Scallar · Legal
Privacy policy
Draft — pending legal validation
This draft describes the marketing website’s current configuration. Retention arrangements, service-provider terms and international transfers still require confirmation. It is not a finalized privacy notice.
Effective date: to be set after approval for publication.
01Introduction
Scallar aims to respect your privacy and handle personal data responsibly. This policy concerns the Scallar marketing website, contact messages, demo requests and early-access registrations only. It does not cover processing by a future enterprise product or customer work-data integrations.
02Data controller
The website is operated by Simon Baron as an individual, who is responsible for the website’s personal-data processing. Scallar is a pre-incorporation project; no Scallar company has been incorporated. Privacy enquiries may be sent to simon@scallar.ai.
Postal contact arrangements remain subject to legal validation. No residential address is disclosed in this draft; this does not establish an exemption from any applicable disclosure obligation.
03Personal data collected
Contact messages include your name, email address, message and company if supplied. Demo requests include your first name, last name, professional email address, company and role; company size and area of interest are optional. Early-access registrations contain an email address. Required fields are needed to submit and respond to the relevant request; optional fields provide context. Please do not include sensitive personal information in messages.
Submissions also carry the form type, website language, a unique submission identifier and, for contact and demo forms, the privacy acknowledgement. A hidden anti-spam field is checked. The submission service temporarily holds email addresses and request counters to limit abuse and logs delivery errors. No project database stores the leads: accepted submissions are forwarded by email, where messages and delivery records may be retained.
The page requests fonts from Google Fonts. This involves communication with Google’s servers, which receive your IP address and request information. Form-interaction events and language are added to an in-browser event queue; the reviewed source does not attach a third-party analytics service to that queue. The exact hosting and email infrastructure logs still need confirmation.
04Purposes and legal bases
Responding to an enquiry and managing a demo request rely on legitimate interests in answering professional enquiries and assessing interest in the project (GDPR Article 6(1)(f)). Where a request is made by a prospective contracting party for steps before a contract, Article 6(1)(b) may apply instead; this does not automatically cover employees contacting us on behalf of a company. These bases require validation against the actual activity.
Early-access registration is an affirmative request to receive early-access communications, intended to rely on consent (Article 6(1)(a)). You can withdraw this consent by emailing simon@scallar.ai, without affecting earlier lawful processing. Registration does not authorize unrelated marketing.
Validation, spam prevention and request limiting serve the legitimate interest in protecting the website and its inbox. Loading fonts serves the interest in presenting the website consistently, subject to an assessment of necessity and visitors’ rights. Processing required by an identified legal obligation would rely on Article 6(1)(c); no unspecified obligation is used to justify indefinite retention.
The required contact and demo checkbox acknowledges the privacy information; it is not consent to marketing. No separate marketing subscription is bundled with these requests. No automated decision-making with legal or similarly significant effects was identified in this website’s form handling.
05Recipients and service providers
Simon Baron receives submissions at simon@scallar.ai. Hosting, email-delivery and infrastructure providers may process data needed to operate their services. The configured email-delivery service is Lovable Emails, using the verified notify.scallar.ai sending domain. Google supplies the remotely loaded website fonts.
The project has a Lovable-hosted published address. The exact contractual hosting entity, infrastructure providers, email subprocessors and the provider of the receiving mailbox remain to be confirmed. Provider contracts, processor roles and any authorized additional recipients must be documented before publication; no unverified integration or recipient is asserted here.
06Data retention
Personal data should be kept only as long as justified by the enquiry, requested early-access communications, security needs and applicable obligations. Retention periods for inbox messages, delivery records, early-access registrations and infrastructure logs have not yet been established and approved. This is an outstanding operational requirement, not a claim that deletion already occurs on a fixed schedule.
The configured anti-abuse counter uses a ten-minute request window in temporary server memory. That window is not an email or lead-retention period and does not establish a guaranteed deletion time for every copy of an address. You may request erasure or withdraw early-access consent using the contact below.
07International data transfers
Google Fonts, website infrastructure, email delivery and the receiving mailbox may involve processing outside the European Economic Area. Their actual processing locations and onward transfers have not been confirmed for this website. We do not claim that all data stays in Europe.
Where a transfer is subject to GDPR restrictions, an applicable mechanism must be identified, such as a relevant adequacy decision or standard contractual clauses with any necessary supplementary measures. The specific mechanisms, recipients and means of obtaining safeguards remain to be verified before approval; none is represented as already established for this project.
08Data security
The configured form handling includes browser and server validation, a hidden anti-spam field, best-effort request limiting and email-provider submission identifiers. These measures reduce particular risks but do not guarantee security. No certification, security audit or particular encryption configuration is asserted.
Access management for the receiving inbox, provider agreements, incident handling and deletion procedures require operational confirmation. A broader security review is needed before making claims about safeguards beyond those observed in the form implementation.
09Your rights
Subject to the conditions of the GDPR, you may request access, rectification, erasure or restriction of your personal data. You may object to processing based on legitimate interests. Portability applies where processing is automated and based on consent or a contract. Where processing relies on consent, you may withdraw it at any time without affecting its earlier lawfulness.
Send requests to simon@scallar.ai. A proportionate identity check may be needed to avoid disclosing data to someone else. Requests should normally receive a response within one month, subject to legally permitted extensions and exceptions.
You may lodge a complaint with the competent supervisory authority, including the French Commission nationale de l’informatique et des libertés (CNIL). See the CNIL’s official complaints page.
11Policy updates
This policy will need revision when the website’s processing, providers or legal requirements change, including after incorporation or the introduction of an operational product. The effective date will reflect the approved publication date. This draft has not yet been approved and has no effective publication date.
12Contact
For privacy questions, rights requests or withdrawal of early-access consent, contact Simon Baron at simon@scallar.ai.