1. Overview
This policy explains how we process personal data when you visit our website scalera.ai, book a demo, take part in the partner program or use our software. Personal data is any information relating to an identified or identifiable person. We follow the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
2. Controller
Scalera AG, Büttenweg 16, 8045 Zurich, Switzerland, email: info@scalera.ai.
3. What data we process
- Data you give us: for example name, business email, phone, company, job title, country and the content of your message when you write to us, book a demo, sign up as a partner or use our platform.
- Technical data when you visit the website: IP address, date and time, pages visited, referrer URL, browser, operating system and device.
- Data from cookies and similar technologies: see sections 5 and 7.
- Data from third parties: for example when a partner introduces a company and a contact person to us (see section 9).
4. Purposes
We process personal data to provide and secure the website, answer inquiries, hold demos, prepare and perform contracts, run the partner program and calculate commissions, measure and improve our website and advertising (see section 7), develop our software and meet legal obligations.
5. Cookies and similar technologies
Cookies are small files your browser stores. We use necessary cookies and cookies for statistics (Google Analytics 4), advertising (Google Ads, Meta Pixel) and partner attribution (scalera_partner, 90 days). You can find the table with names, purposes and durations here:
We will introduce a cookie banner shortly. Until then, you can refuse these cookies by blocking or deleting them in your browser, using the opt-out options in section 7 or writing to info@scalera.ai.
6. Hosting and server logs
Our website is hosted by Webflow, Inc., USA. The host automatically stores server logs (IP address, time, page requested, browser, operating system). We need them for operation, security and error analysis. They are typically deleted after 5 to 25 days. For EU visitors, the legal basis is our legitimate interest in a secure website (art. 6(1)(f) GDPR). For fonts, scripts and libraries we use jsDelivr; this technically transmits your IP address.
7. Analytics and advertising
We use Google Tag Manager, Google Analytics 4 and Google Ads (Google Ireland Limited) and the Meta Pixel (Meta Platforms Ireland Limited) to measure how the website is used and how well our advertising works.
7.1 Google Tag Manager
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). We use it to manage the tags on our website. The Tag Manager itself sets no cookies, but your IP address is transmitted to Google when it loads.
7.2 Google Analytics 4
Google. We measure which pages are visited and how the website is used (pages visited, interactions, duration, device, browser, approximate location, referrer). IP addresses are truncated. Data is deleted after the retention period set in Google Analytics (for a maximum of 14 months).
7.3 Google Ads conversion tracking
Google. We measure whether an ad led to a demo booking and use this to improve our advertising.
7.4 Meta Pixel
Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta"). We measure whether ads on Facebook or Instagram lead to visits or demo bookings (events "PageView", "Lead", "Schedule") and target ads better. We and Meta are joint controllers for the collection and transmission to Meta (art. 26 GDPR). Meta alone is responsible for further processing: https://www.facebook.com/privacy/policy.
These services currently run without prior consent. In Switzerland the basis is art. 45c Telecommunications Act: we inform you here, and you can refuse. You can refuse by blocking cookies in your browser, with Google's browser add-on (https://tools.google.com/dlpage/gaoptout) and in Meta's ad settings (https://www.facebook.com/adpreferences). Google and Meta may transfer data to the USA; both are certified under the Data Privacy Framework, and standard contractual clauses also apply.
8. Demo booking, forms and CRM (HubSpot)
We use HubSpot as our CRM and for demo bookings (HubSpot Meetings on /demo) and forms (for example the partner sign-up). The provider is HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA; the contracting party for customers in Europe is HubSpot Ireland Limited, Dublin, Ireland.
- Data: details you enter when booking or in the form (for example name, business email, company, phone, chosen time slot, message), technical booking data, the page you came from and, where applicable, a partner code (section 9).
- Purpose: arranging and holding the meeting, getting in touch with you, preparing quotes and contracts, managing partners and attributing commissions.
- Legal basis: pre-contractual steps and contract (art. 6(1)(b) GDPR), our legitimate interest in maintaining business contacts (lit. f).
- Location: HubSpot stores our data in a data center in the EU. Access from the USA, for example for support, is possible. HubSpot is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework; standard contractual clauses also apply. We have a data processing agreement with HubSpot.
- When you book a demo, we may report the successful booking to Google Analytics, Google Ads and Meta (section 7).
9. Partner program
9.1 Partner data
When you sign up as a partner, we process the details in the sign-up form (name, business email, phone, company, job title, country, role, any companies you mention, newsletter consent). After approval, your partner code and bank, VAT and statement details are added. Purpose: reviewing your sign-up, running the program, attributing referrals, calculating and paying commissions. Legal basis: contract (art. 6(1)(b) GDPR), legal obligations (lit. c), your consent for the newsletter (lit. a). Recipients: HubSpot (section 8), our bank and accounting (bexio, Switzerland), fiduciary and tax advisors.
9.2 Data of referred companies and contact persons
A partner may introduce a company and a contact person to us, for example by email. We then receive from the partner the contact person's name, job title and business contact details and information about the company. The partner may only pass these data to us if the person agrees. We use them to contact you as the contact person, offer a demo and calculate the partner's commission. The legal basis is our legitimate interest (art. 6(1)(f) GDPR). When we first contact you, we tell you which partner we got your data from. You can object at any time.
9.3 Partner link and partner cookie
Partners receive a personal link with a code (for example scalera.ai/demo?partner=XY). If you visit scalera.ai via such a link, we pass the code to the booking form. We may also store the code in the cookie scalera_partner (Scalera first-party cookie, code only, 90 days). This lets us attribute a demo booking or sign-up within 90 days to the right partner. The code is stored in HubSpot together with your booking. The partner learns that you came via their link and whether this leads to a contract, but no details of your conversations. We will introduce a cookie banner shortly. Until then, you can refuse the cookie by blocking or deleting cookies in your browser or writing to info@scalera.ai (section 7). For the attribution in HubSpot, we rely on our legitimate interest in correct commission accounting (art. 6(1)(f) GDPR).
10. Disclosure and transfers abroad
We only share personal data with service providers named in this policy or working for us (for example IT, hosting, accounting), with partners as described in section 9.3, where needed for a contract or where the law requires it. Some providers process data in the USA. We only transfer data there if the recipient is certified under the Data Privacy Framework (recognized for Switzerland since 15 September 2024) or standard contractual clauses have been agreed.
11. How long we keep data
- Server logs: typically 5 to 25 days.
- Cookies: see table in section 5.
- We delete inquiries that do not lead to a contract no later than 24 months after the last contact.
- Partner sign-ups not approved: 12 months.
- Contract and partner program data: during the collaboration and for 10 years afterwards where needed for accounting and records (art. 958f Swiss Code of Obligations).
- Newsletter: until you unsubscribe.
12. Legal bases
In Switzerland we process personal data in line with the principles of the FADP. For visitors from the EU we rely on art. 6(1) GDPR: consent (lit. a), contract or pre-contractual steps (lit. b), legal obligations (lit. c) and legitimate interests (lit. f), for example security, maintaining business contacts and correct commission accounting.
13. Your rights
You can at any time request access to your data, have incorrect data corrected and data deleted, have processing restricted, receive your data (data portability), object to processing, in particular processing based on legitimate interests or for advertising, and withdraw consent with effect for the future. Write to info@scalera.ai. You can also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority where you live.
14. Data security
We protect your data with technical and organizational measures against loss, misuse and unauthorized access. However, transmission over the internet is never completely secure.
15. Changes
We update this policy when our processing or the law changes. The version on this page applies. Version: 12 November 2026.