Privacy Notice
Effective date: October 7, 2026 · Version 1.5
How ScaleIQ handles personal data across our website and the Service.
This Privacy Notice explains how ScaleIQ, LLC handles personal data in connection with our website (scale-iq.ai) and the ScaleIQ Service. ScaleIQ operates exclusively in the United States with USA-only sales. This Notice addresses applicable US state privacy laws, including the Texas Data Privacy and Security Act (TDPSA) and the California Consumer Privacy Act (CCPA/CPRA) for California-resident customers.
Two roles, two scopes
- Controller — for marketing-site visitors, prospects, account administrators, and personnel of our customers and prospects. This Notice describes that processing.
- Processor — for personal data within Customer Data processed through the Service. That processing follows the customer’s instructions and our Data Processing Addendum. End users of a customer should contact that customer directly.
What we collect
You give us
- Account & contact data — name, business email, role, employer.
- Billing data — billing contact and tax details; payment is handled by Microsoft or our payment processor, and we do not store full card numbers.
- Communications — messages you send to us.
- Survey responses — answers you give in surveys on our website, such as the PersonaIQ persona survey.
- Notice subscriptions — the email address you give us to receive subprocessor change notices.
Collected automatically
- Usage & device data — pages viewed, features used, IP address, timestamps.
- Cookies and similar technologies — see our Cookie Notice.
From the Service (as processor)
What we process depends on the ScaleIQ product you use:
- ComplyIQ — your questionnaire answers, the documents you choose to upload, and the public web pages you authorize us to review. ComplyIQ does not access your Microsoft tenant and uses no Microsoft Graph permissions.
- AssessIQ and the other CoIQ platform Capabilities (including GovernIQ and ValueIQ) — Microsoft 365 tenant configuration and usage metadata read under tenant-administrator consent (for example, policy, identity, sharing, and adoption signals).
- PersonaIQ — tenant signals read under tenant-administrator consent (for example, Entra role, usage, and work-pattern metadata) and answers to its short role-level survey. PersonaIQ does not read the content of email, files, or chats and is designed not to identify individuals in its outputs.
- TenantIQ Cloud — configuration, permission, and workload metadata from the source and target Microsoft tenants you authorize for a migration assessment.
- Every product — the assessment results derived from the data above.
ScaleIQ products other than ComplyIQ are designed to read only the metadata needed for readiness scoring, under least-privilege Microsoft Graph permissions that your administrator grants, with each customer’s data kept separate by design. ComplyIQ does not access your Microsoft tenant and uses no Microsoft Graph permissions.
Sensitive data categories
Under the Texas Data Privacy and Security Act, certain categories of data are considered sensitive and require consent before processing. These include: biometric data, health and medical data, financial data, data revealing racial or ethnic origin, religious beliefs, sexual orientation, immigration status, and personal data of known children. ScaleIQ does not intentionally collect sensitive data categories through the Service. If you believe sensitive data has been submitted, contact privacy@scale-iq.ai immediately (TDPSA § 541.002).
Why we use it
| Purpose | Legal basis |
|---|---|
| Provide and operate the Service and website | Contract performance |
| Bill, collect payments, prevent fraud | Contract / legal obligation / legitimate interest |
| Support, troubleshoot, secure the Service | Legitimate interest / legal obligation |
| Analytics and product improvement | Legitimate interest (or consent where required) |
| Marketing communications | Consent or legitimate interest (with opt-out) |
Who we share it with
- Service providers / subprocessors — cloud hosting and supporting services that process data on our behalf under written agreements. See our Subprocessors list.
- Authorities — when required by law or to protect rights, safety, or property.
- Successors — in a merger, acquisition, or asset sale, with notice where practical.
Microsoft may store prompts and outputs for a limited period to monitor for misuse of its AI services, as described in its terms.
We do not sell personal data and we do not share it for cross-context behavioral advertising, as defined under US state privacy laws.
Where data is processed
The Service runs on Microsoft Azure. Customer Data is stored in Microsoft Azure’s East US 2 region. AI processing may occur in other Azure regions. Where customers are located in jurisdictions requiring transfer mechanisms, we use Standard Contractual Clauses or other approved transfer mechanisms, with supplementary measures including encryption in transit and at rest. Note: ScaleIQ’s primary sales and operations are USA-only. If EU or UK residents independently access the Service, GDPR and UK GDPR may apply; please contact privacy@scale-iq.ai for more information.
