Privacy Policy

1. Introduction

Good to Growing, Inc., a Texas corporation doing business as ScaleBoss AI ("ScaleBoss," "Company," "we," "us," or "our"), is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, store, and protect information, including personal data, when you access or use our websites, mobile applications, software-as-a-service platform, and all related services (collectively, the "Services").

ScaleBoss AI is a comprehensive business operating system that combines analytics, employee reviews, performance management, and artificial intelligence-powered insights to facilitate informed decision-making within organizations.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use our Services.

This Privacy Policy should be read in conjunction with our Terms of Service, which are incorporated herein by reference.

2. Scope of This Privacy Policy

2.1 What This Policy Covers

This Privacy Policy describes ScaleBoss's privacy practices in relation to information we collect as a data controller, including in the context of:

(i) Our websites, including scaleboss.ai and related domains

(ii) Our Services, including our web and mobile applications

(iii) User account registration and management

(iv) Marketing and promotional communications

(v) Customer support interactions

(vi) Any other activities where we display or link to this Privacy Policy

For purposes of this Privacy Policy, "Service Data" has the meaning given to it in Section 7.2 of our Terms of Service and includes Customer Data together with the prompts, inputs, outputs, telemetry, configuration, usage, performance, and operational metrics generated by, derived from, observed in, or transmitted through Customer's use of the Services. "Customer Data" refers to data uploaded or submitted by a Customer about that Customer's employees, contractors, clients, or other individuals.

2.2 Our Role When Handling Customer Data

ScaleBoss acts as a data processor (or service provider under U.S. state privacy laws) when handling data uploaded by Customers about their employees, contractors, clients, or other individuals ("Customer Data"). For those processing activities, the relevant Customer is the data controller, and ScaleBoss processes Customer Data only on the Customer's instructions and as necessary to provide the Services. The processing of Customer Data in that capacity is governed by the agreement between ScaleBoss and the applicable Customer (including the Terms of Service).

ScaleBoss acts as a data controller only with respect to limited, narrowly scoped operational and security data — including account, billing, authentication, telemetry, and security-monitoring data — and for the de-identified, aggregated data described in Section 7.3, in each case as further described in this Privacy Policy.

If you are an employee, contractor, or client of an organization that uses ScaleBoss and you have questions about how your data is handled within the Customer's instance of the Services, please contact that organization. For questions about ScaleBoss's processing of operational data, contact us at legal@scaleboss.ai.

This Privacy Policy also does not apply to third-party websites, services, or applications that may be linked to or integrated with our Services. We are not responsible for the privacy practices of such third parties.

3. Who We Are

ScaleBoss AI is operated by Good to Growing, Inc., a Texas corporation. For the purposes of applicable data protection laws, including the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), ScaleBoss is the data controller of the personal information described in this Privacy Policy, except where we process data solely as a processor on behalf of our Customers.

Contact Information:

Good to Growing, Inc. (d/b/a ScaleBoss AI)
6705 W Highway 290 Ste 607 #2006
Austin, TX 78735
Email: legal@scaleboss.ai

4. Information We Collect

We collect information in several ways, as described below.

4.1 Information You Provide Directly

When you interact with our Services, you may provide us with various types of information:

4.2 Information Collected Through the Services

When you use our Services, you or your organization may submit various types of data:

(i) Business and Organizational Data: Information about your organization's structure, goals, metrics, key performance indicators (KPIs), business strategies, and operational data.

(ii) Employee and Personnel Data: Information about employees, contractors, and other personnel, which may include names, contact information, job titles, department information, performance reviews, goals, feedback, compensation data, and other human resources information. This data is typically uploaded or entered by your organization or its administrators.

(iii) Analytics and Performance Data: Data related to business performance, including metrics, scorecards, reports, and analytical outputs generated through the Services.

(iv) User-Generated Content: Content created or uploaded by users within the Services, including notes, comments, documents, files, and other materials.

4.3 Information Collected Automatically

When you access or use our Services, we automatically collect certain information, including:

(i) Usage Data: Information about how you interact with our Services, including features used, pages viewed, actions taken, search queries, session duration, and navigation paths.

(ii) Device and Browser Information: Information about the device and browser you use to access our Services, including device type, operating system, browser type and version, screen resolution, language settings, and unique device identifiers.

(iii) Network and Connection Information: Information about your network connection, including your Internet Protocol (IP) address, Internet service provider, mobile carrier, and connection speed.

