Privacy Policy

1. Scope and Who We Are

This Privacy Policy describes how Bitscaled LLC ("Bitscaled," "we," "us," or "our"), a Florida limited liability company operating from Tampa, Florida, United States, handles personal information when you visit https://bitscaled.tech, create an account, subscribe to our newsletter, submit a form, use Client Workspace, Intranet, or Admin portals, run a VaultTools check, or receive managed IT and related professional services.

It should be read with our Terms of Service, Cookies Policy, Acceptable Use Policy, and Data Processing Agreement. A signed MSA, SOW, BAA, NDA, or DPA controls over this policy where they conflict for that engagement.

We do not publish a street address on this page. Formal notices may be sent to Bitscaled LLC, Tampa, FL, United States. Request a mailing address from legal@bitscaled.tech if you need one for service of process. We have not appointed a GDPR Article 37 Data Protection Officer. Privacy questions go to the contacts in Section 20 — not a DPO title or dpo@ alias.

2. Controller Versus Processor

Our role depends on the data and the product surface. This split is the starting point for every other section of this policy.

• Controller — Website Data. We decide how to process information from public site visitors, contact and quote forms, newsletter subscribers, and account holders (Workspace, Intranet, and Admin users). That includes authentication, billing contacts, and support tickets you open with us about our own services.
• Processor — Client Data. When we access data in your systems, tenants, endpoints, mailboxes, or backups to deliver Managed Services, we process that Client Data on your documented instructions under the DPA (and a BAA where HIPAA applies). You are the controller of Client Data; we do not use it for Bitscaled marketing.
• Controller — VaultTools probe requests. When you submit a domain, IP, email, or optional Microsoft 365 connection to VaultTools, we are the controller of that request record (who submitted it, what was probed, and the resulting snapshot). You must be authorized to assess the target. Unauthorized scanning is prohibited.

3. Information We Collect

The categories we collect as a controller depend on how you interact with us:

• Identity and contact: name, business email, phone, company, job title, and message content from forms, chat, email, or phone.
• Account and portal: credentials (stored hashed), role, organization membership, MFA status, session metadata, and legal-policy acknowledgments.
• Billing: invoice details, PayPal transaction references, and billing contacts. We do not store full payment-card numbers (PAN).
• Newsletter: email address and subscription preferences for the public list.
• Technical: IP address, user agent, approximate location derived from IP, referrer, and diagnostic logs needed to operate and secure the services.
• VaultTools inputs: domain names, IP addresses, email addresses you submit, questionnaire answers, and optional Microsoft 365 OAuth tokens used only to produce the snapshot you requested.
• Support and security: ticket content, abuse reports, and records needed to investigate incidents or enforce the AUP.
• Applicants: information you submit through careers or recruiting channels, used only to evaluate and communicate about that application.

Google Maps AddressAutocomplete is used only inside Intranet CRM address fields. It is not loaded on the public website. We do not seek special-category data or PHI through the public website. Do not send PHI unless a BAA is in place and the channel is appropriate.

4. How We Use Personal Information

As a controller, we use Website Data and VaultTools request data to:

• Provide, secure, and improve the websites, portals, APIs, and public tools.
• Create and administer accounts, including organization invites and role changes.
• Respond to sales, support, and privacy requests.
• Send transactional messages (security alerts, invoices, policy acknowledgments).
• Send marketing email only where permitted, with an unsubscribe path (Section 18).
• Measure public-site usage after analytics consent, and operate cookieless Vercel Analytics and Speed Insights when enabled.
• Prevent fraud, abuse, and unauthorized VaultTools scanning.
• Comply with law, enforce contracts, and keep legal and signature records.
• Enrich Bitscaled CRM records for our own B2B sales and account operations.

As a processor, we use Client Data only to perform the contracted Managed Services, to maintain related tickets and runbooks, and as otherwise instructed in the DPA or required by law.

5. Legal Bases (GDPR and UK GDPR)

If the EU GDPR or UK GDPR applies, we rely on these bases for controller processing:

• Contract — creating an account, providing Workspace, fulfilling a request, or performing a paid engagement described in an order or MSA.
• Legitimate interests — securing the services, B2B CRM and relevant sales contact, improving features, and defending legal claims, balanced against your rights.
• Consent — non-essential analytics cookies and optional marketing email. You may withdraw consent without affecting processing that already occurred.
• Legal obligation — tax, accounting, lawful requests, and retention of certain legal and signature records.

Processor activity for Client Data is governed by the DPA and your instructions, not by a separate Bitscaled marketing purpose.

