Privacy Policy

SCADABLE · scadable.com · Effective 2026-07-12

This Privacy Policy describes how SCADABLE ("we", "us", or "our") collects, uses, discloses, and protects your personal information when you visit scadable.com, use our services, or otherwise interact with us (together, the "Services"). It also explains your privacy rights and how to exercise them. Reading it will help you understand what happens to your information and what choices you have. If you do not agree with our practices, please do not use the Services. This policy is governed by the laws of Ontario, Canada.

Summary of key points

• What we collect: the personal information you provide and limited information collected automatically, listed under what information we collect.
• Why we process it: to provide and improve the Services, for security, and for the purposes under how we process your information.
• Sensitive information: We do not knowingly collect sensitive categories of personal information such as health data, precise geolocation, biometric identifiers, or government identifiers.
• Sharing: we share information only with the parties and in the situations described under when and with whom we share.
• Your rights: depending on where you live, you may have rights to access, correct, delete, or port your information; see your privacy rights and the regional sections that follow it.
• Contact: the fastest way to reach us about privacy is privacy@scadable.com.

Table of contents

1. What information do we collect?

In short: we collect the personal information you provide to us and limited information collected automatically when you use the Services.

We collect the following categories of personal information:

• name
• email address
• company name
• account credentials
• usage and product analytics data
• IP address

Where the Services collect information automatically (such as device, browser, and usage information, IP address, and approximate location derived from it), we use it to operate, secure, and improve the Services. We do not knowingly collect sensitive categories of personal information such as health data, precise geolocation, biometric identifiers, or government identifiers. All personal information you provide must be true, complete, and accurate.

2. How do we process your information?

In short: we process your information to provide, improve, and administer the Services, communicate with you, prevent fraud and abuse, and comply with law.

We process personal information for these purposes:

• provide and operate the platform
• authentication and account management
• product analytics and improvement
• customer support
• billing and payments

We process personal information only when we have a valid reason to do so, and we never use it for purposes that are incompatible with the ones listed above without telling you first. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

3. What legal bases do we rely on?

In short: we only process your personal information when the law allows us to, and the legal basis depends on where you live and how you interact with the Services.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR and equivalent laws: your consent (which you may withdraw at any time); the performance of a contract with you; our legitimate interests, provided they are not overridden by your rights and freedoms; compliance with a legal obligation; and, in rare cases, the protection of vital interests.

If you are located in Canada, we process information on the basis of your express or implied consent, which you may withdraw at any time, subject to legal or contractual restrictions and reasonable notice.

4. When and with whom do we share your information?

In short: we share information with the service providers below, in business transfers, and when the law requires it. We do not sell your personal information for money.

We share personal information with the following categories of third parties and service providers, each bound to use it only to provide their service to us:

• Auth0 (authentication)
• Stripe (payments)
• PostHog (product analytics)
• DigitalOcean (hosting)

We may also disclose personal information: as part of a merger, acquisition, financing, or sale of assets (in which case this policy continues to apply to your information); when required by law, subpoena, or other legal process; and where disclosure is necessary to protect the rights, safety, or property of our users, the public, or ourselves.

We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under applicable US state laws, and we do not use personal information for targeted advertising. You can contact us about this at any time at privacy@scadable.com.

5. Do we use cookies and other tracking technologies?

In short: yes, like most websites we use cookies and similar technologies; you are in control of them.

We use essential cookies to keep you signed in, and analytics cookies to understand how the product is used. You can control non-essential cookies in your browser settings.

Analytics and tracking providers we work with:

• PostHog

Similar technologies (such as pixels, local storage, and software development kits) may be used for the same purposes. Where our Cookie Policy is published, it lists each category in detail and lets you change your choices at any time.

6. How long do we keep your information?

In short: only as long as we need it for the purposes described here, unless the law requires a longer period.

We retain account data for as long as your account is active, and for up to 24 months after it is closed unless a longer period is required by law.

When we no longer have a legitimate need for your personal information, we delete or anonymize it; if that is not immediately possible (for example, in backups), we store it securely and isolate it from further processing until deletion is possible.

7. How do we keep your information safe?

In short: with organizational and technical measures appropriate to the risk. No system is perfectly secure.

