Privacy Policy

Last updated: October 27, 2026

ScaleTrack is operated by Obscale LLC, a New Jersey limited liability company. This policy explains how Obscale LLC (“ScaleTrack”, “we”, “us”) handles data across the ScaleTrack web application (app.scaletrack.com), the ScaleTrack mobile application, and the tracking service our customers install on their own websites. It applies to you if you hold a ScaleTrack account, and it describes how we process data about our customers' website visitors on our customers' behalf.

1. Data we collect from account holders

• Account data — name, email address and a hashed password (or passkey credential) when you register.
• Workspace data — the campaigns, sites, integrations, creatives, support conversations and settings you create while using the product.
• Usage data — standard server logs (IP address, user agent, timestamps) kept for security and debugging.
• Push tokens — if you enable notifications in the mobile app, we store a push token so we can deliver alerts you asked for. Tokens are removed when you sign out, when your device is deregistered by the platform, or when your workspace membership ends.

2. Data we process on behalf of our customers

Customers install ScaleTrack's measurement snippet on their own websites. Through it we process visitor events — page views, clicks, add-to-cart and checkout events, order values, and attribution identifiers (such as click IDs and browser identifiers used by Meta's Conversions API) — strictly as a processor for the customer that operates the website. The customer is the data controller for this data and is responsible for their own privacy disclosures and consent management. We do not sell this data or use it for our own advertising.

2a. Messaging data processed on behalf of our customers (Meta channel)

A customer may connect its own Facebook Page and Instagram professional account to ScaleTrack. ScaleTrack then receives, through Meta webhooks, the Messenger and Instagram messages and the Facebook and Instagram comments that people send to that Page or account, and forwards each one to the support system the customer designates. The customer's system may reply through ScaleTrack as the Page. For this data the customer is the controller and ScaleTrack acts strictly as a processor, and as a Tech Provider under Meta's Platform Terms: the data of one customer is used only to provide the service to that customer, is never combined across customers, and is never used for our own purposes.

• What we hold: the Page-scoped sender id, the message or comment text, links to attachments hosted by Meta (which expire on Meta's side), Meta's identifiers and timestamps, and a log of the replies the customer's system sent (identifiers only, not the reply text).
• What we do not hold: names and profile pictures are not stored (a name may be looked up on the customer's request and is cached for 24 hours at most); attachments are not copied.
• Retention: raw webhook deliveries are deleted after 14 days; relayed events, delivery attempts and reply receipts after 30 days; when a Page is disconnected its events are deleted immediately.
• Deletion requests: a person may ask the customer, or us, to delete their messages at any time; see the data deletion page. Deletion requests we receive from Meta are honored within 30 days.
• Where: this data is processed on the infrastructure listed in section 4, in the United States, under standard contractual clauses where required.
• Automated replies: whether a customer's system answers automatically, and the disclosure of that to the person, is the customer's responsibility.

3. Cookies

The ScaleTrack application uses cookies for authentication and session management only. The marketing site (scaletrack.com) sets no cookies. Our measurement snippet on customer sites uses first-party identifiers under the customer's domain, controlled by the customer.

4. Third-party services

We rely on a small set of processors to run the service:

• Hosting & infrastructure — Railway (application hosting), Cloudflare (edge network and static hosting), managed PostgreSQL/ClickHouse/Redis providers.
• Meta Platforms — when you connect ad accounts or use server-side conversions, campaign data and conversion events flow between ScaleTrack and Meta's APIs under your instruction; when you connect a Facebook Page or Instagram account to the Meta channel, your customers' messages and comments flow from Meta to ScaleTrack and replies flow back, under your instruction.
• Upstash — managed Redis for queues and short-lived caches (including the Meta channel delivery queue).
• Shopify — when you connect a store, order and checkout webhooks flow from Shopify to ScaleTrack under your instruction.
• Expo — push notification delivery for the mobile app (Apple APNs / Google FCM downstream).
• Resend — transactional email (invitations, alerts).
• Anthropic — if you enable AI-assisted support replies, conversation text is processed to generate draft responses.

5. Retention

Account and workspace data is retained while your account is active. Tracking health snapshots are pruned after 60 days. Meta channel messaging data follows the shorter periods in section 2a. If you delete your account or workspace, associated data is deleted from production systems within 30 days, with encrypted backups expiring on their regular cycle.

6. Your rights

You can access, correct, export or delete your account data at any time — most of it directly in the product, or by contacting us. If you are in a jurisdiction with statutory data rights (such as the EU/EEA under GDPR), we honor access, rectification, erasure, portability and objection requests.

7. Security

All traffic is encrypted in transit (TLS). Credentials are stored hashed; third-party API tokens are stored encrypted at rest. Access to production systems is restricted and logged.

8. Changes

We will post any changes to this policy on this page and update the date above. Material changes will be announced in the product.

9. Contact

Questions or requests: support@scaletrack.com.

Obscale LLC
1400 Hooper Ave, Floor 2, PMB 17400532, Toms River, New Jersey 08753, United States