ScaleWin ("ScaleWin", "we", "us" or "our") is a software service operated by Hema, sole proprietor, trading as Giftyard (Udyam Registration UDYAM-DL-06-0212746, enterprise name ScaleWin; GSTIN 07BAHPH4827C1ZZ), with its registered office at 1st Floor, Flat No. PVT-2, Plot No. E-7B/1, Right Portion, Block E, KH No. 77/9/1 Front, Vijay Vihar Phase 1, Rohini, North West Delhi, New Delhi 110085, India. This Privacy Policy explains how we collect, use, share and protect your information when you use our website scalewin.ai and our marketing-automation services (the "Service").
By using the Service, you agree to the practices described in this policy.
1. Information we collect
- Account information — name, business name, email, phone number and password when you sign up.
- Business & campaign data — information you connect or provide so we can run your marketing, such as your product/cost details, store data and goals.
- Connected advertising accounts — when you authorise a connection (for example Meta Ads or Google Ads) via secure OAuth, we access campaign and performance data needed to operate and optimise your ads. We never see or store your platform passwords.
- Payment information — subscription payments are processed by our payment partner Razorpay. We do not collect or store your full card or bank details on our servers.
- Usage & device data — log data, IP address, browser type and how you use the Service, collected via cookies and similar technologies.
2. How we use your information
- To provide, operate and optimise the Service for you;
- To create, manage and report on your advertising campaigns;
- To process subscriptions and payments;
- To communicate with you about your account, updates and support;
- To improve and secure our products; and
- To comply with legal obligations.
3. How we share information
We do not sell your personal information. We share data only with:
- Service providers we rely on to run the Service — for example payment processing (Razorpay), advertising platforms (Meta, Google), hosting and database providers, and automation infrastructure — strictly to deliver the Service to you;
- Legal & safety — where required by law, regulation or valid legal process, or to protect our rights and users.
Google user data and Limited Use
When you connect a Google account to ScaleWin (Google Ads, Google Analytics 4 or Google Search Console), we request read-only access through Google OAuth. We never see or store your Google password.
- What we access — Google Ads campaign and performance data; Google Analytics 4 traffic, engagement and ecommerce metrics; and Google Search Console search performance data such as queries, clicks, impressions, click-through rate and average position.
- Why we access it — solely to display your own marketing performance inside your private ScaleWin dashboard, to generate your reports and summaries, and to create or manage advertising campaigns that you explicitly request.
- Who can see it — only you, the account owner. We do not sell, rent or share Google user data with third parties, and we do not use it for advertising, profiling, credit assessment or to train generalised artificial intelligence or machine learning models.
- Storage and deletion — we cache only the aggregated metrics needed to render your dashboard. You can disconnect any Google account at any time from your dashboard, which immediately revokes our access token and deletes the stored connection. You may request deletion of the associated data by writing to [email protected].
ScaleWin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Data from your connected accounts
Data accessed from your connected advertising or store accounts is used only to provide the Service to you — to run, monitor and improve your own campaigns. We do not use it for any unrelated purpose, and you can disconnect any account at any time from your dashboard.
Website analytics tag
If you install the ScaleWin analytics tag on your own website, we collect information about visits to your site so that we can show you traffic and conversion reports. For this data you remain the data fiduciary (controller) and ScaleWin acts only as your data processor: we handle it on your instructions and solely to produce your reports.
- What the tag collects — the page address and title, the referring URL and campaign parameters (utm_source, utm_medium, utm_campaign, gclid, fbclid), device type and browser, an approximate location (country, state and city) derived from the visitor’s IP address, a random first-party visitor and session identifier stored in the visitor’s own browser, and the actions you choose to track such as product views, add to cart, checkout, purchases, leads and calls, together with their value.
- What it does not collect — the tag does not capture names, email addresses, phone numbers, postal addresses, payment details, form contents or keystrokes. Where an order is recorded, the customer’s email address is stored only as an irreversible hash, so that repeat customers can be counted without being identified.
- Identifiers — the visitor and session identifiers are random values held in first-party browser storage on your own domain. They are not shared with any third party, are not used for cross-site tracking, and are not used to build advertising profiles or audiences.
- IP addresses — a visitor’s IP address is used only to derive an approximate location (country, state and city) and is deleted within 7 days. We do not retain raw IP addresses beyond that period. To convert an IP address into a location we send it to a third-party geolocation lookup service; only the IP address is sent, never any other visitor detail, and each address is looked up once and then cached.
- Retention — individual events are kept for 7 days. After that only aggregated daily totals remain, and those cannot be traced back to an individual visitor.
- Your responsibility — because these are your visitors, you must disclose this collection in your own website privacy policy and obtain any consent your local law requires before the tag runs. Suggested wording is provided inside Store manager.
- Turning it off — you can remove the tag at any time from Store manager. Collection stops immediately and the stored events for your site are deleted.
5. Data retention
We keep your information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes and enforce our agreements. You may request deletion of your account data as described below.
6. Security
We use reasonable technical and organisational measures — including encryption in transit and access controls — to protect your information. However, no method of transmission or storage is fully secure, and we cannot guarantee absolute security.
7. Your rights
You may access, correct, update or request deletion of your personal information, and withdraw consent for connected accounts, by contacting us at [email protected].
8. Cookies
We use cookies and similar technologies as described in our Cookie Policy.
We and our advertising partners, Google and Meta, use cookies to measure ad performance and to show our ads to people who have visited scalewin.ai (remarketing). See our Cookie Policy for details and opt-out options.
9. Children
The Service is intended for businesses and users aged 18 and above. We do not knowingly collect data from children.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised "Last updated" date.
11. Contact
For any privacy questions or requests, contact us at [email protected] or via our Contact page.
Data Ownership & No-Sharing Commitment
Your dashboard data, account details, ad performance, store data and business information belong to you. ScaleWin does not sell, rent, trade or share your data with any third party, advertiser, or other user — ever. Internal access is strictly limited, role-based and logged: our administrators and staff do not browse or read your dashboards, conversations or account details in the ordinary course of business. Access happens only if (a) you explicitly request support, (b) the law requires it, or (c) it is essential to investigate a security incident — and in each case it is limited to the minimum necessary.
AI Conversations & Memory
Messages you exchange with ScaleWin AI assistants are processed solely to generate your responses and improve your own experience. Preference "memories" derived from your conversations are stored against an anonymous internal user ID (never your name), are used only to personalise your own account, and are never shared with anyone. Conversations and memories are encrypted in transit (TLS/HTTPS) and encrypted at rest. No human reads your conversations. You may request deletion of your conversation memory at any time using the contact details on this page.
Encryption & Security
All traffic between your device and ScaleWin uses TLS 1.2+ encryption. Data is encrypted at rest with our infrastructure providers. Credentials and API keys are held in a restricted secrets vault, never in application code, and access is role-based.
Sub-processors
To operate the service we use a small number of vetted infrastructure providers acting under contract: database hosting, AI model providers (to generate assistant responses), an AI memory service (to store your personalisation memories against an anonymous ID), Meta/Google APIs (only to operate the ad accounts you connect), and Razorpay (billing). Each receives only the minimum data needed for its function and may not use your data for anything else.
Your Deletion Rights
You can ask us to delete your conversation memory, usage data or entire account at any time using the contact details on this page. We honour verified requests within 30 days.