Privacy Policy

The short version

We collect what you give us — name, email, phone number, and your brand’s details — plus limited usage data tied to a random visitor ID. Our own site measurement never stores your IP address, full referrer URLs, or advertising click IDs.
If your company is a SuppScale customer, we also process the content, credentials, and store data your business connects (for example, from Shopify) to build and host your storefront.
On the storefronts we host for customers, we act as the brand’s service provider — the brand you bought from is responsible for that data, and requests about a purchase should go to them first.
We introduce ourselves to supplement brands by email using business contact information from public sources and data providers. Every one of those emails has an unsubscribe link, and opt-outs are honored permanently.
We share personal information only with the providers that run the service and — subject to your choices — advertising measurement partners. We do not sell it for money, and we honor Global Privacy Control signals.
Questions or requests: mike@suppscale.io.

1. WHO WE ARE; WHAT THIS POLICY COVERS; OUR ROLES

This Privacy Policy is published by SuppScale LLC, a Texas limited liability company doing business as “SuppScale” (“SuppScale,” “we,” “us,” or “our”). It covers:

our website at www.suppscale.io, including its forms and scheduling tools;
the SuppScale platform at admin.suppscale.io used by our customers and their teams; and
the emails and text messages we send, including outreach email sent from our suppscale.app addresses (together, the “Services”).

Two different roles. For the Services above, we decide how information is used — we act as the “controller” or “business.” For the online storefronts we build and host on behalf of our customers, the brand that operates the store decides how visitor and buyer information is used, and we process it only on that brand’s behalf as a “service provider” or “processor.” If you visited or bought from a store hosted by SuppScale, that brand’s own privacy policy applies; please direct requests about your data to the brand. If you contact us instead, we will pass your request to them and assist where we can. Section 2 describes what we process in that role.

2. INFORMATION WE COLLECT

Information you provide

Contact and business details — your name, email address, phone number (with country code), and your brand’s website URL, when you submit our signup form.
Scheduling details — the appointment time you choose and your time zone, when you book a call.
Account information — your name and email address when a platform account is created for you, and, if you sign in with Google, the name, email address, and profile photo Google provides.
Customer content and credentials — if your business is a SuppScale customer: the brand information, product details, images, reviews, and other content your team submits, and the integration credentials your business provides (such as a Shopify connection, a Klaviyo API key, or advertising tag IDs). Content your team submits can include information about other people — for example, reviewer names in a review file you import — and your business is responsible for having the right to share it.
Consent records — the consent choices you make and when you made them, including text-message opt-ins and opt-outs.
Communications — the contents of messages you send us.

Information collected automatically

We run our own site measurement, designed to work without identifying you personally:

a randomly generated visitor ID and session ID, stored in cookies;
the pages you view and the buttons you click;
the page you landed on and any campaign (UTM) parameters in the link you followed;
the referring site — recorded as a domain only, never a full URL;
a coarse location signal — the two-letter country code supplied by our hosting provider; and
broad device information — device category (such as mobile or desktop), browser family, and operating system family.

Our measurement events deliberately exclude your IP address, precise location, and advertising click IDs — none of these are stored in our analytics records. Separately, our hosting provider processes IP addresses as part of delivering the Services and protecting them (for example, in short-lived infrastructure logs), and emails we send may include an open pixel and wrapped links that record when a message was opened or clicked.

Information from other sources

Business outreach information — to introduce SuppScale to supplement brands, we obtain business contact information about brands and the people who work at them — name, job title, company, business email address, public professional profile URL and photo, and general location — from public sources (such as company websites and professional profiles) and from third-party data providers. Section 7 describes how we use it and how to opt out.
Connected services — information received from services you or your business authorize, such as sign-in details from Google or store data from Shopify.

Information we process for our customers

On storefronts we host for customers (see Section 1), we process on the brand’s behalf: pseudonymous visit measurement keyed to random identifiers (the same minimal design described above); order records mirrored from the brand’s Shopify store, which are designed to exclude shopper names, email addresses, physical addresses, and payment details; email addresses and phone numbers shoppers submit in signup forms, which are passed to the brand’s own marketing platform (we do not build our own marketing list of shoppers); and reviews the brand publishes, which can include reviewer names and, in some imports, reviewer email addresses. Payment for storefront purchases is handled by Shopify’s checkout — SuppScale never receives payment card details.

