Privacy notice

• Your business’s data is yours. We use it only to run Sclfy for you.
• Connected tools are read-only. Once they open, an email campaign you approve goes out from your own SendGrid, an Instagram or Facebook post you approve goes up on your own account or Page, a fix you ask for becomes a branch and a pull request on your own repository, and a release you approve merges that one pull request. Sclfy never deploys, never reverts anything, and touches no other branch. For mail, Sclfy reads senders and subject lines, never message bodies or attachments.
• AI runs only when you ask for it. Plans, the morning brief, replies and search each name their AI provider and the most they can cost before you agree to them.
• We don’t sell your information, use it for advertising, or use it to train AI models.
• Each business’s data is kept apart, and only its owner can see it.

Your account. Your email address, your name if you add it, and your password, which our sign-in provider stores only in scrambled (hashed) form. Sclfy uses cookies only to keep you signed in and remember your settings. There are no advertising or analytics cookies.

What you add. Your business’s name, time zone and currency; the names you give your teammates; notes, documents and web pages you add to the Company Brain; products and product photos, and the web addresses (domains) you record for them; your brand profile and business profile; the costs, cash on hand and targets you enter for Home’s numbers; how you sort your books’ expense accounts into categories and products in Finance (kept by each account’s ID, never its name or amounts); the monthly budget you approve in Finance, with each change to it and who approved it; and the work you ask for, your messages to teammates, your answers and your approvals.

Uptime checks.If you turn on Data & Analytics’ uptime checks (not available yet), Sclfy asks each domain you recorded for a product for its home page every five minutes and keeps whether it answered, its status code, how long it took and, if it didn’t answer, why. Sclfy doesn’t read or keep the page itself, and never sends a check to a private network address.

What your connected tools provide. Only once you connect a tool, and only by reading:

• Mail (Gmail or Microsoft 365): for new messages, the sender, the subject line, when it arrived and your mail provider’s own labels, such as unread or important. Sclfy doesn’t read message bodies or attachments.
• Calendar (Google Calendar or Microsoft 365): today’s events, with their title, start and end time, whether they were cancelled, your own reply and a link to the event. Not other attendees or event descriptions.
• Stripe: payments, fees, refunds, disputes, invoices, subscriptions and Checkout sessions, used to work out daily totals by product, including new and returning customers, trials and retention. To tell a returning customer from a new one, a sync compares customer IDs, emails or card fingerprints while it runs and keeps none of them. Sclfy saves only the totals and your product names, not your customers’ names, emails or card details. Once you turn on Finance’s sales tax preparation (not available yet) and ask for a worksheet, Sclfy also reads that period’s paid invoices, completed Checkout payments and credit notes, and keeps only the tax Stripe recorded by place, tax and rate, and your sales by your customers’ country and state or province.
• SendGrid: only that it’s connected, until email campaigns open (not available yet). Then, when you send a piece of approved copy as a campaign, the names of your contact lists and how many people are on each, your verified senders and your unsubscribe groups, so you can choose. For 15 days after a campaign goes out, Sclfy reads and saves how many people it was delivered to, opened it, clicked a link, unsubscribed, bounced or marked it as spam, as totals. Sclfy never reads or saves your contacts themselves, or who opened or clicked.
• Facebook and Instagram (through the Facebook account that manages your Page): only that it’s connected, until Facebook and Instagram posts open (not available yet). Then, when you post a piece of approved copy, the names of the Facebook Pages you manage and the Instagram professional accounts linked to them, so you can choose. To check whether a Facebook post went up when Facebook didn’t answer, Sclfy reads your Page’s posts from the last few minutes, and keeps only the one it made. For 15 days after a post goes up, Sclfy reads and saves how many people it reached, how many times it was seen, and its likes or reactions, comments, shares and saves, as totals. Sclfy doesn’t read your followers, messages, other posts, or who liked or commented.
• Help Scout: once you turn on Customer Service’s support inbox and pick a mailbox (not available yet), the names of your mailboxes, so you can choose, then every few minutes the conversations in that mailbox: each one’s subject, number and status, the customer’s name and email, and its latest ten customer and team messages. Sclfy saves these as support cases, which hold your customers’ personal information on your behalf. Sclfy doesn’t read Help Scout’s private notes. If you also turn on drafted replies, Sclfy adds a reply to a conversation only when you approve that reply, in the words you approved. If you also turn on issue updates, Sclfy adds an update you approved, once, to each conversation of the customers who reported that issue. Otherwise it doesn’t reply, tag or change anything in Help Scout. If you also turn on Data & Analytics (not available yet), Sclfy counts these conversations by the month they started, to show on Home beside your Stripe numbers; only the counts are used, and sent to Anthropic only by Data & Analytics’ recommendations and experiments, if you turn them on.
• App Store and Google Play: once the support inbox is on and you connect an app (not available yet), every few minutes that app’s new reviews: each one’s stars, title, words, the reviewer’s nickname and its date. Sclfy saves each review as a support case. You give Sclfy the app’s ID and a key from App Store Connect or a Google Cloud service account, which Sclfy uses only to read reviews. Sclfy doesn’t reply to reviews, and doesn’t read your sales, users or anything else in the store.
• GitHub: once you turn on Information Technology and install Sclfy’s own read-only GitHub app on the repositories you choose (not available yet), the account you installed it on and those repositories’ names, whether each is private and its default branch. Every half hour, for each repository you link to a product, its latest deployment in each environment (the environment’s name, its status, the commit, the branch and its web address) and its last five published releases. The app is allowed to read your code, and Sclfy reads it only for a change plan or a fix you ask for. Once you accept its permission to write code and pull requests (not available yet), Sclfy uses it only to put a fix you asked for on a new branch of its own and open a pull request, and, where you turn releases on and approve one, to merge that one pull request into your default branch; it never deploys, reverts or writes any other branch. After a release it reads the production deployment your host reports to GitHub for that commit, to record whether the fix went live. When you install it, Sclfy uses your one-time GitHub sign-in only to check you can reach the installation, then revokes it.
• QuickBooks Online: once you turn on Finance and reading your books (not available yet), every six hours your QuickBooks company’s name, country, home currency and accounting basis, each bank account’s name and balance, and your profit and loss for each of the last 13 whole months: each section’s total and the accounts in it with their amounts. Each read replaces the one before, and Home’s cash on hand and company overhead come from it. Sclfy doesn’t read your transactions, invoices, customers, vendors or payroll, and nothing from your books is sent to an AI provider. QuickBooks’ sign-in allows changes to your books, but Sclfy only reads: it doesn’t write anything to QuickBooks or move money.
• Xero: once you turn on Finance and reading your books from Xero (not available yet), the names of the organisations your sign-in covers, so you can pick one, then every six hours that organisation’s name, country and base currency, the balance of each bank account in that currency, and your profit and loss on the accrual basis for each of the last 13 whole months: each section’s total and the accounts in it with their amounts. Each read replaces the one before, and Home’s cash on hand and company overhead come from it. Sclfy doesn’t read your transactions, invoices, contacts or payroll, and nothing from your books is sent to an AI provider. Xero’s sign-in gives Sclfy read-only access, and it doesn’t write anything to Xero or move money.
• Your bank, through Plaid: once you turn on Finance and link a bank in the US or Canada (not available yet), you sign in to your bank in Plaid’s own window, never Sclfy’s, and choose the accounts to share. Then every six hours Sclfy reads, through Plaid, your bank’s name and each shared checking, savings or other deposit account’s name, type, last digits, currency and current and available balance. Each read replaces the one before, and Home’s cash on hand comes from it. Plaid’s sign-in also shares your recent transactions with Plaid, which keeps the balances current; Sclfy doesn’t read them. Sclfy keeps Plaid’s access to your bank encrypted and uses it only to read balances: it doesn’t move money or write anything to your bank, and nothing from your bank is sent to an AI provider.
• PostHog: once you turn on Data & Analytics and connect PostHog with a personal API key (not available yet), the names of the projects the key can read, so you can link each product to one, then every six hours, for each linked product and each of the last 13 whole months: how many people were active, on how many days, how many hit an error, how many PostHog first saw, how many of those reached the first key step or did the core action you named and how long it took, and how many came back the month after. Only these counts are kept: no person, event or property leaves PostHog’s answer, and only Data & Analytics’ recommendations and experiments, if you turn them on, send the counts to an AI provider. Sclfy keeps the key encrypted and uses it only to read: it doesn’t write anything to PostHog.
• Google Analytics and Search Console: once you turn on Data & Analytics and connect either (not available yet), the names of the Analytics properties and Search Console properties your sign-in can read, so you can link each product to one, then every six hours, for each linked product and each of the last 13 whole months: from Google Analytics, the property’s time zone and how many visitors, new visitors, sessions, engaged sessions and key events it counted; from Search Console, how many clicks and impressions your site had in Google Search and its average position. Only these counts are kept: no visitor, page or search query leaves Google’s answer, and only Data & Analytics’ recommendations and experiments, if you turn them on, send the counts to an AI provider. Both sign-ins are read-only, and Sclfy doesn’t write anything to Google.
• HubSpot: once you turn on Sales and reading HubSpot (not available yet), every six hours your deal pipelines and their stages; each deal that is open or closed in the last two years, with its name, stage, amount, currency, expected close date and company; the contacts that are leads or on those deals; and the companies they belong to, with each one’s name and web domain. For a contact Sclfy keeps only its lifecycle stage, lead status, where HubSpot says it came from, the campaign tag on the first page it saw and its company, never a contact’s name, email address, phone number or messages. Each read replaces the one before. Besides Sales’ own page and Home, the deals won in the last 90 days show on Customer Service’s page, so you know who’s new before they write in. Nothing from HubSpot is sent to an AI provider unless you also turn on Sales’ weekly qualification or its drafts, described under AI features. HubSpot’s sign-in is read-only, and Sclfy doesn’t write anything to HubSpot.