We protect personal data with organizational and technical measures appropriate to the risk, including encryption in transit, access controls limited to the people who need it, and monitoring of our systems.

Despite our safeguards, no electronic transmission or storage technology can be guaranteed to be 100 percent secure, so we cannot promise that unauthorized third parties will never defeat our security. You transmit personal information to and from the Services at your own risk and should only access them in a secure environment.

8. Do we collect information from minors?

In short: no, not knowingly.

We do not knowingly collect personal information from, or market to, children under the age of majority in their place of residence (and never under 13). By using the Services you represent that you meet that age or that a parent or guardian consents to your use. If we learn that we have collected information from a minor, we will deactivate the account (if any) and delete the information promptly. If you become aware of any data we may have collected from a minor, contact us at privacy@scadable.com.

9. What are your privacy rights?

In short: depending on where you live, you may review, change, delete, or receive a copy of your personal information, and object to or restrict how we use it.

Subject to applicable law, you may have the right to: request access to the personal information we hold about you and a copy of it; request correction of inaccurate or incomplete information; request deletion; request portability of the information you provided to us; object to or restrict certain processing; and withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, contact us at privacy@scadable.com. We will respond within the period required by the law that applies to you. We will never discriminate against you for exercising your rights.

10. Residents of the EEA, UK, and Switzerland

This section applies if you are located in the European Economic Area, the United Kingdom, or Switzerland.

If you are in one of these regions, the EU General Data Protection Regulation (GDPR), the UK GDPR read together with the Data Protection Act 2018, or the Swiss Federal Act on Data Protection (FADP) applies to our processing of your personal information. This section adds the detail those laws require on top of the rest of this policy.

Controller and contacts

The data controller responsible for your personal information is the company named at the top of this policy. For any question about this section, contact us at privacy@scadable.com.

We have not appointed a Data Protection Officer. You can contact us at privacy@scadable.com for any data protection matter.

Where Article 27 GDPR requires it, we will appoint a representative in the European Union; contact us for current details.

Where Article 27 UK GDPR requires it, we will appoint a representative in the United Kingdom; contact us for current details.

Legal bases in detail

We process your personal information only when the law allows it. Under Article 6 of the GDPR and the UK GDPR, the lawful bases we may rely on are:

• Consent: you have given us specific, informed, and freely given permission for a stated purpose, and you can withdraw it at any time. Typical example from our processing: analytics cookies.
• Contract: the processing is necessary to perform a contract with you, or to take steps at your request before entering one. Typical example: providing the service you signed up for.
• Legal obligation: the processing is necessary to comply with a law we are subject to. Typical example: keeping tax and accounting records.
• Legitimate interests: the processing is necessary for our legitimate interests, except where those interests are overridden by your rights. Typical example: securing the Services and preventing fraud, always balanced against your rights and freedoms.
• Vital interests: the processing is necessary to protect someone's life. This rarely applies to us.
• Public task: the processing is necessary for a task carried out in the public interest or under official authority. This also rarely applies to us.

Special categories of personal information receive extra protection under Article 9: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data used for identification, health data, and data concerning sex life or sexual orientation. We process special category data only where an additional Article 9 condition applies, such as your explicit consent. We do not knowingly collect sensitive categories of personal information such as health data, precise geolocation, biometric identifiers, or government identifiers.

International transfers

Your information may be stored or processed in countries other than your own. Where we transfer personal information across borders, we use appropriate safeguards such as adequacy decisions or standard contractual clauses.

Where your personal information is transferred outside the EEA, the United Kingdom, or Switzerland, we rely on a lawful transfer mechanism: an adequacy decision covering the destination country where one exists, or appropriate safeguards such as the European Commission's standard contractual clauses, used with the UK Addendum or the ICO's International Data Transfer Agreement (IDTA) for transfers from the United Kingdom, together with supplementary measures where needed. You may request a copy of the relevant safeguards by contacting us at privacy@scadable.com.

