Privacy Policy

Last Updated: September 2026 Welcome to ScaleXium Tools (“Company”, “we”, “us”, or “our”), accessible at https://scalexiumtools.com (including associated subdomains, portals, web applications, and APIs). ScaleXium Tools operates as a B2B Software-as-a-Service (SaaS) provider and channel distribution partner delivering automated digital productivity tools. We respect individual privacy and are committed to maintaining the confidentiality, integrity, and security of personal and business data. This Global Privacy Policy (“Privacy Policy”) explains how we collect, process, store, disclose, and protect personal data when you visit our website, register for an account, subscribe to our modular tools, or interact with our services. 1. Key Roles & Regulatory Frameworks Depending on how you interact with our platform: Data Controller: ScaleXium Tools acts as a Data Controller for personal data collected directly from our website visitors, registered account holders, direct subscribers, and white-label resellers (e.g., your account credentials, billing information, and direct correspondence). Data Processor / Service Provider: When resellers or business subscribers upload, integrate, or process data belonging to their end customers (such as restaurant patrons, salon clients, or review authors), the business subscriber acts as the Data Controller, and ScaleXium Tools (along with its upstream hosting infrastructure partners) acts as a Data Processor. Compliance Standards: This Policy is designed to comply with global privacy frameworks, including the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Indian Digital Personal Data Protection Act, 2023 (DPDPA), and applicable international cross-border data transfer laws. 2. Categories of Information We Collect 2.1 Personal Data You Provide Directly Identity & Account Information: Full name, business trade name, professional title, email address, physical billing address, and telephone/WhatsApp contact number. Operational & Profile Content: Content submitted to power your active tools, such as digital restaurant menus, price lists, v-card portfolio details, digital coupon structures, and brand logos. Payment & Transaction Data: Online Transactions: Electronic payments are processed securely through certified, PCI-DSS-compliant third-party payment gateways (e.g., Razorpay, Stripe, Cashfree). We do not collect, view, or store full credit/debit card numbers, CVVs, or bank security PINs. Manual / Offline Payments: If you elect to settle invoices via direct bank wire (IMPS/NEFT/RTGS/SWIFT) or corporate UPI, we collect transaction reference numbers, bank transfer confirmation receipts, or transaction screenshots strictly for financial clearance and audit verification. Communications & Support Records: Transcripts of customer support inquiries, feature requests, diagnostic bug submissions, and WhatsApp or email correspondence. 2.2 Third-Party API Tokens & Authentication Data Certain modules—specifically our AI Google Reviews & Local SEO Booster—interact directly with third-party service APIs (e.g., Google My Business / Google Business Profile). When you link your business profile, we receive authorized OAuth access tokens granted by you via the third party’s official authentication consent screen. We use these tokens strictly to fetch incoming reviews, generate sentiment metrics, post authorized AI responses, and schedule profile updates. We do not sell, scrape, or repurpose your third-party API credentials. 2.3 Automated Device, Telemetry & Log Data When you navigate our website or dashboards, our servers automatically log: Internet Protocol (IP) addresses, browser type and version, language preferences. Device identifiers, operating system architecture, and screen resolution. Referring URLs, clickstream paths, access timestamps, and session durations. 3. Legal Bases for Processing (GDPR & Global Mandates) If you reside within the European Economic Area (EEA), the United Kingdom, or similar jurisdictions, our legal bases for collecting and processing your personal data include: Performance of a Contract: Fulfilling our service obligations, provisioning your SaaS modules, managing billing, and delivering technical support. Legitimate Interests: Monitoring platform stability, detecting cyber threats, improving software workflows, and securing our multi-tenant server infrastructure. Compliance with Legal Obligations: Complying with statutory accounting rules, anti-fraud verifications, tax reporting, and lawful government requests. Consent: For explicit marketing distributions or optional third-party integrations (which may be revoked at any time). 4. How We Use Your Information We process collected data exclusively for lawful commercial purposes, including: Service Delivery & Provisioning: Creating and administering accounts, provisioning VPS multi-tenant instances, routing custom domains, and maintaining active software modules. Automated AI Processing: Synthesizing business profiles to draft AI review replies, generate landing page copy, or formulate local SEO reports via automated APIs. Transaction Settlement & Accounting: Validating electronic payment callbacks, clearing manual bank remittance receipts, issuing statutory tax invoices, and preventing fraudulent transactions. Platform Security & Infrastructure Protection: Monitoring brute-force attempts, unauthorized scraping, rate-limit exploitation, or malicious script injection. Operational Communications: Transmitting system alerts, service updates, policy revisions, invoice notices, and essential onboarding workflows. 5. Data Architecture, Upstream Processing & Third-Party Disclosure We do not sell, rent, monetize, or trade your personal data to third parties or data brokers. Data sharing is limited to the following categories of recipients under strict confidentiality standards: Upstream Infrastructure & Technology Partners: As a channel distribution partner and SaaS operator, our backend multi-tenant systems, databases, and microservices are hosted on enterprise cloud servers and upstream software provider architectures (including SaaS Yaari and certified VPS cloud networks). These providers process technical data strictly to maintain platform uptime, data storage, and compute execution. AI Model Vendors: Text inputs designated for automated copywriting or review replies may be routed via secure enterprise APIs (such as OpenAI or Google Cloud AI). Data transmitted via these enterprise endpoints is processed transiently and is not utilized by the underlying model providers to train public models. Payment Gateways & Banking Partners: To authorize card debits, verify corporate UPI handles, or reconcile bank wires. Professional Advisors & Legal Authorities: We may disclose data where strictly necessary to legal counsel, auditors, or statutory regulatory bodies in compliance with court orders, applicable statutes, or to defend against fraudulent chargebacks. 