(iv) Location Information: General location information derived from your IP address, such as city, state, and country. We do not collect precise geolocation data without your explicit consent.

(v) Log Data: Server logs that record information about your use of the Services, including access times, error logs, and referring URLs.

4.4 Information from Third-Party Sources

We may collect information about you from third-party sources, including:

(i) Third-Party Integrations: If you or your organization connects third-party services or applications to our Services (such as CRM systems, HR systems, or other business tools), we may receive information from those services as necessary to provide the integrated functionality.

(ii) Single Sign-On Providers: If you choose to log in using a single sign-on service (such as Google or Microsoft), we receive certain profile information from that service as authorized by you.

(iii) Business Partners and Referrals: We may receive information from business partners, resellers, or referral sources, such as your name, email address, company, and interest in our Services.

(iv) Publicly Available Sources: We may collect information from publicly available sources, such as professional networking sites, company websites, and public databases, to supplement information we hold.

4.5 Categories of Personal Information (CCPA)

Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), we may collect the following categories of personal information:

(i) Identifiers (e.g., name, email address, phone number, IP address, account username)

(ii) Personal information described in California Civil Code Section 1798.80(e) (e.g., name, address, telephone number, employment information)

(iii) Commercial information (e.g., products or services purchased, transaction history)

(iv) Internet or other electronic network activity information (e.g., browsing history, search history, interactions with our Services)

(v) Geolocation data (general location derived from IP address)

(vi) Professional or employment-related information (e.g., job title, employer, professional history)

(vii) Inferences drawn from any of the above categories to create a profile about you

We do not knowingly collect sensitive personal information as defined under the CCPA/CPRA, such as Social Security numbers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, or genetic data, except where such information is voluntarily provided by Customers as part of their use of the Services.

5. How We Use Your Information

We use the information we collect for various purposes, including:

5.1 Providing and Operating the Services

(i) Creating and managing your account

(ii) Providing access to and operating the Services

(iii) Processing transactions and billing

(iv) Providing customer support and responding to inquiries

(v) Sending service-related communications, such as confirmations, technical notices, updates, security alerts, and administrative messages

(vi) Enabling integrations with third-party services

5.2 Improving and Developing the Services

(i) Analyzing usage patterns and trends to understand how users interact with our Services

(ii) Identifying and fixing bugs, errors, and technical issues

(iii) Conducting research and development to improve existing features and develop new features, in each case using de-identified or aggregated data only

(iv) Generating de-identified and aggregated data for the internal operation, security, and integrity of the Services

5.3 Marketing and Communications

(i) Sending promotional emails, newsletters, and other marketing communications (where you have consented or as otherwise permitted by law)

(ii) Displaying targeted advertisements

(iii) Conducting market research and surveys

(iv) Personalizing your experience and tailoring content to your interests

5.4 Security and Fraud Prevention

(i) Verifying accounts and authenticating users

(ii) Detecting, investigating, and preventing fraudulent, unauthorized, or illegal activity

(iii) Protecting the security and integrity of our Services

(iv) Enforcing our Terms of Service and other policies

5.5 Legal and Compliance

(i) Complying with applicable laws, regulations, and legal processes

(ii) Responding to lawful requests from government authorities

(iii) Establishing, exercising, or defending legal claims

(iv) Protecting our rights, property, and safety, and those of our users and others

6. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, we process your personal data based on the following legal bases under the GDPR or equivalent legislation:

(i) Contractual Necessity: Processing necessary to perform our contract with you, including providing the Services, managing your account, and processing payments.

(ii) Legitimate Interests: Processing necessary for our legitimate interests, provided those interests are not overridden by your rights and interests. Our legitimate interests include operating and improving our Services, marketing our Services, preventing fraud, and ensuring security.

(iii) Consent: Processing based on your consent, such as for marketing communications and certain cookies. You may withdraw your consent at any time.

(iv) Legal Obligation: Processing necessary to comply with our legal obligations under applicable law.

7. Artificial Intelligence and Data Usage

7.1 AI-Powered Features

ScaleBoss AI incorporates artificial intelligence and machine learning technologies to provide features such as analytics, insights, recommendations, predictions, and automated processing. These AI features are powered by both our proprietary technology and third-party AI service providers, including OpenAI and Anthropic.