Your rights and how to complain

Subject to the conditions and exemptions in the GDPR, the UK GDPR, and the FADP, you have the right to:

• Access: obtain a copy of the personal information we hold about you.
• Rectification: have inaccurate information corrected and incomplete information completed.
• Erasure: have your information deleted in certain circumstances.
• Restriction: limit our processing of your information in certain circumstances.
• Portability: receive certain information in a structured, commonly used, machine-readable format.
• Objection: object to processing based on our legitimate interests, and object to direct marketing at any time. The right to object to direct marketing is absolute: if you object, we stop.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing carried out before you withdrew it.
• Automated decision-making: not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except in limited cases, and in any event to be informed, make your views known, obtain human review, and contest the decision. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

To exercise any of these rights, contact us at privacy@scadable.com. We will respond within one month; for complex or numerous requests we may extend this by up to two further months, and we will tell you if we do. Exercising your rights is free in most cases.

You also have the right to lodge a complaint with a supervisory authority. In the EEA, that is the data protection authority in the country where you live, work, or where the issue you are complaining about took place. In the United Kingdom, it is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; we also operate an internal complaints procedure and would appreciate the chance to respond to your concern first. In Switzerland, it is the Federal Data Protection and Information Commissioner (FDPIC). You can always raise a concern with us directly at privacy@scadable.com.

11. Residents of Canada

This section applies if you are located in Canada.

We process your personal information under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Alberta's Personal Information Protection Act, British Columbia's Personal Information Protection Act, and in Quebec the Act respecting the protection of personal information in the private sector as modernized by Law 25. We are accountable for the personal information under our control. The person responsible for our personal information practices is the person responsible for privacy, reachable at privacy@scadable.com. You can contact this person with any question, access request, or complaint about your personal information.

Consent

We collect, use, and disclose your personal information on the basis of your consent, except where the law permits or requires otherwise. Depending on the sensitivity of the information and your reasonable expectations, that consent may be express or implied. Sensitive personal information requires your express consent, and in Quebec consent must be requested for specific purposes, in clear and simple language, separately from any other information. We do not knowingly collect sensitive categories of personal information such as health data, precise geolocation, biometric identifiers, or government identifiers. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may affect our ability to provide some services to you.

Your rights

You have the right to request access to the personal information we hold about you, to be told how it has been used and to whom it has been disclosed, and to ask us to correct information that is inaccurate or incomplete. You may withdraw your consent as described above. Since September 2024, if you are in Quebec you also have the right to data portability: on request, we will provide the computerized personal information you provided to us in a structured, commonly used technological format. Quebec residents may also require us to cease disseminating their personal information, or to de-index a link giving access to it, where its dissemination breaches the law. We respond to requests within 30 days, and we may need to verify your identity before acting on a request.

Automated decisions and tracking (Quebec)

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Where a decision about you is based exclusively on the automated processing of your personal information, we inform you at or before the time of the decision. On request, we will tell you what personal information was used to make the decision, and you may have that information corrected and submit observations to a member of our staff who is in a position to review the decision. Where we use technology that allows you to be identified, located, or profiled, we tell you, and the means to deactivate that function are available to you. The privacy settings of our technological products and services default to the highest level of confidentiality (privacy by default).

Transfers outside your province or Canada

Your information may be stored or processed in countries other than your own. Where we transfer personal information across borders, we use appropriate safeguards such as adequacy decisions or standard contractual clauses.

For Quebec residents, we assess that personal information transferred outside Quebec will receive adequate protection before we transfer it.

Complaints

If you have a concern about how we handle your personal information, please contact us first at privacy@scadable.com. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, to your provincial regulator (the Office of the Information and Privacy Commissioner of Alberta or of British Columbia), or in Quebec to the Commission d'acces a l'information (CAI). Confidentiality incidents that present a risk of serious injury are reported to the CAI and to affected individuals as the law requires.

12. Residents of the United States

This section applies if you are a resident of a US state with a comprehensive privacy law, including California, Virginia, Colorado, Connecticut, Texas, Oregon, and others.

The United States has no single federal privacy law. Instead, a family of state laws, with the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA") as the most detailed, gives residents of those states specific rights over their personal information. This section describes those rights and how to use them. The state laws also require certain disclosures: the categories of personal information we process, our purposes, the categories of third parties we disclose to, and how to exercise your rights. Those disclosures appear under what information we collect, how we process your information, and when and with whom we share, and in the California table below.

