Your information matters, and we treat it that way. We only collect what we genuinely need, we hold it with providers we trust, and we never sell it to anyone. This policy is written in plain language so you always know what we hold, why we hold it, where it is kept, and how to get a copy of it or have it removed. Here is exactly how we handle it.
1. Who we are and what this policy covers
This Privacy Policy explains how we handle personal information. In this policy, "we", "us", "our" and "Scalus" mean TMC Media Pty Ltd (ABN 26 660 757 415), trading as Scalus App, of Melbourne, Victoria, Australia.
We provide websites, digital marketing, and marketing automation services to our clients. This means we handle personal information in two different roles:
- Information about you, as our own customer or enquirer, for example when you visit our website, request a demo, contact us, or become a Scalus client. For this information we decide how and why it is handled, and this policy applies to that information.
- Information about other people that our clients put into the systems we build or operate for them, for example our clients' own customers, leads and contacts. For this information we generally act on the client's instructions, as their service provider. The client is responsible for collecting that information lawfully and for having any consents or notices required (including consent to load it into our systems). Section 5 explains this in more detail.
We aim to handle personal information consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy describes our practices and is intended to be read alongside, not instead of, your rights under the Privacy Act. It forms part of how we handle personal information and does not vary the terms of any services agreement you have with us.
2. What we collect
When you visit our website, request a demo, or contact us, we may collect:
- Your name, phone number and email address
- Your business or company details
- Any information you choose to give us in messages, forms or enquiries
- Information about how you use our website, such as pages viewed, device and browser type, and general location, collected through analytics and cookies (see section 10)
When you become a client, we also collect and hold:
- Business and billing information
- Account, login and support information
- Data needed to build, run and maintain your website
- Details of the social media accounts you connect so we can publish posts for you (see section 9)
Our demo phone line. If you ring or text our demo line on 0420 117 225, the call and your texts are recorded. We keep a written record of the call, the details you give, your phone number and any texts you send, and we text you a sample write up after the call. Tim from Scalus may reach out to you afterwards about the Scalus phone system. Reply STOP to the demo line and it will not text you again, or email privacy@scalus.app to ask us not to contact you.
When you use the Scalus app on your phone, we collect:
- Your mobile number or email address, which you use to sign in with a one time code
- Your name and your business details, which we set up when you become a client
- The messages you type and the photos you choose to send, which are your change requests
The app uses your camera or your photo library only when you choose to take or attach a photo, and it sends only the photos you pick. Some business tools in the app, such as the invoice maker, can read details off a photo you choose, for example a customer's business card or a supplier's quote. That photo is sent to an automated reading service only when you tap the read button (see section 7), what it reads is shown to you to check, and a business card photo is not kept. The app keeps you signed in on your phone. It does not collect your location, your contacts or any advertising identifier, and it contains no advertising, analytics or tracking tools.
We also hold information for our clients about their own customers and leads. This includes what a client gives us, and what people send through a client's website forms and chat: their name, phone number, email address, suburb, what they asked about, their answers to any questions on the form and their chat messages. With it we keep the page and ad link they came from, when they sent it, the IP address and browser it came from, and notes on how the enquiry went, such as when it was answered or booked. We hold this for the client, on the client's instructions (see sections 1 and 5).
We generally only collect personal information that we reasonably need for the purposes described in this policy. Where it is lawful and practical, you can deal with us anonymously or using a pseudonym, although we may not be able to provide some services without certain details.
3. How we use your information
We use personal information to:
- Provide, operate, maintain and improve our services
- Respond to your enquiries and provide support
- Contact you about demos, quotes, invoices, accounts and service matters
- Build and run client websites
- Publish posts you have approved to the social media accounts you connect (see section 9)
- Send marketing communications, where permitted (see section 6)
- Quote what our clients tell us about our work, in our own marketing (see section 6)
- Maintain the security and integrity of our systems and help prevent fraud or misuse
- Meet our legal, tax and regulatory obligations
If we want to use your information for a materially different purpose, we will seek your consent or otherwise rely on a basis permitted by law.
4. Data storage and security
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include access controls so that information is available to staff and contractors who need it, use of reputable service providers, and other technical and organisational measures appropriate to the information we hold.
No method of transmission or storage is completely secure, and we cannot guarantee that information will never be accessed, disclosed, altered or destroyed in breach of our safeguards. We aim to keep our security measures appropriate to the sensitivity of the information and the risks involved.
Enquiries and chat messages from some of our clients' websites are now kept in our own secure database, rather than in a third party customer platform. The websites can add enquiries to it but cannot delete them. We back these records up every night, keep each backup for 35 days and then delete it automatically.
