Legal · last updated 2026-05-22
Privacy Policy
ScaLabs Cloud is operated jointly by Scalabs UG (haftungsbeschränkt) (Germany, “Scalabs UG”) and ScaLabs Cloud Pvt. Ltd. (Kathmandu, Nepal, “ScaLabs Cloud Pvt. Ltd.”). This policy explains how both entities handle personal data and customer data on the scalabs.cloud platform.
1. What we collect
Account data
When you sign up for an interest form or a founding reservation, we collect: name, email, company or project name, country, the product you’re interested in, and a free-text description of your intended use case.
Operational data
For active tenants we additionally collect: payment method metadata (the payment processor — see §5 — holds the card data; we never see it), tenant configuration (quotas, gateway grants, secrets references), and metadata-level logs of admin actions and tool calls.
Inference / agent runtime data
Prompts, outputs, memory contents, files, conversations, and tool-call payloads sent through hosted-agents tenants and inference endpoints stay inside the tenant environment.
2. What we do NOT do
- We do not use customer prompts, outputs, memory, files, conversations, or tool-call data for model training, ever.
- We do not share customer data with third parties for advertising or marketing.
- We do not sell customer data.
3. How long we keep it
- Interest form submissions: 24 months from submission, then deleted unless you opt to remain on the announcement list.
- Account data: kept while your account is active and for 12 months after termination for tax and audit purposes.
- Operational metadata logs: 90 days by default.
- Request and response bodies (LLM prompts, agent outputs): not logged by default. Tenants can opt in to per-call logging for their own debugging; that data is kept for the tenant-configured retention period.
4. Lawful basis (GDPR)
For EU customers and prospects, we rely on:
- Contract performance (Art. 6(1)(b)) for active tenants
- Legitimate interest (Art. 6(1)(f)) for interest-form submissions
- Consent (Art. 6(1)(a)) for announcement-list subscriptions
5. Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare | CDN, DDoS protection, DNS, Pages | Global |
| Brevo (Sendinblue) | Email — interest list, announcements | France (EU) |
| Stripe | Payment processing (deposits + annual billing) | Ireland (EU) |
We will update this list before adding new subprocessors and notify active customers.
6. Your rights
EU and UK residents have the right to access, correct, delete, restrict processing of, and port their personal data, plus the right to object to processing and to lodge a complaint with a supervisory authority.
Nepal customers: equivalent rights under the IT Bill 2079 framework as it is enacted; we will track changes and align.
Contact: privacy@scalabs.cloud.
7. Cross-border transfers
Data may move between our German and Nepali entities for billing reconciliation, support escalation, and infrastructure operations. We rely on Standard Contractual Clauses (Modules 1 and 2) and have a Data Processing Addendum available on request.
8. Changes
If we materially change this policy, we’ll email active tenants at least 30 days before the change takes effect.
Last updated: 2026-05-22.