Privacy Policy
Last updated:
What changed
- : Cookies section: how Suplify measures its own sign-up ads. When you enter your email to sign up, Meta receives a scrambled (hashed) version of it; trial starts and first payments are also reported from our server; and a first-party cookie remembers which ad or link brought you (90 days).
- : The list of service providers now names every company that handles personal data for Suplify: Google (address autocomplete, sign-in), Openprovider (domain registration), Telegram and Slack (optional chat-app channels and alerts), Klaviyo, Meta and other advertising tools merchants choose. We also added how to report a security problem and how fast we notify after a breach.
This policy explains how Healis LLC ("Suplify", "we") handles personal data. It covers people who visit scale1.app, store owners who use Suplify ("merchants") and their team members, and, in section 3, shoppers of stores built with Suplify.
We collect only what we need to run Suplify, we don't sell personal data, and we don't use your data or your customers' data to train AI models.
1. Who is responsible
For data about merchants, their team members and visitors of our website, the controller is Healis LLC, 5830 E 2nd St, Ste 7000 #36257, Casper, WY 82609, United States. Contact for all privacy questions: support@scale1.app (subject "Privacy").
2. Data about merchants and visitors
Account data: email, name, sign-in codes and sessions, team members
Why: Create and secure your account, sign you in
Legal basis (GDPR): Contract (Art. 6(1)(b))
Business details: legal name, business address, country, VAT ID, company number, contact email
Why: Labels, store legal notice and policy pages, tax and compliance, payouts
Legal basis (GDPR): Contract; legal obligation (Art. 6(1)(c))
Store content: brand, logo, products, texts, images, settings, onboarding answers, AI prompts and outputs
Why: Build and run your store, provide AI features
Legal basis (GDPR): Contract
Billing and payout data: plan, invoices, payment status, Stripe account ID and verification status (card and bank details are held by Stripe, not by us)
Why: Charge your plan, pay out your sales, recover amounts owed
Legal basis (GDPR): Contract; legal obligation (accounting and tax records)
Support and communications: emails, chat messages, feedback
Why: Answer you and improve our help
Legal basis (GDPR): Contract; legitimate interests (Art. 6(1)(f))
Usage and device data: pages used, actions in the dashboard, IP address, browser, error reports
Why: Security, fraud prevention, fixing bugs, understanding which features help
Legal basis (GDPR): Legitimate interests
Product news and tips by email
Why: Tell you about new features and offers for your store
Legal basis (GDPR): Legitimate interests for existing customers, with an unsubscribe link in every email; consent where required
We receive some data from others: Stripe tells us whether your connected account is verified and can receive payouts; our domain and email providers tell us the status of your domain and mailbox.
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Fraud and risk checks may flag an account for human review.
3. Shoppers of stores built with Suplify
When you visit or buy from a store built with Suplify, the store owner (the merchant) is the controller of your data and is responsible for it; their privacy notice is linked in the store footer. Suplify processes that data on the merchant's behalf as their processor, under a data processing agreement, to host the store, process payments through Stripe, send order emails and have the order produced and shipped by our fulfilment suppliers. Please send requests about your data to the store; we will help the store answer them.
For a few purposes we act on our own behalf: keeping the platform secure and preventing fraud and abuse across stores, and meeting our own legal obligations (legitimate interests and legal obligation).
5. International transfers
Healis LLC is a US company, and some providers are in the United States. When personal data from the EU/EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments where needed), or rely on a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Our main database is hosted in Switzerland and our servers are in Germany. You can ask us for a copy of the safeguards.
6. How long we keep data
- Account and store data: while your account is active, then up to 30 days to let you export your data; after that we delete or anonymise it.
- Orders, invoices and payment records: as long as tax and accounting laws require (usually up to 10 years).
- Shopper data processed for merchants: as instructed by the merchant and our DPA; deleted or returned when the merchant's store is closed, except where we must keep it by law.
- Support messages: up to 3 years after the conversation ends.
- Security logs: up to 90 days, longer if needed to investigate an incident.
- Encrypted backups: up to 30 days, after which they are overwritten.
7. Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use (including to direct marketing at any time), receive it in a portable format, and withdraw consent at any time without affecting earlier processing. To use a right, email support@scale1.app. We answer within one month (we may extend this by two months for complex requests and will tell you). We may need to confirm your identity.
You can complain to a data protection authority, in particular in the EU country where you live or work, the UK Information Commissioner's Office (ICO) or the Swiss Federal Data Protection and Information Commissioner (FDPIC). We'd appreciate the chance to help first.
8. Notice for US residents (including California)
In the last 12 months we collected these categories of personal information: identifiers (name, email, IP address, account ID); commercial information (plan, orders, transactions); internet activity (use of our website and dashboard); geolocation derived from IP address (approximate); professional information (business details); and inferences limited to fraud and risk signals. Sources, purposes and recipients are described in sections 2 to 4. We do not use or disclose sensitive personal information for purposes that require a right to limit.
We do not sell personal information. Where you allow advertising cookies on our marketing and sign-up pages (section 9), sending those events to Meta, TikTok and Google to show our ads to people who started signing up can count as sharing for cross-context behavioural advertising under some US state laws; you can decline in the cookie bar. We have no actual knowledge of selling or sharing data of anyone under 16. Residents of California and other US states with privacy laws may request to know, access, correct and delete personal information, and appeal our decision, by emailing support@scale1.app. You may use an authorised agent. We will not discriminate against you for using these rights. Retention is described in section 6.
10. Security
We protect data with encryption in transit (TLS) and at rest, row-level access controls that keep every store's data separate, least-privilege access for staff, sign-in by one-time codes, encrypted backups, monitoring and alerting. No system is perfectly secure; if a breach affects you we will tell you as the law requires: affected merchants without undue delay and within 48 hours of us becoming aware (see the DPA), supervisory authorities within 72 hours where that duty is ours, and affected individuals without undue delay when the risk to them is high. To report a vulnerability, email security@scale1.app (see /.well-known/security.txt); we do not take action against good-faith research.
11. Children
Suplify is for businesses and adults. We do not knowingly collect data from children under 16.
12. Changes
We will update this policy when our processing changes and show the new date at the top. For material changes we will tell merchants by email or in the dashboard before they apply.