Privacy Policy

We collect information you provide directly to us, such as when you: • Fill out a contact form or request a consultation • Subscribe to our newsletter or download a resource • Book a call through our scheduling system • Communicate with us via email, phone, or other channels • Engage our services or access our client portal • Purchase a course or training program This information may include your name, email address, company name, job title, phone number, payment information, and any other information you choose to provide. We also automatically collect certain information when you visit our website, including: • Log data (IP address, browser type, pages visited, time spent) • Device information (operating system, screen resolution, device type) • Referral source and attribution data • Cookies and similar tracking technologies (see "Cookies and Tracking" below)

We use the information we collect to: • Respond to your inquiries and provide customer support • Deliver our consulting services and manage client engagements • Process payments and send invoices • Send you updates, newsletters, and marketing communications (with your consent) • Send transactional emails (appointment confirmations, account notifications, support responses) • Improve our website and services • Analyze usage patterns and trends • Prevent fraud and ensure platform security • Comply with legal obligations Email Communications: If you subscribe to our newsletter or provide your email through a form, we may send you marketing and informational emails. Every marketing email we send will include our physical mailing address and a clear unsubscribe link. We will honor unsubscribe requests within 10 business days. Unsubscribing from marketing emails will not affect transactional emails related to active engagements, such as invoices, appointment confirmations, or portal access links. We do not sell, rent, or share your personal information with third parties for their marketing purposes.

If you provide your mobile phone number and opt in to receive text messages from ScaledByDesign, we may send you transactional or account-related SMS messages, including: • Account notifications • Integration updates • Support-related alerts • Authentication or verification messages • Other service-related communications Message frequency may vary. Message and data rates may apply. You can reply STOP to opt out at any time or HELP for assistance. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories of personal information described in this Privacy Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. We may use service providers that help us deliver text messages or support our platform operations, but they may only use your information as necessary to provide services to us and not for their own marketing purposes.

We may share your information with: • Service providers who assist in our operations (see "Third-Party Services" below for specifics) • Professional advisors (lawyers, accountants) as necessary • Law enforcement or government agencies when required by law • A successor entity in the event of a merger, acquisition, or sale of assets (with notice to you) All service providers are bound by confidentiality agreements and are only permitted to use your data as necessary to provide services to us.

We use the following categories of third-party service providers to operate our website and deliver our services. Each provider may collect or process your data as described: Hosting and Infrastructure: • Vercel — website hosting, edge functions, and deployment; processes server logs and IP addresses • Upstash — rate limiting; processes IP addresses temporarily Analytics and Performance: • Vercel Analytics — website traffic analysis; collects anonymized page view data and referrer information • Vercel SpeedInsights — performance monitoring; collects page load metrics and browser/device type • OpenPanel — behavioral analytics; collects page interactions and feature usage • Dub — link tracking and attribution; collects click data and referral attribution Communications: • Resend — transactional email delivery; processes email addresses and message content • Twilio — SMS messaging; processes phone numbers and message content • Cal.com — appointment scheduling; collects name, email, and scheduling preferences when you book a call Data Storage: • Notion — CRM and client records; stores contact information and project details Payments: • Stripe — course and product payments; processes payment card information, email, and transaction details; subject to Stripe's Privacy Policy Authentication: • Google OAuth — optional portal sign-in; processes Google account information if you choose to sign in with Google Each provider's data practices are governed by their respective privacy policies. We maintain data processing agreements with providers who process personal data on our behalf.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (TLS/SSL), secure authentication mechanisms, access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security. If you become aware of any unauthorized access to your account, please contact us immediately.

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy: • Contact form submissions and lead information: Up to 3 years from last interaction • Email marketing subscriber data: Until you unsubscribe, plus 30 days for processing • Client portal data and authentication tokens: 90 days of inactivity • Client engagement records and invoices: 7 years (for tax and legal compliance) • Website analytics data: As determined by our analytics providers (typically 14–26 months) • SMS opt-in and opt-out records: Retained indefinitely to honor your preferences When personal data is no longer needed, we securely delete or anonymize it. You may request earlier deletion by contacting privacy@scaledbydesign.com, subject to our legal retention obligations.