Categories of personal information we collect

The table below shows the categories of personal information defined by California law, whether we collect them, where they come from, why, and whether they are disclosed, sold, or shared:

Your rights

Depending on the state you live in, you have the right to:

• Know and access. Confirm whether we process your personal information and access it, including the categories we have collected, the categories of sources, our purposes, and the categories of third parties to whom it is disclosed.
• Delete. Request that we delete personal information we have collected about you, subject to the exceptions your state's law allows.
• Correct. Request that we correct inaccurate personal information we maintain about you (available in most, but not all, states).
• Portability. Obtain a copy of your personal information in a portable and, to the extent technically feasible, readily usable format.
• Opt out. Opt out of the sale or sharing of personal information, of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects.
• Limit sensitive personal information (California). Direct us to limit the use and disclosure of your sensitive personal information to the purposes permitted by California law.
• Non-discrimination. Not be denied goods or services, charged a different price, or given a different level of quality because you exercised any of these rights.
• Appeal. Appeal our refusal to act on a request. If we decline a request, we will explain why and how to appeal; we will respond to your appeal in writing within the period your state's law requires and explain our decision. If your appeal is denied, you may contact your state attorney general.

How to exercise your rights

You can submit a request to know, access, correct, or delete your personal information by emailing us at privacy@scadable.com. You can opt out of the sale or sharing of personal information and of targeted advertising by emailing us at privacy@scadable.com, or by broadcasting a recognized opt-out preference signal such as the Global Privacy Control (GPC), which we honor.

We may need to verify your identity before responding to a request, using information associated with your account, and we will only use the information you provide for verification. You may use an authorized agent to submit a request on your behalf; we may ask for proof that you authorized the agent to act for you. We will respond within 45 days of receiving your request and may extend that period once by an additional 45 days where reasonably necessary, in which case we will notify you of the extension before the first period ends.

California disclosures

As stated above, we do not sell or share personal information as those terms are defined by the CCPA, and we do not process personal information for targeted advertising. We do not knowingly sell or share the personal information of consumers under 16 years of age.

We retain each category of personal information as described under how long we keep your information. We do not knowingly collect sensitive categories of personal information such as health data, precise geolocation, biometric identifiers, or government identifiers. We do not use or disclose sensitive personal information for purposes that require a right to limit under California law.

California residents may request, up to twice in a 12-month period, that we disclose, for the preceding 12 months: the categories and specific pieces of personal information we collected about you, the categories of sources, our business or commercial purposes for collecting, selling, or sharing it, the categories we disclosed for a business purpose, the categories we sold or shared, and the categories of third parties that received it. We do not offer financial incentive programs (such as discounts or loyalty perks in exchange for personal information) unless we separately disclose the program and its terms, in which case participation is opt-in and you may withdraw at any time. California's "Shine the Light" law (Civil Code Section 1798.83) also permits California residents to request, once per calendar year, information about any personal information disclosed to third parties for those parties' direct marketing purposes; you can send that request to privacy@scadable.com.

13. Controls for Do-Not-Track features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature. No uniform technology standard for recognizing and implementing DNT signals has been finalized, so we do not currently respond to DNT browser signals. Where applicable law requires us to honor an opt-out preference signal (such as the Global Privacy Control), we do so. If a standard we must follow is adopted, we will describe it in a revised version of this policy.

14. Do we make updates to this policy?

In short: yes, as needed to stay compliant with the law.

We may update this Privacy Policy from time to time. The "Last updated" date at the bottom of this policy shows when it last changed, and the effective date at the top shows when it first took effect. Material changes will be highlighted through a notice on the Services or, where required, directly to you. We encourage you to review this policy whenever you use the Services.

15. How can you contact us?

Questions or comments about this policy can be sent to SCADABLE at privacy@scadable.com, or through scadable.com.

16. How can you review, update, or delete your data?

Based on the laws of your place of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, to correct inaccuracies, or to delete it. To make such a request, email privacy@scadable.com. We will act on your request as required by applicable law.

Last updated 2026-08-13. Generated and kept current by scadable.com.