3. COOKIES WE SET

These are the first-party cookies our website uses:

Cookie	Purpose	Duration
ss_vid	Anonymous, randomly generated visitor ID for site measurement.	400 days
ss_sid	Groups your page views into a browsing session (30 minutes of inactivity starts a new one).	1 day
ss_ft	Remembers the campaign that first brought you here (UTM parameters and landing page only — never advertising click IDs).	90 days
ss_booking_link	Temporarily connects a personal outreach link to application prefill and on-site funnel steps.	30 minutes
ss_booking_lead	Keeps an application linked to its in-progress call scheduling.	30 minutes
ss_internal	Marks staff and demo traffic so it is excluded from our measurement.	180 days
ss_consent_region	Remembers whether your region requires a cookie consent banner.	24 hours
analytics_consent	Stores the privacy choices you make in our consent banner.	Persistent

The SuppScale platform at admin.suppscale.io sets only strictly necessary cookies — sign-in session and security cookies — and runs no advertising or analytics trackers. Storefronts we host for customers use the same minimal first-party measurement cookies listed above, plus a short-lived attribution cookie and a cookie that keeps the page version you see consistent during a split test; any additional tools on a storefront are chosen by the brand and covered by its own policy.

When permitted by your consent choices (see Section 8), Google Analytics, Meta, and TikTok may also set their own cookies and identifiers on our website.

4. HOW WE USE INFORMATION

to respond to your inquiries and applications;
to schedule, confirm, remind you about, host, and follow up on calls;
to provide and operate the platform — including creating and hosting customer storefronts, generating pages and content, providing support, and measuring how storefronts perform;
to send you service communications and — with your consent or as otherwise permitted by law — marketing communications by email and text message, including business outreach described in Section 7;
to operate, secure, and improve the Services;
to measure how our marketing performs, including which campaigns lead to inquiries and booked calls;
to comply with law and enforce our agreements.

Access to personal information inside SuppScale is limited to personnel who need it to do the things above — including, for customer accounts, our team members who provision, support, and build storefronts on your behalf.

5. HOW WE USE AI

The platform uses third-party artificial intelligence models — routed through an AI gateway to providers including Google, OpenAI, Anthropic, and Z.ai — to generate page copy and imagery, map and check imported reviews, and run quality checks on generated content. What we send to those models is the material needed for the task: customer-provided brand and product information, images, review content, and related instructions. These providers process the content under their API terms; we do not sell it to them.

We share personal information only as described here. We do not sell it for money.

Service providers

Hosting, delivery, and file storage — Vercel hosts our sites and customer storefronts, stores some uploaded files, and provides aggregate, cookieless web analytics.
Data storage — our databases are hosted by Neon.
Google — sign-in for accounts; Google Calendar and Google Meet for booked calls (a booking creates a calendar event with your contact details, and Google delivers the invitation); Gmail for some outbound email we send.
Email — sign-in links, confirmations, invitations, and follow-up emails are delivered through Twilio SendGrid, which also reports delivery, open, and click events back to us.
Text messages — text messages are delivered through Twilio.
Commerce — Shopify, under the connection each customer authorizes for its own store.
Marketing platforms — shopper signups on customer storefronts are delivered into that customer’s own Klaviyo account.
AI providers — as described in Section 5.
Content tooling — Browserbase (remote browser sessions used to import reviews customers direct us to) and PhotoRoom (product-image processing).

Advertising and analytics partners

Subject to your consent choices where required, we share conversion and usage signals from our website with Google Analytics, Meta, and TikTok to measure our advertising. When we relay conversion events to Meta from our servers, that delivery includes your IP address and browser user agent. Under some U.S. state laws this kind of disclosure may be considered “sharing” or use for “targeted advertising”; you can opt out as described in Section 8.

Other disclosures

We may disclose information to comply with law or valid legal process, to protect our rights, users, or the public, or in connection with a merger, acquisition, or sale of assets (in which case this policy continues to apply to the transferred information).

No mobile opt-in data — your phone number or your text-messaging consent — is shared with third parties or affiliates for their own marketing or promotional purposes.