7.2 How AI Processes Your Data

When you use AI-powered features, Customer Data and other Service Data may be transmitted to one or more third-party AI service providers for the purpose of inference. The current third-party AI service providers used by the Services are Anthropic, PBC and OpenAI, L.L.C.

Based on representations made by Anthropic and OpenAI in their respective publicly available terms and policies, neither provider uses Customer Data submitted via their APIs to train its generally-available models, and each provider's standard data-handling commitments include time-limited retention of inference data (typically up to thirty (30) days) for purposes such as abuse monitoring. ScaleBoss does not authorize either provider to use Customer Data for any purpose other than performing inference for the Services. ScaleBoss does not independently verify either provider's data-handling practices and makes no representation or warranty regarding the accuracy of their representations or the conduct of either provider.

ScaleBoss publishes a list of all third-party Subprocessors, including the AI providers above, in Section 21 of our Terms of Service.

7.3 ScaleBoss's Use of Service Data

ScaleBoss uses Customer Data and other Service Data to provide, operate, support, secure, and improve the Services, and to comply with applicable law. ScaleBoss represents that ScaleBoss does not train, fine-tune, or otherwise develop its own artificial intelligence or machine learning models on Customer Data, and that ScaleBoss does not sell Customer Data to third parties for third-party marketing purposes. ScaleBoss will not, on its own behalf, solicit Customer's clients, contacts, or end-users for so long as Customer remains an active customer of the Services. The foregoing does not limit ScaleBoss's ability to send system-generated, transactional, service-related, account, billing, security, or other business communications to Customer's Authorized Users or to persons whose contact information is provided to ScaleBoss through the Services in connection with the operation of the Services.

ScaleBoss may generate and retain de-identified, aggregated data derived from Service Data for the internal operation, security, and integrity of the Services, as further described in Section 7.5 of the Terms of Service. ScaleBoss does not sell Personal Data under CCPA/CPRA, the Texas Data Privacy and Security Act, or comparable laws.

7.4 AI Limitations and Human Oversight

AI-generated outputs are intended to assist and inform human decision-making, not replace it. ScaleBoss does not engage in fully automated decision-making that produces legal or similarly significant effects on individuals without human intervention. We recommend that users review and validate all AI-generated outputs before relying on them for material decisions.

7.5 EU/UK Right to Object

If you are located in the EEA, UK, or Switzerland, you have the right to object to processing of your personal data based on our legitimate interests. To exercise this right, contact us at legal@scaleboss.ai. We will honor valid objection requests in accordance with applicable law.

8. How We Share Your Information

We do not sell your personal information for monetary consideration, and our internal use of Service Data for analytics and Service operation as described in Section 7.3 does not constitute a "sale" of personal information under applicable privacy law. We share your information only in the circumstances described below:

8.1 Service Providers

We share information with third-party service providers ("Subprocessors") who perform services on our behalf. The complete list of Subprocessors, the purpose for which each is engaged, and the data location for each is set forth in Section 21 of our Terms of Service. Categories include:

(i) Cloud hosting and infrastructure (Supabase, Vercel)

(ii) Payment processing (Stripe)

(iii) AI service providers for inference (Anthropic, OpenAI)

(iv) Error monitoring (Sentry)

(v) Transactional email (Mailgun)

(vi) Marketing-site analytics and tag management (Google, Meta)

(vii) CRM and marketing automation (GoHighLevel)

(viii) Integration sync and connectors (One AI, Trigger.dev)

(ix) Content delivery (Bunny.net)

(x) Bot prevention (Cloudflare)

ScaleBoss seeks to engage Subprocessors that maintain appropriate data-handling practices, and the data-handling practices of each Subprocessor are governed by that Subprocessor's own publicly available terms and policies. The data-handling representations applicable to the third-party AI service providers used by the Services are set forth in Section 7.2.

8.2 Your Organization

If you use the Services through an organization (such as your employer), we may share information about your account and usage with that organization's administrators as necessary to provide and manage the Services. Your organization may have its own policies regarding the collection and use of your information.

8.3 Third-Party Integrations

If you or your organization enable integrations with third-party services, we may share information with those services as necessary to provide the integrated functionality. The sharing of information with third-party services is governed by your agreements with those services and their privacy policies.

