Privacy Policy

Last updated October 1, 2026

ScaleLine is back-office software for direct sales brands. This policy explains what personal information we handle, why, and what control you have over it. It covers scalelinehq.com, the ScaleLine admin, and the rep portal.

Two roles, depending on whose data it is

For brands, their staff, and visitors to this website, ScaleLine decides how your information is used and is responsible for it under this policy.

For a brand's reps, preferred customers, and shoppers, ScaleLine processes information on that brand's behalf and follows its instructions. The brand's own privacy policy governs that data. If you're a rep or customer, contact the brand you work with to access, correct, or delete your information. If you contact us instead, we'll pass your request to the brand and help them respond.

What we collect

Account information

Name, email address, role, and staff permissions for people who sign in. Passwords are stored only as salted PBKDF2 hashes, never in readable form.

Network data a brand manages in ScaleLine

• Rep and preferred-customer profiles: name, contact details, who enrolled them, rank, sales volume, commissions, and payout status.
• Onboarding records a brand requires, which can include a government tax identifier, date of birth, address, phone number, signed agreements, and signature evidence such as IP address and device details. These fields are encrypted with AES-GCM before they're stored.
• Content people post in the portal, such as community posts, photos, comments, and announcements.

Store data

When a brand connects its Shopify or BigCommerce store, we receive orders, customer names and email addresses, products, and discount codes so we can credit sales to reps. Store credentials are encrypted at rest.

Share-link activity

When someone opens a rep's share link, we record the time, the browser's user-agent string, and the referring page. We don't store the visitor's IP address with these clicks.

Technical data

Like any website, our hosting provider processes IP addresses and request details to deliver and secure the service. We keep application logs for troubleshooting.

Cookies and local storage

• Sign-in: sl_session keeps you signed in. sl_return is set only while ScaleLine or brand support staff are viewing an account on someone's behalf.
• Rep attribution on brand stores: when a shopper arrives through a rep's link, the brand's store remembers that rep for up to 90 days, in a cookie and in local storage, so later orders are credited correctly.
• No ad or analytics trackers: this website doesn't use advertising cookies or third-party analytics. It loads fonts from Google Fonts, which means Google receives your IP address when the page loads.

How we use information

• To run the service: attributing orders, calculating commissions and ranks, preparing payouts, and showing reps their progress.
• To send service email such as invitations, password resets, and account notices.
• To provide support, keep the platform secure, prevent fraud, and keep an audit log of account changes.
• To meet legal, tax, and accounting obligations.

We don't sell personal information, and we don't use it for advertising.

AI features

Some features use AI: help articles and the rep assistant use Anthropic's Claude, and share-caption suggestions use Cloudflare Workers AI. When you use one, we send the provider the request and only the account information needed to answer it. AI output can be wrong, so earnings projections and other generated answers are estimates, not promises.

Service providers

We share information only with providers that help us run ScaleLine, and only as needed:

• Cloudflare: hosting, database, file storage, email delivery, and AI inference.
• Stripe: payments and rep payouts, when a brand turns them on.
• Anthropic: AI help and the rep assistant.
• Shopify or BigCommerce: the brand's own store platform, which exchanges order and customer data with us at the brand's direction.

We may also disclose information when the law requires it, to protect people's rights or safety, or as part of a merger or acquisition, in which case this policy would continue to apply.

Where data is processed

Cloudflare operates a global network, so your information may be processed outside the country where you live. Where the law requires it, we rely on appropriate safeguards for those transfers.

How long we keep it

We keep account and network data while a brand's account is active. Posted commission periods and audit logs are kept as permanent business records for that account. When a brand closes its account, it can export its data first. After that, we delete it or make it anonymous, except where we need to keep records for legal, tax, or dispute purposes.

Security

Everything travels over HTTPS. Sensitive onboarding fields and store credentials are encrypted at rest, passwords are hashed, staff access follows per-person permissions, and support access to an account is recorded in that account's audit log. No system is perfectly secure, but we'll tell affected brands promptly if we learn of a breach involving their data.

Your rights

Depending on where you live, including under the GDPR, UK GDPR, Canadian privacy law, and US state privacy laws, you may have the right to access, correct, delete, or export your information, and to object to or restrict how it's used. To make a request about your own ScaleLine account, email hello@scalelinehq.com. Reps and customers should contact their brand first, as described above. You can also complain to your local data protection authority.

Children

ScaleLine is a business tool and isn't meant for anyone under 18. We don't knowingly collect information from children.

Changes to this policy

If we change this policy, we'll update the date at the top. For material changes, we'll also email the account owner of each brand before the change takes effect.

Contact

Questions about privacy: hello@scalelinehq.com.