6. Cookies, Local Storage, and Similar Technologies

A full inventory lives in the Cookies Policy. Cookie consent is stored in browser localStorage under `bitscaled-cookie-consent`, not as a cookie. Site theme is stored in localStorage under `bitscaled-theme` and is not a cookie.

Essential cookies (needed for the site and signed-in sessions) include:

• `auth-session` — encrypted HTTP-only session for Workspace, Intranet, and Admin.
• `x-csrf-token` — HttpOnly CSRF token compared on state-changing API calls.
• `x-csrf-token-js` — JavaScript-readable CSRF copy for authenticated browsers.
• `_GRECAPTCHA` — Google reCAPTCHA on public forms (contact, login, invitation acceptance, and VaultSandbox spoof-test submissions).
• `refresh-token` — HttpOnly refresh credential aligned with signed-in sessions.

Analytics cookies load only after you allow analytics: `_ga`, `_ga_*`, `_gid` (Google Analytics 4) and `_dd_s` (Datadog RUM on public pages when configured). Vercel Analytics and Speed Insights are cookieless. Marketing cookies are not used on the public site unless listed in the Cookies Policy.

7. VaultTools Submissions

VaultTools at vaulttools.bitscaled.tech (linked from /tools) accepts domain, IP, and email inputs for DNS/TLS, footprint, breach, ransomware scorecard, BIMI, and related checks. Submit only targets you are authorized to assess. We process the probe request as a controller so we can run the check, return results, prevent abuse, and keep operational logs.

Optional Microsoft 365 security snapshots that use OAuth are completed on vaulttools.bitscaled.tech, not on the Vercel website origin. Guided questionnaire mode does not require Microsoft credentials. Tool output is a point-in-time snapshot, not an audit or guarantee of security.

8. Payments

Workspace invoices that are paid online use PayPal only. PayPal processes card or wallet data under its terms. Bitscaled does not store full PAN on the website or in application databases. We may retain invoice amounts, PayPal references, payer email, and billing contacts needed for accounting and support.

9. AI Features and Hosted MCP

Intranet and Workspace may include AI assistants, article automation, and hosted Model Context Protocol (MCP) endpoints. CRM hosted MCP is `/api/mcp`. Workspace hosted MCP is `/api/workspace/mcp` and uses company-scoped tokens. Optional model providers (for example OpenAI or Anthropic) process prompts only when that provider is configured for the feature. Do not send secrets, PHI, or payment-card data into prompts unless the feature is contracted and appropriate safeguards exist.

We may log prompts, tool names, and MCP call metadata to operate, debug, and secure these features, to enforce permissions, and to investigate abuse. Logs are not used to train public foundation models. AI output can be wrong; review it before relying on it. CRM enrichment vendors listed above process Bitscaled B2B contact data, not Client Data files from your managed environment.

10. Sharing and Subprocessors

We share personal information with service providers that help us host, deliver, secure, measure, and bill the services. The current list is published at Subprocessors. Categories include hosting (including Vercel and databases), email (SendGrid), bot protection (reCAPTCHA), optional analytics, PayPal for invoice checkout, and vendors used only when a feature is configured (for example Microsoft Graph for a VaultTools snapshot you start).

We may also disclose information to professional advisors, to a successor in a merger or asset sale, or when required by law or to protect rights, safety, and security. We do not sell personal information. For Client Data, subprocessors are engaged as described in the DPA.

11. International Transfers

Bitscaled LLC is established in the United States. Personal information is processed in the United States and may be processed in other countries where our subprocessors operate. When we transfer personal data from the EEA, United Kingdom, or Switzerland to a country that is not recognized as providing an adequate level of protection, we use appropriate safeguards. Those safeguards typically include the European Commission Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Addendum, plus supplementary measures where required.

Copies of relevant transfer terms that apply to Client Data are available to customers under the DPA. Website visitors in those regions may contact privacy@bitscaled.tech with transfer questions.

12. Retention, Archive, and Deletion

We keep controller records only as long as needed for the purposes above, then delete or de-identify them, unless a longer period is required by law or a legal hold. Typical examples: account records for the life of the account plus a wind-down period; newsletter records until you unsubscribe; VaultTools request logs for security and abuse prevention; invoice records for tax retention periods.

Intranet CRM contacts and user accounts can be archived and restored through our controlled-delete workflow (snapshot-backed archive, not a silent `deletedAt` toggle). Archive snapshots exist so authorized staff can reverse an accidental delete. Legal, contract, and e-signature records (including MSA, NDA, SOW, BAA, and DPA signature artifacts) are retained as required for the contract, tax, and dispute period even if a related CRM record is archived.

