Privacy Policy

Last updated : October 6, 2026

This policy explains which personal data ScalyX processes, why, for how long, who receives it and how to exercise your rights. ScalyX is published by ScalyX (company being incorporated, contact: [email protected]).

1. Two roles

ScalyX as controller for the data of its customers and users (accounts, billing, support, security), and for the website. ScalyX as processor for the data the agencies put in ScalyX (the creators they manage, their media, captions, social media accounts and statistics): the agency is the controller, and ScalyX processes this data only on its instructions (see article 9 of the Terms of Use).

2. Data we process

• Account: name, email, password (hashed, never readable), language, profile photo, two-factor authentication secret (encrypted), role in the agency, sign-in dates.
• Application: agency name, Telegram contact, answers to the access questions (number of models, accounts, budget).
• Billing: company name, billing address, VAT number, subscription and invoices (handled by Stripe; ScalyX never sees card numbers).
• Agency content: models and their accounts’ usernames, media, captions, schedule, statistics, files, assistant conversations.
• Phones: name, model and identifier of the connected phones, the live screen shown in the browser (not recorded), passcodes if the agency enters them (encrypted).
• Connected accounts: access tokens issued by Instagram, Threads, Facebook, TikTok or YouTube when the agency connects an account through their API.
• Technical data: IP address, browser, actions log (who did what and when), errors, security events.

3. Why, and on what legal basis

• Providing the service and support, managing accounts and teams — performance of the contract.
• Billing and accounting — legal obligation.
• Security, fraud prevention, logs, service improvement — legitimate interest.
• Service emails and alerts — performance of the contract; product news only with the possibility to object at any time.

4. YouTube and Google

When an agency connects a YouTube channel, ScalyX only requests read-only access (youtube.readonly) to list that channel’s videos and their statistics; it does not publish, edit or delete anything through the YouTube API. ScalyX’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. ScalyX uses the YouTube API Services: see the YouTube Terms of Service and the Google Privacy Policy. Access can be revoked at any time at myaccount.google.com/permissions.

5. Artificial intelligence

The included AI (the Xylacs assistant, text writing, reading posts during scrolling) sends the necessary text and images to Anthropic or OpenAI through their API. This data is not used to train their models and is not kept beyond their abuse-monitoring period. Nothing is published without the agency’s approval.

6. Recipients and sub-processors

Data is accessible only to the agency’s members, according to their role, and to ScalyX staff when strictly needed (support is opened only with the agency’s agreement, see confidential mode). It is never sold or rented, nor used for advertising. ScalyX relies on:

• OVH (France): the server that runs ScalyX and its database (accounts, agencies, schedule, statistics).
• Cloudflare (global network, safeguarded transfers): website protection and delivery, domain names, storage of library files (Cloudflare R2).
• Stripe (Ireland / United States): subscription payments and invoices. ScalyX never sees nor stores card numbers.
• Resend (United States): service emails (invitations, passwords, alerts).
• Anthropic and OpenAI (United States): the included AI — the Xylacs assistant, text writing and reading posts during scrolling. Data sent is not used to train their models (API offerings).
• ScrapeCreators (United States): collection of the public statistics of the accounts entered by the agency (views, likes, followers), without logging into the account.
• Google and Apple: sign-in with a Google or Apple account, when the user chooses it; Google also serves the website fonts.
• Meta (Instagram, Threads, Facebook), TikTok, Google (YouTube): only when the agency connects an account through the official API, to read its statistics.
• Telegram: only when the agency links a Telegram account, to receive its alerts.

7. Transfers outside the EU

Some sub-processors are located in the United States. These transfers are governed by the European Commission’s standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.

8. Retention

• Account and agency content: for the duration of the service, then deleted within 30 days after the account is closed.
• Files deleted in the library: kept 30 days in the trash, then erased.
• Invoices and accounting records: 10 years (legal obligation).
• Logs and security events: 12 months.
• Applications not followed up: 12 months.
• Connected-account tokens: until the account is disconnected.

9. Security

Exchanges are encrypted (HTTPS); passwords are hashed; secrets (two-factor keys, phone passcodes, tokens) are encrypted; access follows roles; the server and the database are in France and the EU; backups are made regularly. Confidential mode prevents ScalyX staff from opening an agency without its agreement.

10. Cookies

ScalyX uses only cookies needed for the service to work: the session cookie (sign-in), the language and theme choices, and short-lived cookies during sign-up and Google / Apple sign-in. No advertising or tracking cookie, no audience-measurement cookie: no consent banner is needed. The website loads its fonts from Google Fonts.

11. Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. Write to [email protected]; we answer within one month. If your data was entered by an agency (for example as a creator it manages), you can also contact that agency directly. You can lodge a complaint with the CNIL.

12. Changes

This policy may change; the date at the top shows the latest version, and important changes are announced to customers. Contact: [email protected] · Legal Notice