and organizational measures (TOMs) to ensure a level of security appropriate to the risk, including encryption, pseudonymization, access controls, and regular audits.

12. Your Rights

Under the GDPR, you have the following rights:

• Access: You can request access to your personal data.
• Rectification: You can request correction of inaccurate or incomplete data.
• Erasure: You can request deletion of your data, subject to legal obligations.
• Restriction: You can request restriction of processing under certain conditions.
• Objection: You can object to processing based on legitimate interests.
• Data Portability: You can request transfer of your data to another service provider.

To exercise these rights, please contact us at admin@scalista.eu.

13. Supervisory Authority

If you believe that our processing of your personal data infringes data protection laws, you have the right to lodge a complaint with the supervisory authority:

Website: https://www.ldi.nrw.de

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date and, if changes are significant, notify you by email or via the Service.

15. Contact Information

Email: info@scalista.eu
Phone: +49 179 5316650