We use a range of third party platforms to deliver our services, and your information may be stored or processed in Australia or overseas depending on where those providers operate (see section 7).
5. Information our clients put into our systems
A large part of what we do involves operating marketing and automation systems for our clients. When a client loads or generates information about their own customers, leads or contacts in those systems, we generally handle that information on the client's behalf and under the client's instructions.
For that information:
- The client is responsible for collecting it lawfully and for giving any privacy notices and obtaining any consents required (including to share it with us and to load it into our systems).
- We use it to provide the services the client has engaged us for, and we do not use it for our own unrelated purposes.
- If you are one of our client's customers or leads and you have a question or request about your information, please contact that client directly, as they are best placed to manage it. You can also contact us (see section 17) and we will refer your request to the relevant client or assist where appropriate.
6. Direct marketing and your choices
From time to time we may send you marketing about our services by email, SMS or other electronic means. We send electronic marketing only where we have your consent or it is otherwise permitted under the Spam Act 2003 (Cth). Every marketing message identifies us as the sender and includes a simple way to opt out (such as an unsubscribe link or reply instruction), and we will action opt out requests within a reasonable time.
You can also ask us at any time to stop sending you marketing, or to tell you the source of personal information we have used for marketing, by emailing privacy@scalus.app. We will not use sensitive information for direct marketing without your consent. Opting out of marketing does not stop service related messages, such as account, billing or support communications.
Quoting what our clients say about us. Where you are a Scalus client and you tell us the work went well, whether that is in the Scalus app, by email, SMS, WhatsApp, live chat, a review or on a call, we may publish what you said as a quote in our own marketing, including social media posts and paid advertising. The quote may appear with your first name, your business name, your logo, your role and your suburb. We do not publish your phone number, your email address or your home address, and we do not publish personal information about your own customers or staff. Clause 6(g) of our Terms & Conditions sets out the full detail, including your right to tell us at any time that you would rather not be quoted and to ask us to take down anything we control. Email privacy@scalus.app or terms@scalus.app and we will action it.
7. Third parties and overseas disclosure
We do not sell your personal information. We may share personal information with trusted third parties who help us provide our services, including:
- Website and application hosting and cloud infrastructure providers, including Vercel
- Database hosting providers, which store our own records, including enquiries and chat messages from our clients' websites
- Customer relationship management (CRM) and marketing automation platforms
- Email and SMS delivery providers
- Advertising and analytics platforms, including Meta, Google and Microsoft Clarity
- Social media platforms you connect to Scalus, such as Facebook, Instagram, TikTok, YouTube and LinkedIn, when we publish posts you have approved (see section 9)
- Payment processors and accounting providers
- A document reading service, when a client uploads a file to the Contacts page of the Scalus app (see below)
- Professional advisers (such as legal and accounting advisers) and IT support contractors
We only share what is reasonably necessary for these purposes. We only use providers that are bound to protect personal information to the same or an equal standard as this policy and the Australian Privacy Principles, and that may use it only to provide their service to us. We may also disclose information where required or authorised by law, or to protect our rights, safety or property or those of others.
Contacts in the Scalus app. A client can upload a file of their own customers' details to the Contacts page: a spreadsheet, a contacts export, a PDF, a screenshot or a photo of a list. Spreadsheets and contact exports are read on our own server. A PDF, screenshot or photo is sent to a document reading service, run by an overseas provider, which reads the names, phone numbers, email addresses and social media handles in it and sends them back to us. That provider processes the file only to give us that answer. It does not use the file to train its models, and every read is sent with the provider's zero data retention option, so the file is not stored once it has answered (a provider may hold a copy briefly for abuse and safety checks, then delete it). The client then chooses which of the people found are added to their contacts. Clients may only upload details of people who have dealt with their business, and are responsible for having the right to hold and use those details (see our Terms, clause 8).
Connecting your own email to the Scalus app. A client can connect an email address they already have to the Inbox of the Scalus app by typing the address and its password. We store that password encrypted and use it only to read and send that mailbox's email inside the app, and only while someone signed in to the client's account has the app open. The emails stay with the client's own email provider and we do not keep copies of them. The names and addresses of people the mailbox has written to or heard from can be suggested in the app's Contacts page and when writing an email. Scalus staff can see this Inbox when helping a client in the app. The client can disconnect the address at any time, which deletes the stored password.