8.4 Legal Compliance and Protection

We may disclose information if we believe it is necessary to:

(i) Comply with applicable law, regulation, legal process, or governmental request

(ii) Enforce our Terms of Service and other agreements

(iii) Protect the rights, property, and safety of ScaleBoss, our users, and others

(iv) Detect, prevent, or address fraud, security, or technical issues

(v) Respond to an emergency involving danger of death or serious physical injury

8.5 Business Transfers

In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred to the acquiring or surviving entity. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

8.6 With Your Consent

We may share your information for other purposes with your consent or at your direction.

8.7 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you for any purpose, including research, analytics, benchmarking, and marketing.

9. Data Retention

We retain your information for as long as necessary to fulfill the purposes for which it was collected, including to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. The retention period may vary depending on the type of information and the context in which it was collected.

Generally, we retain:

(i) Account information for as long as your account is active and for a reasonable period thereafter

(ii) Transaction and billing records as required by tax and accounting laws

(iii) Customer Data in accordance with our agreements with Customers and their instructions

(iv) Usage data and logs for a limited period for analytics and security purposes

(v) Marketing preferences and opt-out records indefinitely to respect your choices

When we no longer have a legitimate need to retain your information, we will securely delete or anonymize it.

10. Data Security

We implement and maintain reasonable administrative, technical, and physical security measures designed to protect your information from unauthorized access, use, alteration, and destruction. These measures include:

(i) Encryption of data in transit and at rest

(ii) Access controls and authentication mechanisms

(iii) Regular security assessments and monitoring

(iv) Employee training on data protection and security

(v) Incident response and breach notification procedures

However, no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to protect your information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

If you become aware of any unauthorized access to or use of your account, please notify us immediately at legal@scaleboss.ai.

11. International Data Transfers

ScaleBoss is based in the United States, and your information may be transferred to, stored, and processed in the United States or other countries where we or our service providers operate. These countries may have data protection laws that are different from, and potentially less protective than, the laws of your country.

If you are located in the EEA, UK, or Switzerland, we take appropriate steps to ensure that your personal data receives an adequate level of protection when transferred outside those regions. These steps may include:

(i) Relying on adequacy decisions by the European Commission

(ii) Entering into Standard Contractual Clauses approved by the European Commission

(iii) Implementing appropriate supplementary measures where required

By using our Services, you acknowledge and consent to the transfer of your information to the United States and other countries as described in this Privacy Policy.

12. Your Rights and Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information. We are committed to facilitating the exercise of these rights.

12.1 Rights Under GDPR (EEA, UK, and Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the following rights:

12.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the CCPA/CPRA:

(i) Right to Know: The right to know what personal information we collect, use, disclose, and sell about you.

(ii) Right to Access: The right to request access to and obtain a copy of the specific pieces of personal information we have collected about you.

(iii) Right to Delete: The right to request deletion of your personal information, subject to certain exceptions.

(iv) Right to Correct: The right to request correction of inaccurate personal information.

(v) Right to Opt-Out of Sale/Sharing: The right to opt out of the sale or sharing of your personal information. Note: We do not sell personal information.

(vi) Right to Limit Use of Sensitive Personal Information: The right to limit the use and disclosure of sensitive personal information. Note: We do not use sensitive personal information for purposes beyond what is necessary to provide the Services.

(vii) Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising your privacy rights.

12.3 Exercising Your Rights

To exercise any of the rights described above, please contact us at legal@scaleboss.ai or visit our Your Privacy Choices page. We will respond to your request within the timeframe required by applicable law (generally within 30-45 days).

We may need to verify your identity before processing your request to ensure the security of your personal information. If you make a request through an authorized agent, we may require proof of authorization.

If you are an employee or user whose organization uses our Services, please direct your privacy requests to your organization, as they control your data within the Services.

12.4 Marketing and Communication Preferences

You may opt out of receiving marketing communications from us by:

(i) Clicking the "unsubscribe" link in our marketing emails

(ii) Contacting us at legal@scaleboss.ai

(iii) Adjusting your preferences in your account settings

Please note that even if you opt out of marketing communications, we may still send you transactional and service-related communications, such as account notifications, security alerts, and updates about the Services.

12.5 Cookie Preferences

You can manage your cookie preferences through your browser settings or by clicking "Cookie Preferences" in the footer of our website. Please note that blocking certain cookies may affect the functionality of our Services.

13. Children's Privacy

Our Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe that a child under 18 has provided us with personal information, please contact us at legal@scaleboss.ai.