7. EMAIL, TEXT MESSAGES, AND OUR OUTREACH

Messages you signed up for

You opt in to text messages by checking the consent box on our forms. Reply STOP to any text to opt out (you may receive one final message confirming your opt-out), or reply HELP for help. Message frequency varies, and message and data rates may apply. See the Text Message Terms for the full program terms. Marketing emails include an unsubscribe option. Even after you opt out of marketing, we may still send you transactional messages — for example, a confirmation of a call you booked.

Business outreach we initiate

We send introductory email to supplement brands and the people who work at them, using the business contact information described in Section 2. This outreach:

is sent from our suppscale.app email addresses and includes our physical mailing address and an unsubscribe link in every message;
may include measurement of whether a message was opened or a link was clicked;
when you follow a personal outreach link, may connect your on-site call-to-action, application, and confirmed call to that outreach contact record;
stops permanently when you unsubscribe or reply asking us to stop — we keep the email address on a suppression list for the sole purpose of making sure we never email it again; and
may reference a preview page we prepared using the brand’s publicly available product information. Previews are non-transactional, and we will take one down promptly at the brand’s request to mike@suppscale.io.

8. YOUR CHOICES AND PRIVACY RIGHTS

Consent banner

In regions where consent is required (such as the EEA and the United Kingdom), analytics and advertising tools stay off until you allow them through our consent banner. You can change your choices at any time using the “Privacy preferences” control on the site.

Global Privacy Control

We honor Global Privacy Control browser signals as an opt-out of ad-related sharing of your information.

Browser controls

You can also block or delete cookies through your browser settings; parts of the site’s measurement will simply not run.

Email and text opt-outs

Use the unsubscribe link in any marketing or outreach email, reply STOP to any text, or email mike@suppscale.io and we will remove you by hand.

U.S. state privacy rights

Depending on where you live (for example, Texas, California, Colorado, Connecticut, or Virginia), you may have the right to know or access the personal information we hold about you, correct it, delete it, obtain a portable copy, and opt out of targeted advertising or “sharing.” We honor these requests regardless of whether a particular state law technically applies to us. To exercise any of them, email mike@suppscale.io. We may need to verify your identity (and, for an agent request, the agent’s authority), we will not discriminate against you for exercising your rights, and if we decline a request you may appeal by replying to our decision.

Data on customer storefronts

If your request concerns a store operated by one of our customers — for example, a review that displays your name, or an email address you entered in a store’s signup form — the brand operating that store is responsible for it. Contact the brand first; if you contact us, we will forward your request to the brand and assist it in responding.

Visitors outside the United States

Where the GDPR or UK GDPR applies, we process personal data on the legal bases of consent (for example, marketing cookies and text messages), performance of steps you request before entering a contract (for example, scheduling a call), and our legitimate interests in operating and promoting our business — including our legitimate interest in contacting businesses that may benefit from our services, using professional contact information. You may also have the rights to object, to restrict processing, and to lodge a complaint with your supervisory authority.

9. DATA RETENTION

We keep personal information for as long as it is relevant to our relationship with you and as needed to comply with legal obligations, then delete or anonymize it. A few specifics:

consent, opt-out, and suppression records are kept as long as needed to honor your choices;
site and storefront measurement events are keyed to random identifiers rather than to your name or contact details;
checkout attribution records that never match an order are deleted after 90 days; and
customer organization data is handled at the end of a subscription as described in our Terms of Service.

You can request deletion at any time by emailing mike@suppscale.io; we will honor it except where retention is required.

10. SECURITY

We use reasonable administrative and technical safeguards to protect personal information, including encryption in transit, access controls, and limiting access to personnel who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. CHILDREN

The Services are intended for business users who are at least 18 years old and are not directed to children. We do not knowingly collect personal information from children under 13; if you believe a child has provided us information, contact us and we will delete it.

12. WHERE INFORMATION IS PROCESSED

We operate from the United States, and information we collect is processed and stored in the United States, where privacy protections may differ from those in your jurisdiction.

13. CHANGES TO THIS POLICY

We may update this policy from time to time. The “Last updated” date at the top of this page shows when it was most recently revised, and material changes may be highlighted on the site.

14. CONTACT US

Questions or requests about this policy or your information can be sent to:
SuppScale LLC
5701 Scruggs Way, Apt 10307
Plano, TX 75024, USA
Email: mike@suppscale.io