Records of AI use. For each AI request, which feature made it, the model, how many tokens it used and what it cost. These records are how Sclfy enforces your spending limits.

Technical information. Our hosting and database providers process IP addresses, browser details and request logs to deliver and protect the service.

Waitlist and support. If you joined the early-access waitlist, your email address, when you joined and what you agreed to. If you email us, what you send.

• To run Sclfy for you: your morning brief, the plans you ask for, replies to your messages, Company Brain search and the numbers on Home.
• To keep Sclfy secure, enforce spending limits, fix problems and answer your questions.
• To bill you, once paid plans open.
• To tell you about changes to Sclfy, this notice or our terms. We don’t send marketing email unless you ask for it.

We don’t sell personal information or use it for advertising, and we don’t use your business data to train AI models. People at Sclfy don’t read your business data unless you ask us to, for example in a support request, or it’s needed for security or required by law.

Plans, the morning brief, Business Manager replies and Company Brain search stay off until you agree to them in Sclfy. Your agreement names the provider and the most the feature can cost, and you can turn it off again. Product and marketing drafts, and images, video and voice-overs, run only when you press the button that asks for one. Customer Service’s sorting runs only once you turn on its support inbox and agree to what it does, and its drafted replies, recurring issues and issue updates only once you turn those on too. Information Technology’s change plans and fixes, and Finance’s sales tax worksheets, run only once you turn them on and agree to them, and then only when you ask for one. Data & Analytics’ recommendations run once a month, only once you turn them on and agree to them, and its experiments only once you turn those on too, and then only when you ask for one from a mission. Sales’ qualification runs once a week, only once you turn it on and agree to it, and its drafts only once you turn those on and agree to them, and then only when you ask for one. Each feature sends only what it needs:

• Plans: the outcome you asked for and the notes you chose to include, to OpenAI or Anthropic, whichever the plan names when you agree to it. A plan that shows its sources can also read the documents and web pages you choose, only the start of a long one, with your saved business profile and the facts you confirmed; its agreement says so.
• Morning brief: today’s event titles and times, mail senders and subject lines, your Stripe totals and your team’s saved work, to Anthropic.
• Business Manager replies: your message, your recent chat, your latest brief, and your work, decisions and product names, to Anthropic.
• Company Brain search: passages from your notes, documents and pages, and the words you search for, to OpenAI.
• Product and marketing drafts: the product details, photos and brand profile you use for a draft, to Anthropic. A strategy or creative package you ask Marketing for from a mission also sends your saved business profile and that step of the plan.
• Images, video and voice-overs (not available yet): the product photo or approved image each one starts from, the copy it’s for, your direction and the words to read aloud, to fal. fal may pass them to the company that makes the model: OpenAI for images, ByteDance for video and ElevenLabs for voice.
• Customer Service sorting (not available yet): a support case’s subject and its latest six messages, which may include your customer’s own words and details, to Anthropic, which sorts it by type, urgency and mood with a one-line summary. A review from a connected app is sorted the same way, from its stars, title and words.
• Customer Service replies (not available yet): a sorted support case’s subject, its sorting and its latest six messages, your customer’s name, your business’s name, profile summary and voice, and the policies you wrote in the Company Brain, to Anthropic, which drafts a reply for you to approve, edit or decline. Where your policies allow it, the draft may offer a refund or a replacement, which you approve or decline before the reply. Sclfy records what you approve; it never refunds, charges or ships anything.
• Customer Service recurring issues (not available yet): sorted support cases’ subjects, types and one-line summaries, with your open issues’ titles and summaries, to Anthropic, which groups cases that report the same thing. Their messages and your customers’ names and emails aren’t sent. Sclfy keeps each issue and the cases behind it; an issue handed to IT waits until you ask IT for a change plan.
• Customer Service issue updates (not available yet): once a fix you released for a recurring issue is confirmed live, the issue’s title and summary, the fix’s one-line summary, your product’s name and description and your business’s name, to Anthropic, which drafts one short update for the customers who reported it. No customer’s name, email or messages are sent. You approve, edit or decline the update, and only the words you approve are added, once, to each of those customers’ Help Scout conversations. Sclfy keeps the update and which conversations it went to.
• Information Technology change plans (not available yet): when you ask for a plan for an issue handed to IT, the issue’s title and summary, your product’s name and description, and the list of file names in the repository you chose, to Anthropic, which picks up to eight files; then those files’ contents, the repository’s latest deployments and releases and the same issue and product, to Anthropic, which writes the plan. Files that usually hold secrets, such as .env files, keys and certificates, are never read or sent. Sclfy keeps the plan, the commit it read and the files’ names, not your code, and nothing changes your code, deploys or contacts a customer.
• Information Technology fixes (not available yet): when you ask for the change a plan you approved describes, Sclfy copies your repository’s latest code into an isolated Vercel Sandbox, a short-lived virtual machine that holds no key or password, installs its dependencies, then cuts it off from the internet. There it sends the plan, the issue’s title and summary, your product’s name and description, and the code and command output Claude reads to Anthropic, which edits the code and runs its tests. Sclfy deletes the sandbox when the fix is done, puts the change on a new branch through its GitHub app and opens a pull request. Sclfy keeps the pull request’s link, the names of the files changed, how the tests went and Claude’s summary, not your code. A public repository’s pull request doesn’t describe what customers reported. Nothing is merged, deployed or sent to a customer unless you approve its release.
• Finance sales tax worksheets (not available yet): when you ask for a worksheet for a period, Sclfy’s totals of the tax Stripe recorded by place, tax and rate and of your sales by your customers’ country and state or province, where your business is based, your books’ monthly income, expenses and net income for the period if Finance reads your books, and any note you add, to Anthropic, which writes what to check before filing and questions for your accountant. No customer’s name, email or address is sent. Sclfy keeps the totals and the worksheet. Sclfy never files a return, registers your business or pays tax.