The Scalus app. The Scalus app runs on our own server, hosted by Vercel, which also stores your account settings. Your conversation with us and the photos you send are stored in GoHighLevel, the customer relationship management platform we use, which also sends the SMS sign in codes. Resend sends the email sign in codes. When you ask the app to read a photo, the photo is passed through Vercel to a reading model run by OpenAI or Anthropic in the United States, which returns the text it reads and does not use your photo to train its models. Each of these providers receives only what it needs for that job, and they may store or process it in the United States.
Some of these providers, and the tools used by our clients' systems, are based overseas or store data on servers outside Australia. This means your personal information is likely to be stored or processed by, or disclosed to, overseas recipients. The countries in which our principal service providers operate or store data include the United States, and may include the European Union and other countries. Our own database, which holds enquiries and chat messages from our clients' websites, is stored on servers in the United States, and the emails that pass those enquiries on are sent through a provider in the United States. Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, but we cannot always control or guarantee how an overseas recipient handles it.
8. Advertising platform data
Scalus does not manage advertising for clients. We do advertise our own services on platforms such as Meta (Facebook and Instagram) and Google, and we access our own ad account, performance and conversion data on those platforms through their official APIs to measure and improve that advertising. Where a visitor arrives from one of our own ads and submits an enquiry to us, that enquiry is handled under sections 2 to 5 of this policy. We do not sell this data or use it for unrelated purposes, and any platform credentials we hold are kept confidential and used only for our own advertising.
9. Social media accounts you connect to Scalus
This section applies if you connect your business's Facebook, Instagram, TikTok, YouTube or LinkedIn accounts to Scalus so we can publish posts for you at the times you choose. You connect each account yourself, by signing in on the platform's own page and approving what Scalus is allowed to do. We never ask for, see or store your social media passwords.
What we receive. When you connect an account, the platform gives us only what we need to publish for you:
- The account's name, ID and profile picture, and for Facebook and LinkedIn, the business Pages you manage and choose to connect
- A secure access key (a token) that lets Scalus publish to that account until it is disconnected
- For TikTok, the posting options TikTok allows for your account, such as who can view a post and whether comments are allowed
- For each post we publish, its ID, its link and whether it was published successfully
How we use it. We use this information only to publish the posts you have approved, at the times you have chosen, to show you whether each post went out, and to keep the connection working. We do not read your private messages, we do not collect information about your followers, and we never publish anything you have not approved. We do not sell this information or use it for advertising, we share it only with the platform you asked us to publish to and the providers that host our systems (see section 7), and we do not use it to train artificial intelligence or machine learning models.
Where it is kept. Access keys are encrypted and stored in our own database in the United States (see section 7), and only our publishing system can use them. The posts you give us to publish, such as captions, photos and videos, are kept with your Scalus account until you ask us to delete them.
Disconnecting an account. You can disconnect an account at any time by messaging us in the Scalus app or emailing privacy@scalus.app, or by removing Scalus in the platform's own settings: for Facebook and Instagram, in the apps and business integrations section of your Facebook or Instagram settings; for TikTok, in the list of apps you have given permission to in your TikTok settings; for YouTube, on the Google security settings page; and for LinkedIn, under Data privacy, Permitted services. When an account is disconnected, or we find that its access has been removed, we stop publishing to it, delete its access key straight away, and delete everything else we received from that platform within 7 days. Posts that were already published stay on the platform until you delete them there.
YouTube. Scalus uses YouTube API Services to upload videos to the YouTube channels you connect. By connecting a YouTube channel to Scalus, you agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy applies to how Google handles your information. You can remove Scalus's access to your Google account at any time at security.google.com/settings/security/permissions. Scalus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The terms and privacy policy of each platform also apply to your account and to what you publish there.
10. Cookies and analytics
Our website uses cookies and similar technologies to remember your preferences, keep the site working, and understand how the site is used. The tools we use on our own website include:
- Meta Pixel (Meta Platforms) for advertising measurement, which may set cookies and share usage and event information with Meta
- Scalus Analytics, our own visitor counter, which records the page viewed, the website or ad that sent the visit, the type of device, and an approximate location (country, region and city) worked out from your connection. It keeps a random visitor number in your browser's local storage so a return visit is not counted as new. It does not collect your name or contact details
- Google Analytics (Google), which shows us how visitors find and use the site, such as the pages they view and the website or search that brought them here. It uses cookies, and you can opt out with Google's browser add on at tools.google.com/dlpage/gaoptout
- Microsoft Clarity (Microsoft), which shows us heatmaps and recordings of how visitors use the site, such as where they click and how far they scroll. Clarity hides anything typed into form fields, and it may set cookies
On the websites we build and host for our clients, we also set up Scalus Analytics and Google Analytics (Google) for that client, so we can show them how their website is used and improve it. Visitors to those websites can ask the business that owns the website, or us at privacy@scalus.app, about that information.