6. Cookies, Tracking & Analytics Essential Cookies: Necessary for core platform operation, user authentication, session security, and load balancing across our servers. Analytical & Performance Cookies: Aggregate telemetry tools (e.g., privacy-centric web analytics) that help us measure feature adoption and page render latencies. Managing Preferences: You can instruct your browser to refuse all cookies or notify you when a cookie is being transmitted. Disabling essential session cookies may impair dashboard performance and authentication persistence. 7. Cross-Border International Data Transfers ScaleXium Tools operates globally, with core administrative and operational nodes in India and cloud infrastructure hosted across enterprise global data centers. If you access our services from outside India (including the EEA, UK, US, or Middle East), your data will be transferred to, stored, and processed in India and other secure cloud regions. Where required by cross-border regulations, we implement recognized transfer safeguards, including Standard Contractual Clauses (SCCs), administrative access limitations, and end-to-end data encryption in transit and at rest. 8. Data Security & Storage Controls We employ robust administrative, organizational, and technical safeguards designed to preserve data integrity and prevent unauthorized access: Encryption Protocols: All web traffic is enforced over HTTPS utilizing modern Transport Layer Security (TLS/SSL). Stored database records are encrypted using industry-standard AES-256 ciphering. Server Isolation: Multi-tenant databases utilize access-controlled permission boundaries to prevent cross-tenant data visibility. Manual Payment Isolation: Payment verification proofs (wire receipts, UPI transaction IDs) are stored in restricted administrative repositories accessible solely by authorized billing personnel. Security Disclaimer: While we deploy enterprise-grade defenses, no method of digital transmission or electronic storage is entirely invulnerable. Consequently, we cannot guarantee absolute, impenetrable security against zero-day vulnerabilities or sophisticated cyber intrusions. 9. Data Retention & Account Decommissioning Active Subscription Retention: We retain personal information and operational data as long as your account remains active and in good standing. Decommissioning & Deletion: Upon account cancellation, expiry, or termination, your account is placed into a dormant state. We reserve the right to purge tenant data, custom configurations, and stored media from active server databases in accordance with standard data cleanup schedules. Statutory Retention: We retain financial records, invoice audit trails, payment confirmation receipts, and relevant communication logs for the statutory period mandated by applicable corporate, tax, and anti-money laundering legislation (typically up to 7 years). 10. Your International Privacy Rights Depending on your geographic location and local data privacy laws (e.g., GDPR, UK DPA, CCPA/CPRA, Indian DPDPA), you may hold the following statutory rights: Right to Access / Know: The right to request confirmation of whether we process your personal data and obtain a readable copy of that information. Right to Rectification: The right to correct inaccurate, obsolete, or incomplete personal records. Right to Erasure (“Right to be Forgotten”): The right to request the deletion of your personal data, subject to statutory retention exceptions (such as tax compliance and active dispute resolution). Right to Restrict or Object: The right to restrict or object to our processing of your personal data under specific circumstances (such as direct marketing). Right to Data Portability: The right to receive your operational content in a structured, commonly used, and machine-readable format. Right to Non-Discrimination: We will never deny services, charge different prices, or provide a lower quality of service for exercising your statutory privacy rights. How to Exercise Your Rights: To exercise any applicable statutory right, submit a formal written request to support@scalexiumtools.com with the subject line "Data Subject Request". For security and verification purposes, we may require identity confirmation before executing the request. We endeavor to resolve all verified requests within thirty (30) calendar days. 11. Third-Party Links & Reseller Portals Our website and products may contain links to external third-party portals, merchant stores, or reseller platforms. ScaleXium Tools does not control, supervise, or accept liability for the data governance practices or content of third-party platforms. When purchasing from or utilizing tools rebranded by an independent white-label reseller, the reseller remains directly responsible for presenting their own privacy disclosures to their end clients. 12. Children’s Privacy Our Services are designed exclusively for commercial business use and are not directed to individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal data from minors. If we discover that an individual under the age of 18 has submitted personal information to us, we will immediately delete that record from our active repositories. 13. Policy Modifications & Periodic Review We review and update this Privacy Policy periodically to maintain alignment with technological enhancements, statutory changes, and evolving operational workflows. Any revisions will be published on this page with an updated “Last Updated” version date. Continued interaction with our website or services following published modifications constitutes your informed acknowledgment of the revised Privacy Policy. 14. Data Protection Inquiries & Contact Details For any questions, data subject access requests, or regulatory privacy concerns regarding this Global Privacy Policy, please contact our administrative team: Legal Entity: ScaleXium Digital Growth Agency Website: https://scalexiumtools.com Official Privacy Email: support@scalexiumtools.com Direct Helpline / WhatsApp: +91-8700603941 Jurisdiction: Gurugram, Haryana, India