• Data & Analytics recommendations(not available yet): once a month, for up to 20 of your products and the latest three whole months, the counts Data & Analytics read from Stripe, Google Analytics, Search Console, PostHog, its uptime checks and Help Scout, with your products’ names and your business’s time zone, to Anthropic, which recommends up to three things to Marketing or Information Technology, each citing the counts and months it rests on and how confident it is, or says there isn’t enough data yet. No customer’s or visitor’s name, email or messages, and no page or search query, are sent; nothing is sent in a month when no count has two months to compare. Sclfy keeps the counts it sent and the recommendations. A recommendation changes nothing by itself.
• Data & Analytics experiments(not available yet): when you ask from a mission, the mission’s title and objective, any note you add, the name of the mission’s product, the counts Data & Analytics read for that product and for your whole business over the latest three whole months, and what it last recommended for that product, to Anthropic, which designs one experiment: a hypothesis, the one change Marketing or Information Technology would make, the count that should get better and by how much, what mustn’t get worse and how many months it runs, citing the counts it rests on. No customer’s or visitor’s name, email or messages, and no page or search query, are sent. Sclfy keeps the counts it sent, the design and what you approved. An experiment starts only when you approve it with its budget and end month; Sclfy spends nothing and changes nothing itself. Its result is worked out by Sclfy from the same counts, without an AI provider.
• Sales qualification(not available yet): once a week, after HubSpot is read, for up to 20 of your open deals and up to 10 of your newest leads that aren’t on a deal, each deal’s stage, chance of winning, amount, dates, whether it has a company, how many contacts it has with their lifecycle stages and where they came from, and its campaign tag; each lead’s lifecycle stage, lead status, where it came from, campaign tag and dates; and how many deals you won and lost in the last two years, to Anthropic, which says whether each is qualified, not yet, or not a fit, citing the fields it rests on. No deal’s or company’s name, and no person’s name, email address, phone number or messages, are sent; nothing is sent in a week when nothing is open. Sclfy keeps what it sent and the verdicts. A verdict changes nothing in HubSpot.
• Sales drafts(not available yet): when you ask for a follow-up to one open deal or a first message to one lead, that deal’s stage, chance of winning, amount, dates, whether it has a company, how many contacts it has with their lifecycle stages and where they came from, and its campaign tag, or that lead’s lifecycle stage, lead status, where it came from, campaign tag and dates; Sales’ latest verdict on it; your saved business profile; and your note, to Anthropic, which drafts a subject and message. No deal’s or company’s name, and no person’s name, email address, phone number or messages, are sent, so the draft says [Name] and [Company] for you to fill in. Sclfy keeps what it sent, the draft and the words you approved. Sclfy never sends a draft: you send the words you approved from your own email.
• Human Resources role briefs(not available yet): when you ask for a role brief, the help you described, the country and state or province the work would be done in, whether you lean to a contractor or an employee, and your saved business profile, to Anthropic, which drafts the role, the arrangement it suggests, the work, what’s required, what to count in its cost and a hiring plan. No one’s name or contact details are sent from Sclfy, so leave them out of your description too. Sclfy keeps what it sent, the brief and what you decided: the title, contractor or employee, and the pay if you set it. Nothing is posted and nobody is contacted.
• Human Resources job posts(not available yet): when you ask for a job post for a role you approved, its title and arrangement, where the work is done, the brief’s summary, hours, outcomes, work and requirements, and your saved business profile, to Anthropic, which drafts the post. The pay you set isn’t sent: Sclfy puts it where the draft marks it. Sclfy keeps what it sent, the draft and the words you approved. Sclfy never posts it: you copy it to the job board you choose. Candidate records are never sent to Anthropic or anyone else.
• Human Resources onboarding plans(not available yet): when you ask for an onboarding plan for a role you approved, its title and arrangement, where the work is done, the brief’s summary, hours, outcomes, work and requirements, your saved business profile, and the names of the Company Brain records you’ve saved, to Anthropic, which drafts the plan. Never the pay, a candidate’s record or anyone’s details. Sclfy keeps what it sent and the plan. Sclfy never sends it, and never collects an identity document, tax number or bank detail: you share the plan yourself.
• Human Resources people policies(not available yet): when you ask for a people policy, the policy you picked, who it covers, the country and state or province, what you said about how your business works, and your saved business profile, to Anthropic, which drafts it. Never a role’s pay, a candidate’s record or anyone’s details. Sclfy keeps what it sent and the draft, held for Legal’s review. Sclfy never adopts, publishes or gives a policy to anyone.