Client Data retention in your environment follows your systems and the DPA. We return or delete Client Data we hold after the engagement ends, subject to backup cycles and legal holds, as described in the DPA.

13. Security

We use administrative, technical, and organizational measures appropriate to the nature of the information we handle as a small professional-services firm: encrypted sessions, CSRF protections, access control, hashing of passwords, and vendor due diligence for subprocessors. No method of transmission or storage is completely secure.

Bitscaled does not claim SOC 2, ISO 27001, PCI DSS, independent pentest reports, or 24/7 staffed data centers. If your sector requires additional assurances, those must be written into an MSA, BAA, or similar agreement.

14. Your Privacy Rights and Access Requests

Where applicable law provides, you may have rights to access, correct, delete, or restrict personal information, to object to certain processing, to withdraw consent, and to data portability. Those rights are not identical in every jurisdiction. GDPR and UK GDPR also include the right to lodge a complaint with a supervisory authority (for example your EEA authority or the UK Information Commissioner's Office).

To make a data-subject access request (DSAR) or other privacy request about Website Data we control, email privacy@bitscaled.tech (copy legal@bitscaled.tech if you prefer). We will verify your identity before fulfilling the request and will respond within the time required by applicable law. We may decline requests that are unfounded, excessive, or that would violate another person's rights or a legal hold.

If your request concerns Client Data we process for a customer, we will direct you to that customer (the controller) or handle the request as the DPA requires. Organization admins manage Workspace member access from team settings.

15. California (CCPA / CPRA)

If you are a California resident, you may have rights to know, delete, and correct personal information, to opt out of sale or sharing, and to non-discrimination for exercising those rights. In the previous twelve months we have collected the categories described in Section 3 for the business purposes in Section 4.

We do not sell personal information and we do not share personal information for cross-context behavioral advertising, as those terms are used in the CCPA/CPRA. We do not have actual knowledge that we sell or share the personal information of consumers under 16. Authorized agents may submit requests to privacy@; we will still need to verify the consumer and the agent's authority.

Submit California requests to privacy@bitscaled.tech. You may also call +1 (813) 419-0419 during Monday to Friday, 8:00 AM to 6:00 PM EST. We do not disclose personal information to third parties for their direct marketing (California Shine the Light). Nevada residents may also email privacy@ to confirm we do not sell covered information.

16. Florida Information Privacy

Bitscaled LLC is based in Tampa, Florida. We apply Florida information-protection and consumer-privacy requirements that apply to our size and activities, including reasonable security and breach-notification duties. Where a Florida consumer privacy right applies to you, you may exercise it through privacy@bitscaled.tech using the same identity-verification process as other DSARs.

17. Children

The services are intended for business users who are at least 18 years old. They are not directed at children under 13, and we do not knowingly collect personal information from children under 13 (COPPA). If you believe we have collected such information, contact privacy@bitscaled.tech and we will delete it.

18. Marketing Email (CAN-SPAM)

We send marketing email only to addresses that subscribed or that we may lawfully contact for B2B communications. Every marketing message includes a working unsubscribe method. Transactional mail (invoices, security notices, policy acknowledgments, product updates required to use an account) is not marketing and may continue while the account or legal obligation lasts. We honor CAN-SPAM and similar rules. Unsubscribe or write privacy@bitscaled.tech or support@bitscaled.tech.

Bitscaled does not send marketing SMS to website visitors. SignalWire Voice/SMS, when used, is contracted client telephony under an MSA/SOW. The client is responsible for TCPA, consent, and opt-out for messages to its own customers. We do not record support or sales calls unless we disclose recording at the time of the call.

19. Changes

We may update this policy by posting a new version at https://bitscaled.tech/legal/privacy and updating the effective date and version. Material changes that affect portal use may require re-acknowledgment of the Privacy Policy together with the Terms and AUP. Continued use of the public website after the effective date constitutes acceptance of the updated policy for website use.

20. Contact

Privacy and DSAR requests: privacy@bitscaled.tech. Legal notices: legal@bitscaled.tech. Product support: support@bitscaled.tech. Phone: +1 (813) 419-0419, Monday to Friday, 8:00 AM to 6:00 PM EST. Mailing line: Bitscaled LLC, Tampa, FL, United States (no published street address).

These addresses are the privacy contacts for this policy. They are not an appointed Article 37 DPO and should not be treated as a DPO job title.