14. Third-Party Links and Services

Our Services may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to such third-party services. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies before providing any personal information to them.

15. Do Not Track and Global Privacy Control Signals

Some browsers offer a "Do Not Track" (DNT) signal. Because the World Wide Web Consortium has not finalized a uniform DNT standard, our Services do not currently respond to DNT signals. However, we do recognize and honor Global Privacy Control (GPC) signals to the extent required by applicable law (including the CCPA/CPRA). When we detect a valid GPC signal from your browser, we will treat it as a request to opt out of the "sale" or "sharing" of personal information for that browser and device.

16. Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar tracking technologies to collect information about your use of our Services and to provide, improve, and personalize our Services. These technologies help us:

(i) Remember your preferences and settings

(ii) Authenticate users and prevent fraud

(iii) Analyze usage patterns and improve our Services

(iv) Deliver targeted advertising and measure ad effectiveness

(v) Provide customer support

Types of Cookies We Use

(i) Essential Cookies: Required for the operation of our Services, including authentication, security, and load balancing. These cookies cannot be disabled.

(ii) Functional Cookies: Used to remember your preferences and provide enhanced functionality and personalization.

(iii) Analytics Cookies: Used to understand how visitors interact with our Services, including which pages are visited most often and how users navigate through the site.

(iv) Advertising Cookies: Used to deliver relevant advertisements and track the effectiveness of marketing campaigns.

Managing Cookie Preferences

You can manage your cookie preferences by clicking "Cookie Preferences" in the footer of our website. You can also manage cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that blocking certain cookies may affect the functionality of our Services.

Third-Party Analytics and Advertising

We use third-party analytics services, such as Google Analytics, to help us understand how users interact with our Services. These services may use cookies and similar technologies to collect information about your use of our Services and other websites. We may also use third-party advertising services to deliver targeted advertisements based on your interests.

For more information about how Google uses data, please visit Google's Privacy Policy. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

(i) Update the "Last Updated" date at the top of this Privacy Policy

(ii) Post a notice on our website or within the Services

(iii) Where required by law, seek your consent to the changes

We encourage you to review this Privacy Policy periodically for the latest information on our privacy practices. Your continued use of the Services after any changes to this Privacy Policy constitutes your acceptance of such changes.

18. Additional State-Specific Disclosures

18.1 California Residents

In addition to the rights described in Section 12.2, California residents are entitled to the following disclosures:

(i) Categories of Personal Information Collected: In the preceding 12 months, we have collected the categories of personal information described in Section 4.5 of this Privacy Policy.

(ii) Sources of Personal Information: We collect personal information from the sources described in Section 4 of this Privacy Policy.

(iii) Business or Commercial Purposes: We use personal information for the purposes described in Section 5 of this Privacy Policy.

(iv) Categories Disclosed for Business Purposes: We disclose personal information to the categories of recipients described in Section 8 of this Privacy Policy.

(v) Sale or Sharing of Personal Information: We do not sell personal information as defined under the CCPA. We may share personal information for cross-context behavioral advertising purposes through cookies and similar technologies, which may constitute "sharing" under the CCPA. You may opt out of such sharing by adjusting your cookie preferences.

(vi) Retention: We retain personal information as described in Section 9 of this Privacy Policy.

(vii) Financial Incentives: We do not offer financial incentives in exchange for personal information.

18.2 Texas, Virginia, Colorado, Connecticut, and Other State Residents

If you are a resident of Texas, Virginia, Colorado, Connecticut, Oregon, Montana, or another state with a comprehensive consumer privacy law, you may have rights similar to those described in Section 12.2, including rights to know, access, correct, delete, and opt out of certain processing. The Texas Data Privacy and Security Act ("TDPSA") additionally grants Texas residents the right to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. To exercise any state-law privacy right, contact us at legal@scaleboss.ai or visit our Your Privacy Choices page. We will respond within the timeframes required by applicable law.

19. Contact Information

If you have any questions, comments, or concerns about this Privacy Policy or our privacy practices, please contact us at:

Good to Growing, Inc. (d/b/a Scale B.O.S.S., Scale B.O.S.S. AI)
6705 W Highway 290 Ste 607 #2006
Austin, TX 78735
Email: legal@scaleboss.ai

We will respond to your inquiry within 30 days or as required by applicable law.

Thank you for taking the time to read our Privacy Policy. Your privacy is important to us, and we are committed to protecting your personal information.