AI requests may pass through Vercel’s AI Gateway on their way to the provider. Under their API terms, these providers don’t train their models on what Sclfy sends them, and may keep it for a limited time to detect abuse.

AI can be wrong. Sclfy shows where its answers come from, and nothing it drafts is sent, published or paid for without your approval.

Sclfy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Gmail, Google Calendar, Google Analytics and Search Console information only to provide the features you see in Sclfy, such as your brief and Data & Analytics.
• We share it only with the companies below that help provide those features, when the law requires it, or as part of a merger or sale of Sclfy, with notice to you.
• We don’t sell it or use it for advertising.
• We don’t use it to develop, improve or train general AI or machine-learning models.
• People don’t read it unless you agree, it’s needed for security, or the law requires it.

Supabase

Database, sign-in and file storage. Receives: Everything Sclfy saves for your account and business.

Vercel

Hosts Sclfy, runs its scheduled jobs and background work, routes AI requests through its AI Gateway, and runs Information Technology’s fixes in isolated, short-lived sandboxes. Receives: Your requests to Sclfy, AI requests on their way to the provider that answers them, and, for each fix you ask for, a copy of the repository’s code, deleted with the sandbox when the fix is done.

Composio

Holds the sign-ins and keys for the tools you connect, and carries Sclfy’s read requests and the email campaigns and Instagram posts you approve to them. Receives: Your connected tools’ sign-ins, what those tools send back to Sclfy (including your Facebook Page’s posting key when you approve a Facebook post), and each email campaign or Instagram post you approve on its way to your SendGrid or Instagram.

Anthropic

Claude models for plans, the morning brief, Business Manager replies, product and marketing drafts, sorting and grouping support cases, drafting replies to them and updates once a fix is live, Information Technology’s change plans and fixes, Finance’s sales tax worksheets, Data & Analytics’ monthly recommendations and experiments, Sales’ weekly qualification of deals and leads and its follow-up drafts, and Human Resources’ role briefs, hiring plans, job posts, onboarding plans and people policies. Receives: What each of those features sends, as described under AI features.

OpenAI

Models for plans and for Company Brain search. Receives: What each of those features sends, as described under AI features.

fal

Runs the models that make Marketing’s images, video and voice-overs: OpenAI’s GPT Image 2.5, ByteDance’s Seedance 2.5 and ElevenLabs’ voices. Receives: For each one you or a Marketing creative package asks for, the product photo or approved image it starts from, the copy it’s for, your direction and the words to read aloud. fal may pass them to the company that makes the model.Not used yet. It starts when Sclfy turns on Marketing’s images, video and voice.

Plaid

Links the bank accounts you choose to Finance through Plaid’s own sign-in window, and reads their balances for Sclfy. Receives: Your bank sign-in, which you enter in Plaid’s window and Sclfy never sees, and an ID for your business at Sclfy. Plaid’s End User Privacy Policy covers what it holds.Not used yet. It starts when Sclfy turns on linking banks in Finance.

Langfuse

Monitors the cost and reliability of AI requests. Receives: Request ids, the model, token counts, cost and timing. Never your business content.