Some of these providers are based overseas, so usage information collected through them may be processed outside Australia, including in the United States (see section 7). You can disable or delete cookies in your browser settings, but some parts of the site may not work properly if you do. Some platforms offer their own opt out or ad preference settings, which you can use to limit how they use your information.
11. Automated processing
We use automation in some of our services, for example to segment contacts, score or prioritise leads, and trigger follow up messages. These tools assist our team and do not, on their own, make decisions that produce legal effects for you or similarly significantly affect you.
If that changes, that is, if we start using personal information in a substantially automated way to make decisions that could significantly affect you, we will update this section to describe the kinds of information used and the nature of those decisions, as required under the Privacy Act (including the automated decision transparency requirements taking effect by December 2026).
12. Data retention
We keep personal information only for as long as we reasonably need it for the purposes described in this policy, or for as long as required by law (for example, tax and business records). When we no longer need information, we take reasonable steps to delete it or de identify it.
For information we hold on a client's behalf, retention is generally determined by our agreement with that client and the client's own requirements.
For enquiries and messages we hold for a client, we keep them while the client is with us. When a client leaves, it gets an export of its records and we delete our copies within 6 months. Each enquiry has its own backup copy, which we delete with it. Our nightly backups of these records are kept for 35 days and then deleted automatically, so a record we delete can stay in a backup for up to 35 days, and for a short time after that in our database provider's restore history.
13. Your rights: access, correction and complaints
You can ask us to:
- Access the personal information we hold about you
- Correct information that is inaccurate, out of date or incomplete
- Stop sending you marketing (see section 6)
You can also ask us to delete information we hold about you, where we are able to do so, although we may need to keep some information to meet legal obligations or to complete a service you have asked for. For how to make a deletion request and what happens next, see our Data Deletion Request page.
Deleting your Scalus app account. You can ask us at any time to delete your Scalus app account, along with the messages and photos you sent through it, by sending us a message in the app or by emailing privacy@scalus.app. We will confirm when it is done, usually within 30 days.
Enquiries you sent to one of our clients. If you sent an enquiry or a chat message through a website we run for one of our clients, you can ask that business, or us, to delete it. We will check with the business and then delete it from our records within 30 days. Our backups clear it automatically within 35 days after that.
Withdrawing consent. You can withdraw any consent you have given us at any time by emailing privacy@scalus.app. Withdrawing consent does not undo anything we did before you withdrew it, and if the consent is needed to provide a service, we will explain what that means for the service.
To make a request, email privacy@scalus.app. We may need to verify your identity first. We will respond within a reasonable time, usually within 30 days (and within the timeframes the Privacy Act requires for access requests). Access is normally free, although we may charge a reasonable cost in some cases. If we correct your information we will do so promptly. If we decline to give access or to correct information, we will tell you in writing why and how you can complain, including to the OAIC.
If you have a privacy complaint, please make it in writing to privacy@scalus.app, including enough detail for us to investigate. We will acknowledge your complaint and aim to respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. The OAIC generally expects you to raise your complaint with us first and give us a reasonable chance to respond.
14. Data breaches
If we suspect a data breach involving personal information we hold, we will assess it promptly and within the timeframes required by the Privacy Act, generally within 30 days, and take reasonable steps to contain it. Where we are required to under the Notifiable Data Breaches scheme in the Privacy Act, we will notify the OAIC and affected individuals of an eligible data breach that is likely to result in serious harm.
Where a breach involves information we hold on a client's behalf, we will notify the relevant client promptly and work with them to meet any notification obligations, as the client is generally the entity responsible for that information.
15. Children
Our website and services are intended for businesses and adults, and are not directed at children. We do not knowingly collect personal information from children. If we become aware that we have collected a child's personal information without appropriate consent, we will take reasonable steps to delete it.
16. Changes to this policy
We may update this Privacy Policy from time to time. The current version will always be posted on this page with an updated date, and we can provide a prior version on request. We encourage you to review it periodically. If we make a significant change, we will take reasonable steps to bring it to your attention. This policy governs how we handle personal information; it does not vary the terms of any services agreement, which has its own change process.
17. Contact us
For any questions or requests about your privacy, contact us:
- TMC Media Pty Ltd (ABN 26 660 757 415), trading as Scalus App
- Email: privacy@scalus.app
- Address: Melbourne, VIC, Australia (postal address available on request)
We aim to handle personal information consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