How long we keep it
ScaleIQ processes and retains personal data only to the extent adequate, relevant, and reasonably necessary for the purposes for which it was collected, consistent with the data minimization principle of the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code § 541.101(a)(2)). See our Data Retention & Deletion Policy.
Assessment data uses two retention tiers. Tier A — Active Assessment Data (assessment inputs, findings, and reports) — is kept for 24 months from delivery of the applicable Report of Findings and can be deleted earlier on request. Tier B — WORM Evidence Blobs, which are the documents submitted for an assessment, dated SHA-256-hashed snapshots of the URLs Customer authorizes us to review, and the digitally signed record of each completed assessment (inputs, model version, and outputs) — is kept for seven (7) years from capture in write-once-read-many (WORM) immutable storage as a security and evidentiary integrity control. This retention is not intended to supersede any non-waivable legal rights except to the extent required by applicable law.
Deletion limits. WORM Evidence Blobs generally cannot be deleted prior to expiration of the 7-year WORM Retention Period, including following a deletion request or termination of your account. Where applicable law grants you a right to erasure that no statutory exemption permits us to refuse, we will restrict all further processing of the affected data, apply cryptographic erasure where technically available, and purge the data at the earliest point the immutability configuration permits. We will tell you in writing when we do this.
Texas residents — your rights (TDPSA)
Texas residents have the following rights under the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code § 541 et seq.):
- Right to Know — confirm whether we process your personal data and access a copy.
- Right to Correct — correct inaccuracies in your personal data.
- Right to Delete — request deletion of personal data we hold about you, subject to the WORM Evidence Blob limitation described above.
- Right to Portability — receive your personal data in a portable, machine-readable format.
- Right to Opt-Out — opt out of the sale of personal data, processing for targeted advertising, or profiling for decisions with legal or similarly significant effects.
- Right to Appeal — if we deny your request, you may appeal within 60 days of our denial, and we will respond within 60 days of receiving the appeal.
Deletion requests. You may request deletion of your Active Assessment Data (Tier A) by contacting privacy@scale-iq.ai. We will respond to your request within forty-five (45) days, and may extend once by a further forty-five (45) days where reasonably necessary, in which case we will tell you why. WORM Evidence Blobs (Tier B) are subject to the 7-year WORM Retention Period described under “How long we keep it,” including the limited erasure path set out there.
To exercise these rights, contact: privacy@scale-iq.ai or visit scale-iq.ai/legal/dsar/.
Global Privacy Control (GPC)
ScaleIQ recognizes and honors the Global Privacy Control (GPC) browser signal as an opt-out of the sale of personal data and targeted advertising processing, as required by the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code § 541.055), effective January 1, 2025.
California residents — your rights (CCPA/CPRA)
California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act. To opt out of the sale or sharing of personal data (we do neither), or to exercise any CCPA/CPRA right, visit our Data Subject Access Request page. California residents may also designate an authorized agent to make requests on their behalf. See our DSAR Policy for the authorized-agent procedure.
Automated decision-making
We do not make decisions producing legal or similarly significant effects about individuals using solely automated processing. AI features surface insights for human review; customers decide how those insights inform their own decisions. See our AI & Responsible AI Policy.
Security & breach notification
ScaleIQ maintains reasonable security procedures and practices appropriate to the nature of the personal information, as required by Tex. Bus. & Com. Code § 521.052. In the event of a security breach affecting Texas residents’ personal data, ScaleIQ will notify affected individuals without unreasonable delay and will notify the Texas Attorney General’s office if the breach affects more than 250 Texas residents, as required by Tex. Bus. & Com. Code § 521.053.
Children
The Service is not directed to children under 16 and we do not knowingly collect their data.
US state notices
For California, Colorado, Connecticut, Virginia, Texas, Utah, and other state residents: the sections above describe the categories of personal data, sources, purposes, and recipients. We do not sell or share personal data for cross-context behavioral advertising. To exercise rights, see Data Subject Requests.
Contact
Privacy team: privacy@scale-iq.ai
Registered office: ScaleIQ, LLC, 240 W Galveston St, #1828, League City, Texas 77573, USA
Privacy mail: Attn: Privacy, same address