Stripe

Billing for Sclfy’s own plans. Receives: Your billing name, email, address and payment details, and the name of the business the plan is for. Sclfy never sees your full card number.Not used for billing yet. It starts when paid plans open.

SendGrid

Sends Sclfy’s sign-in emails: invitations and password resets. Receives: Your email address and the one-time link in each of those emails.Not used yet. Supabase sends these emails until Sclfy moves them to SendGrid.

Google, Microsoft, Stripe, SendGrid, Meta, Help Scout, Apple’s App Store Connect, Google Play, GitHub, Intuit’s QuickBooks, Xero, PostHog and HubSpot are also tools you can connect, Google Analytics and Search Console among Google’s. They’re your own accounts, and their own terms and privacy policies cover what they hold. When you approve an email campaign (not available yet), Sclfy sends its subject and words, and the lists, sender and unsubscribe group you chose, through Composio to your SendGrid account, which emails the people on those lists. Sclfy keeps a record of each campaign you approve: what it said, which lists and sender, how many people were on them, and whether it went out. When you approve an Instagram post (not available yet), Sclfy sends its caption, and a link to each image or the video you chose that works for one hour, through Composio to Meta, which publishes it on the Instagram account you chose, where anyone can see it. Sclfy keeps a record of each post you approve: its caption, a copy of its images (not of a video), the account, whether it went up and its link. When you approve a Facebook post (not available yet), Sclfy asks Meta, through Composio, for your Page’s posting key, then sends the post’s words and the images you chose straight to Meta, which publishes it on the Page you chose, where anyone can see it. The Page’s key is used only for that post and never saved. Sclfy keeps a record of each Facebook post you approve: its words, which images, the Page, whether it went up and its link.

We may also share information when the law requires it, to protect someone’s safety or Sclfy’s rights, or with a buyer if Sclfy is sold, in which case this notice still applies to your information.

These companies are based in the United States and may process information there and in other countries. If you’re in Canada, this means your information is processed outside Canada, where the local laws may let courts or governments access it.

