Privacy notice
Last updated 15 September 2026
Founders trust us with ideas they have not shown anyone. This notice says what we collect, why, who else sees it, how long we keep it, and how you stay in control.
Who is responsible
The controller of your personal data is MD Zahid Hasan, an individual trading as Scaling Protos, at to be completed, Barcelona, Spain. Tax ID (NIE / NIF): to be completed. When a company is registered to run the service, this notice will name it and tell you before anything changes.
Write to support@scalingprotos.com about anything in this notice.
What we collect, why, and for how long
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Your account and sign-in | Email address; your password as a one-way hash; name and picture if you use a Google, GitHub or Microsoft sign-in where one is offered; sign-in sessions with device, IP address and browser | Contract (GDPR Art. 6(1)(b)). Keeping accounts secure is our legitimate interest (Art. 6(1)(f)) | While your account exists. Sessions end when they expire or you revoke them |
| Evaluations and reports | Your answers, uploaded documents, saved drafts and the reports we generate | Contract (Art. 6(1)(b)) | Until you delete them or your account |
| Payments | Email, amount, currency and status. Card and wallet details are entered on Stripe’s page and never reach us | Contract (Art. 6(1)(b)). Tax and accounting records are a legal obligation (Art. 6(1)(c)) | As long as Spanish tax and accounting law requires |
| Usage analytics | Pages viewed, clicks and scrolls, a pseudonymous visitor ID, the campaign that brought you | Your consent (Art. 6(1)(a)), which you can withdraw at any time | Until you withdraw consent |
| Support | What you write to us and your email address | Legitimate interest in answering you (Art. 6(1)(f)) | As long as needed to resolve your request |
We do not sell personal data, and we do not use it for advertising.
How a report is made
When you run an evaluation, three things happen.
- Short keyword phrases derived from your idea are sent from our servers to public search sources: Hacker News (Algolia search API), Google News RSS, Product Hunt API. They never receive your name, email or full answers.
- Comparable companies are chosen from our pool of public directory data. Nothing you write is ever added to that pool.
- Your answers, the text of documents you uploaded, and the retrieved evidence are sent to our language model provider, Amazon Web Services EMEA SARL (Amazon Bedrock, running Anthropic’s Claude models) in AWS regions in the European Union, which writes the report.
Reports are generated with AI and say so: every claim cites a source or is labelled as an inference. The score is calculated automatically. It has no legal effect on you and nobody acts on it unless you share the report. You can ask a person at Scaling Protos to review it.
We do not use your answers or reports to train AI models. Before launch we will confirm in the provider’s contract that it does not use them for training either, and this notice stays in draft until that is done.
Who else processes your data
These providers process personal data on our behalf, under contract, and only for the purpose shown.
| Provider | What for | Data | Where | When |
|---|---|---|---|---|
| Amazon Web Services EMEA SARLplanned | Database, file storage and application servers | Everything in your account: answers, uploaded documents, reports, sign-in sessions | AWS Europe (Spain) region | Always |
| Vercel Inc. | Hosts the website | Technical request data such as IP address and browser, in server logs | United States, global edge network | Always |
| Amazon Web Services EMEA SARL (Amazon Bedrock, running Anthropic’s Claude models) | Writes the report from your answers and the retrieved evidence | Your answers, the text of uploaded documents, retrieved sources and comparables | AWS regions in the European Union | When you run an evaluation |
| Stripe Payments Europe, Ltd. | Takes payments by card, Apple Pay and Google Pay | Email, amount, and the card or wallet details you enter on Stripe’s page | Ireland (EEA) | When you pay |
| Microsoft Corporation (Clarity) | Anonymised usage analytics and session replays | Pages viewed, clicks, scrolls, a pseudonymous visitor ID | United States | Only if you accept analytics |
| Amazon Web Services EMEA SARL (Amazon SES)planned | Sends sign-in codes and receipts | Email address and message content | AWS Europe (Ireland) region | When you sign in |
Transfers outside the European Economic Area
Some providers are based in the United States. When data leaves the EEA we rely on an adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or on the European Commission’s Standard Contractual Clauses.
- Vercel Inc.: to be completed
- Microsoft Corporation (Clarity): to be completed
When you delete your account
Deleting your account in Settings → Privacy and data removes it from our database at once, together with your personal organization, evaluations, reports, drafts, uploaded documents and sign-in history. Payment records stay with Stripe because tax law requires them.
If you own an organization that other people use, we ask you to transfer it or remove them first, so their work is not deleted with your account.
Your rights
- See the data we hold about you, and get a copy in a portable format.
- Correct data that is wrong, or have it deleted.
- Restrict or object to processing based on our legitimate interest.
- Withdraw consent for analytics at any time, without affecting what happened before.
The fastest way is Settings → Privacy and data: download your data, change your cookie choice, or delete your account. You can also write to support@scalingprotos.com. We answer within one month; for complex requests we may need two more months and will tell you why.
If you think we handle your data unlawfully you can complain to the Agencia Española de Protección de Datos (AEPD) or to the authority where you live.
How we protect it
- Connections to the site use HTTPS.
- Passwords are stored only as one-way hashes.
- You can see and end your sign-in sessions in Settings.
- Forms are protected against cross-site request forgery.
- Each organization’s data is kept apart by database access rules.
- A report page opens only for the account that created it.
Age
Scaling Protos is for founders and professionals aged 18 or over.
Changes to this notice
If we change how we use your data, we will update this notice and tell registered users by email before the change takes effect.