Depending on your location, you may have the following rights regarding your personal data: • Access: Request a copy of the personal data we hold about you • Correction: Request correction of inaccurate or incomplete data • Deletion: Request deletion of your personal data • Opt-out: Unsubscribe from marketing communications at any time • Data portability: Request a copy of your data in a structured, machine-readable format • Restriction: Request that we limit processing of your data in certain circumstances • Objection: Object to processing based on legitimate interests To exercise any of these rights, please contact us at privacy@scaledbydesign.com. Include "Privacy Request" in your subject line. We will acknowledge your request within 5 business days and provide a substantive response within 30 days (or 45 days for California residents, with one 45-day extension if reasonably necessary). We may need to verify your identity before processing your request.

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Categories of Personal Information We Collect: • Identifiers (name, email address, phone number, IP address) • Commercial information (services purchased, payment history) • Internet or electronic network activity (pages visited, browser type, device information, analytics data) • Professional or employment-related information (company name, job title) • Inferences drawn from the above to create a profile about your preferences Purposes for Collection: We collect this information to provide and improve our services, respond to inquiries, process payments, send communications you have requested, analyze website usage, and comply with legal obligations. We Do Not Sell or Share Your Personal Information: ScaledByDesign does not sell your personal information as defined under the CCPA/CPRA. We do not share your personal information for cross-context behavioral advertising. Your California Rights: • Right to Know: You may request the categories and specific pieces of personal information we have collected about you. • Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions. • Right to Correct: You may request correction of inaccurate personal information. • Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information; however, you may submit a request to confirm this. • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights. To exercise these rights, contact us at privacy@scaledbydesign.com or write to us at the address below. We will verify your identity before processing your request and respond within 45 days, with one 45-day extension if reasonably necessary. If you are an authorized agent submitting a request on behalf of a California resident, please provide written authorization from the consumer along with your request.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following additional provisions apply: Legal Basis for Processing: We process your personal data based on one or more of the following legal grounds: • Consent — where you have given us explicit consent (e.g., opting in to marketing emails or SMS) • Legitimate Interests — where processing is necessary for our legitimate business interests (e.g., website analytics, fraud prevention, improving our services), provided these interests are not overridden by your rights • Contractual Necessity — where processing is necessary to perform a contract with you (e.g., delivering consulting services) • Legal Obligation — where we are required to process data to comply with applicable law Your Additional GDPR Rights: In addition to the rights listed above, you have the right to: • Object to processing based on legitimate interests • Restrict processing in certain circumstances • Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal) • Lodge a complaint with your local data protection authority International Data Transfers: Your personal data may be transferred to and processed in the United States, where our servers and service providers are located. The United States may not provide the same level of data protection as your home country. We rely on Standard Contractual Clauses and other approved transfer mechanisms where required by law to safeguard your data during international transfers.

We use cookies and similar tracking technologies to: • Remember your preferences and authenticate your sessions • Understand how you use our website • Improve our services and website performance • Track referral attribution and conversion events • Deliver relevant content Cookies We Use: Essential Cookies: • Portal authentication tokens — authenticates your client portal session (90-day expiration) • CSRF protection tokens — protects against cross-site request forgery (session-based) Analytics Cookies: • Vercel Analytics — anonymous page view and performance tracking • Dub Analytics — link click attribution and conversion tracking • OpenPanel — behavioral analytics and feature usage tracking Third-Party Cookies: • Cal.com — set when you interact with our scheduling widget • Google OAuth — set if you sign in with Google • Stripe — set during payment processing You can control cookies through your browser settings. Note that disabling cookies may affect some website functionality, including portal access and scheduling. Do Not Track Signals: Some browsers transmit "Do Not Track" (DNT) signals. There is currently no universal standard for how companies should respond to DNT signals. At this time, we do not alter our data collection and usage practices in response to DNT signals. Global Privacy Control: We honor Global Privacy Control (GPC) signals as a valid opt-out request for the sale or sharing of personal information where required by applicable law.

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe we may have collected information from a child, please contact us at privacy@scaledbydesign.com.

Our website may contain links to third-party websites and services, including scheduling platforms, payment processors, and social media sites. We are not responsible for the privacy practices or content of these sites. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Effective Date" above. For active client engagements, we will also notify you via email of material changes. Your continued use of our services after any changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or our data practices, please contact us at: ScaledByDesign LLC 2028 E Ben White Blvd #240-3203 Austin, Texas 78741 United States Email: contact@scaledbydesign.com Privacy requests: privacy@scaledbydesign.com For formal privacy requests, please include "Privacy Request" in your subject line or mark written correspondence "Attention: Privacy."