• Your account and business data stay while your account is open. Notes, documents and approvals are kept unchanged, so every plan can show what it was based on.
• Disconnecting a tool stops Sclfy’s access to it. What Sclfy already saved from it, such as past briefs and totals, stays until you close your account.
• Support cases, the replies drafted for them, the refunds and replacements you approved or declined, the recurring issues grouped from them and the updates sent about them stay until you delete them: turn the support inbox off, then delete its cases, or close your account. Policies keep every version you saved, like your business profile.
• The key you give Sclfy for an app’s reviews is deleted as soon as you remove the app or turn the support inbox off. The reviews already read stay as support cases.
• Disconnecting GitHub stops its reads at once. The repositories, deployments, releases, domains and change plans already recorded stay until you close your account; Sclfy’s app stays installed on GitHub until you uninstall it there. A change plan is deleted with the issue it’s for, a fix with its plan, and a release with its fix. Turning fixes off stops the ones that haven’t started; pull requests already opened stay on GitHub until you close them. Turning releases off withdraws the ones that hadn’t started; anything already merged stays merged, with the commit it recorded to go back to.
• Uptime checks are kept, counted by the hour, for 14 months, and are deleted with the domain they’re for. Turning the checks off stops them; what was already checked stays until then.
• Disconnecting PostHog deletes its key at once and stops its reads. The counts already read stay on Home, and each product’s link to a project stays for connecting again, until you close your account; a product’s counts are deleted with the product.
• What Sclfy counted from Google Analytics and Search Console stays until the next read replaces it. Unlinking a product or linking it to another property deletes what was counted from the old one; signing a tool out stops its reads and keeps the counts until you close your account. A product’s counts are deleted with the product.
• What Sclfy read from HubSpot stays until the next read replaces it. Turning reading HubSpot off, or turning it on with another HubSpot account, deletes everything Sclfy read from HubSpot; pausing Sales keeps it and reads nothing new.
• Sales’ qualification keeps only its latest verdicts, with what they were written from, and the attempt after them. Turning reading HubSpot off, or turning it on with another HubSpot account, deletes them; turning qualification off stops new ones.
• Sales’ drafts keep the ones being written, waiting for you or approved, and your latest 30 others, each with what it was written from. Turning reading HubSpot off, or turning it on with another HubSpot account, deletes them; turning drafts off stops new ones.
• Human Resources’ role briefs keep every one you approved, the ones being written or waiting for you, and your latest 20 others, each with what it was written from, until you close your account. Turning role briefs off stops new ones.
• Human Resources’ job posts keep every one you approved, the ones being written or waiting for you, and your latest 20 others, each with what it was written from, until you close your account. A candidate’s record holds only the name or initials you gave, where they came from, what you saw against each of the role’s requirements and where they stand; it can’t hold an email address, phone number or link. You can delete one at any time, and each is deleted a year after you last changed it. Turning job posts and candidates off stops new ones and keeps the deletions on schedule.
• Human Resources’ onboarding plans keep every one you approved, the ones being written or waiting for you, and your latest 20 others, each with what it was written from, until you close your account. Turning onboarding plans off stops new ones.
• Human Resources’ people policies keep each draft being written or held for Legal’s review, and your latest 20 discarded or not written, each with what it was drafted from, until you close your account. Turning people policies off stops new ones.
• Data & Analytics’ recommendations, with the counts each was written from, stay until you close your account. Turning them off stops new ones.
• Data & Analytics’ experiments, with the counts each was designed from, what you approved and its result, stay until you close your account. Turning them off stops new ones being designed.
• What Sclfy read from your books stays until the next read replaces it. Turning reading your books off deletes all of it at once; your books stay as they are in QuickBooks or Xero. How you sorted your expense accounts stays, so turning the same books on again keeps it, until you close your account. So does your budget, with each change to it and Finance’s suggestions, approved or not, and your sales tax worksheets, until you close your account; turning sales tax preparation off stops the ones that haven’t started.
• Removing a bank ends Sclfy’s access to it through Plaid, then deletes its encrypted access and everything read from it at once. A record that the bank was linked and removed stays until you close your account.
• To close your account, email support@sclfy.ai from your account’s address. We delete your account and business data within 30 days, except records the law requires us to keep, such as billing records. Copies in backups expire on our database provider’s schedule.
• Waitlist entries stay until you ask us to remove yours or the waitlist closes.

Information is encrypted on its way to Sclfy and where it’s stored. Each business’s data is kept apart in the database, so only its owner can read it. The sign-ins for your connected tools stay with Composio, not in Sclfy’s database, except the App Store and Google Play keys you give Sclfy for app reviews and the PostHog key you give Data & Analytics, which are kept encrypted with a secret held apart from the database and are never shown again. Sclfy’s GitHub app holds no key per business: each read uses a token GitHub issues for an hour, which Sclfy never saves, and a fix’s sandbox never receives one. Connected tools are read-only except for the email campaigns and Instagram and Facebook posts you approve, the branches and pull requests of fixes you ask for, and the one pull request each release you approve merges. No system is perfectly secure; if a breach affects your information, we’ll tell you as the law requires.

• To see, correct or delete your information, or get a copy, email support@sclfy.ai from your account’s address.
• Turn AI features off in Settings, under AI and spending or Morning brief. Disconnect a tool under Connected tools.
• You can withdraw anything you agreed to. It doesn’t undo what already happened.
• If you’re in Canada, you can also complain to the Office of the Privacy Commissioner of Canada. If you’re in the United States, your state’s laws may give you further rights, and we’ll honour them when you ask.

Sclfy is for businesses. It isn’t meant for anyone under 18, and we don’t knowingly collect children’s information.

We post changes here with a new date. If a change affects how we use information you’ve already given us, we’ll email account holders before it takes effect.

Questions or requests about privacy go to support@sclfy.ai. Please don’t send passwords or sensitive financial or health information by email.