Privacy Policy

1The distinction that governs everything below

For operators — the businesses that license SCAIL — we are the business / controller. We decide what to collect and why, and this policy describes it.

For consumers — the clients of those businesses, whose credit reports, addresses, dates of birth and dispute histories live inside an operator’s workspace — we are a service provider / processor. We hold that data on the operator’s instructions and do not decide what happens to it.

If you are a consumer working with a credit repair company that runs on SCAIL, your relationship is with that company, not with us. Ask them for their privacy policy and send privacy requests to them. If you reach us instead, we will refer you to them and help them respond — see section 7.

2What we collect from operators

• Account — name, business name, work email, phone, password (hashed, never stored in readable form), chosen subdomain.
• Billing — plan, subscription status, invoice history, and a payment-method token. We never see or store your full card number; it goes directly to our payment processor.
• Usage — pages visited in the app, features used, AI volume consumed, timestamps, IP address and browser/device information, and error logs.
• Support — what you write to us, and what you ask the in-app assistant.

3What sits in an operator's workspace

On the operator’s instructions, the platform stores the material a credit repair engagement generates. It is sensitive, and worth naming plainly: consumer names, postal and previous addresses, dates of birth, the last four digits of Social Security numbers, employers, telephone numbers and email addresses; credit reports and scores from all three bureaus; tradelines, balances, payment histories, collections and public records; dispute letters, bureau responses and certified-mail tracking; uploaded identity and address documents; and messages between an operator and their client.

We access it to run the service, to fix a fault, to prevent abuse, or when an operator asks us for support. We do not sell it, we do not share it for advertising, and we do not use it to market to consumers.

4Why we use it

• To provide the platform and the features an operator’s plan includes.
• To bill, and to collect what is owed.
• To secure the service — authentication, abuse and fraud prevention, audit logging.
• To support operators when they contact us.
• To improve the product using aggregated, de-identified statistics that identify nobody.
• To meet legal obligations and respond to lawful requests.

We do not sell personal information, and we do not share it for cross-context behavioral advertising — as those terms are defined by the California Consumer Privacy Act.

5Who else touches it

The platform runs on a small set of vendors, each with a defined job. The current list, with what each one receives, is maintained in the Data Processing Addendum. In summary: cloud hosting, the database and file storage, the AI provider that drafts letters and analyses, payment processing, transactional email, SMS delivery, certified-mail dispatch, PDF rendering, and credit-report retrieval where an operator has enabled it.

We also disclose information when the law requires it, to enforce our agreements, or as part of a merger or sale of assets — in which case notice is given and this policy continues to apply until replaced.

None of the above applies to text messaging data. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and text messaging originator opt-in data and consent are not shared with any third parties under any of the categories in this section. See section 12.

6Cookies and what the website actually does

The marketing site at scailapp.com runs no advertising trackers, no analytics pixels and no third-party cookies. It loads a webfont from Google Fonts, which necessarily reveals your IP address to Google in order to serve the file. It stores your chosen color scheme in your browser’s local storage so the site and the app agree; that value never leaves your device.

The application sets strictly necessary cookies to keep you signed in and to protect the session. There is nothing to opt out of because there is nothing optional being set.

6AThe SCAIL mobile app

The SCAIL app for iPhone and Android shows the same workspace as the web, so everything above applies to it. It adds only what an app needs to work:

• Sign-in. Your session is kept in your device’s secure storage (the iOS Keychain or Android Keystore). We never ask the app to store a password.
• Face ID, Touch ID or fingerprint. Checked entirely by your device. We never receive or store any biometric data; the app is only told whether the check passed.
• Notifications. If you allow them, we store a push token for your device so we can tell you about messages and progress on your file. Signing out removes it. You can turn notifications off in your phone’s settings at any time.
• Camera, photos and microphone. Used only when you choose to attach a document or record a voice note, and only for that. Nothing is captured in the background.
• No tracking. The app contains no advertising, analytics or tracking SDKs, does not track you across other apps or websites, and does not sell your information.

Deleting your account. In the app, open More → Delete my account (clients) or ☰ Menu → Account and settings → Delete my account (company staff), or, on the web, your account page. We file your request at once, stop notifications to your device, and the workspace’s team completes it within 45 days. Where the law requires a record of the work done for you to be kept — a signed service agreement, for example — that record is kept for that purpose only, as section 7 explains. You can also email info@scailapp.com to ask for deletion.

6BHalo, our AI assistant

SCAIL includes Halo, an assistant that answers questions, explains a credit file and drafts replies and letters. Halo is powered by Anthropic’s Claude models. When Halo is used, the text it needs to answer — the question or message, and the relevant parts of the credit file (for example names, accounts under dispute and their status) — is sent to Anthropic to produce the answer. Anthropic processes it for that purpose only and, under its commercial terms, does not use it to train its models.

• You choose. The SCAIL app asks for your permission before Halo is used with your information, and you can change your answer at any time in the app (Account and settings → AI and Halo) or by asking your credit-repair company.
• If you are a client and say no, Halo does not answer your messages; a person on your company’s team does, and your file is not sent to Anthropic for replies to you.
• If you work for a company and say no, Halo is turned off for you in the app.
• Nothing sends by itself. Letters and outbound messages Halo drafts for staff are not sent until a person sends them.

7Your rights

Depending on where you live — California’s CCPA/CPRA, other US state privacy laws, and the GDPR where it applies — you may have the right to know what we hold, to get a copy, to correct it, to delete it, to limit the use of sensitive information, and not to be discriminated against for asking.

Operators: email privacy@scailapp.com. We will verify you through your account and respond within 45 days.

Consumers: send your request to the credit repair company you are working with. They control your data; we act on their instruction. If you contact us directly we will pass the request to them promptly and support them in fulfilling it, but we cannot delete or hand over their records on our own initiative.

You may use an authorized agent, and we may ask for proof of that authority.

8How long we keep it

Operator account and billing records are kept while the account is open and afterwards for as long as tax, accounting and legal obligations require. Workspace data is kept while the workspace is active and for 30 days after cancellation, then deleted from production; encrypted backups age out within 90 days. Security and audit logs are kept for up to 12 months.

9Security

Data is encrypted in transit and at rest. Access is scoped per workspace at the database level so one operator cannot reach another’s records. Credentials that must be stored are encrypted with a separate key. Staff access is limited to those who need it, and is logged.

No system is perfect. If a breach affects your data we will notify affected operators without undue delay, and support them in notifying consumers where the law requires it.

10Children

SCAIL is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18 as an account holder.

11Where data is processed

The platform and its subprocessors operate in the United States. If you access it from elsewhere, you understand your information is processed in the US.

12SMS / Text Messaging

SCAIL (Scail Capital LLC) uses your mobile number only to send the account notifications you opted in to receive — account setup confirmations, security alerts, reminders and support replies. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the categories of sharing described elsewhere in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

13Changes, and how to reach us

We will post any change here and update the effective date. For material changes affecting operators we will give notice by email.

Scail Capital LLC · privacy@scailapp.com