Legal · Last updated 27 September 2026
Privacy Policy
ScaleIO is a go-to-market platform made by Scalemind Consulting (Pty) Ltd. This policy explains what personal information we process, why, who we share it with, how long we keep it and how you can exercise your rights under South Africa's Protection of Personal Information Act, 2013 (POPIA).
1. Who we are
Scalemind Consulting (Pty) Ltd ("Scalemind", "we", "us"), registration number 2024/306582/07, 48 Beach Road, Noordhoek, Cape Town, Western Cape, 7979, South Africa. ScaleIO is our product.
Information Officer: Gavin Gamsu · privacy@scaleio.ai
2. Two roles: responsible party and operator
- Responsible party. For people who visit our website, book a demo, or are users of a ScaleIO account (our customers' staff), Scalemind decides why and how their information is processed.
- Operator. Our customers are businesses. When a business uses ScaleIO to talk to its customers (for example over WhatsApp, Facebook or Instagram), that business is the responsible party for its customers' information and Scalemind processes it on the business's instructions, under a written agreement. If you are a customer of a business that uses ScaleIO, please also read that business's privacy policy and contact it first about your information.
3. What we collect
From website visitors and prospects
- Details you give us: name, email, phone number, company, and what you tell us when you book a demo or send a message.
- Usage and device information: pages viewed, referring link and campaign tags, approximate location from IP address, browser and device type. Analytics and advertising cookies are set only if you accept them in our cookie banner.
From users of a ScaleIO account
- Account details: name, work email, role and permissions, login activity, and Google sign-in identifiers if you use Google to sign in.
- Content you create in ScaleIO: strategies, drafts, approvals, notes and settings.
Processed for our customers (as operator)
- Contact and conversation data: names, phone numbers, email addresses, messages and attachments exchanged over WhatsApp, email, web forms, Facebook and Instagram.
- CRM records: companies, contacts, deals, activities and notes.
- Advertising and campaign data from Google Ads and Meta ad accounts that the customer connects, such as spend, clicks and conversions.
4. Information we receive from Meta (Facebook and Instagram)
When a business connects its Facebook Page or Instagram professional account to ScaleIO, it authorises our Meta app to access that account on its behalf. Through that connection we receive:
- the Page's and Instagram account's own posts, and their performance data (reach, engagement and similar insights);
- comments left on those posts, including the commenter's public name and Meta-issued ID where Meta provides them;
- direct messages to the Page or Instagram account, only if the business enables messaging in ScaleIO;
- basic details of the Pages and accounts the business manages, so it can choose which to connect.
We use this information only to provide ScaleIO's features to that business: showing comments and messages in its inbox, letting its staff reply to or hide them, publishing the posts it schedules and approves, and reporting on its own performance.
We do not sell Meta data, we do not use it to build advertising profiles, and we do not share it with anyone except the service providers listed in section 7 who help us run ScaleIO. Our use of information received from Meta follows the Meta Platform Terms.
5. Why we use personal information (and on what basis)
- To provide ScaleIO to our customers and their users: performing our contract.
- To respond to enquiries and book demos: at your request.
- To secure, support and improve the service, including fixing faults and preventing abuse: our legitimate interest.
- To measure and advertise our own product with cookies and pixels: your consent, which you can withdraw at any time through "Cookie settings".
- To meet legal obligations, such as tax records.
We only send marketing messages to people who have agreed to receive them or who are existing customers, and every message lets you opt out.
6. AI features
ScaleIO uses AI models to draft replies, content and reports. Drafts that go to the public or to our customers' contacts require approval by a person unless the customer has deliberately switched on automatic replies for routine questions. Content sent to AI providers is used to produce the response for the customer. We choose providers whose terms state that customer content submitted through their business APIs is not used to train their general models.
7. Who we share information with
We use service providers ("sub-operators") who process information on our instructions:
- Microsoft Azure: hosting, databases and file storage (primarily in the South Africa North region).
- Meta: WhatsApp Business Platform, Facebook and Instagram, for the channels a customer connects.
- AI providers: OpenAI, Anthropic and Google (Gemini), for drafting and analysis.
- Pinecone: search index for a customer's knowledge base.
- Google: sign-in, and Analytics and Ads for our own marketing (with consent) and for the customer's connected ad accounts.
- LinkedIn: publishing and our own marketing (with consent).
- Amazon Web Services: video rendering for generated creative.
- Integrations a customer chooses to connect, such as its CRM, email provider or online store.
We may also disclose information when the law requires it, or to protect our rights and the safety of others.
8. Information sent outside South Africa
Some of the providers above process information outside South Africa, mainly in the United States and the European Union. We transfer information only where POPIA section 72 allows it: for example, where the provider is bound by a written agreement giving an adequate level of protection, or where the transfer is necessary to perform a contract.
9. How long we keep information
- Customer and operator data: for as long as the customer's ScaleIO account is active. After an account closes or a channel is disconnected, we delete or anonymise the related data within 30 days unless the customer asks us to return it first, or the law requires us to keep it.
- Demo and enquiry records: up to 24 months after our last contact with you.
- Financial records: as long as tax law requires (currently five years).
10. How we protect information
Data is encrypted in transit, access is restricted by role and permission, connection secrets such as Meta tokens are stored encrypted, and each customer runs on its own separate instance and database. If we become aware of a security compromise affecting your information, we will notify you and the Information Regulator as POPIA requires.
11. Your rights
You may ask us to confirm whether we hold your information, to see it, to correct or delete it, or to object to its processing, including for direct marketing. To delete data that ScaleIO holds, see our data deletion instructions. For other requests, email privacy@scaleio.ai. We respond within 30 days. If the information was collected by one of our customers, we will pass your request to that business and help it respond.
You may also complain to the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@inforegulator.org.za.
12. Children
ScaleIO is a business service and is not directed at children under 18.
13. Changes
We will post any changes here with a new "last updated" date, and tell customers about material changes in advance.