This Policy explains how the legal entity to be identified before launch, operating Batch Scale, handles personal information on the public website, in direct business relationships, and while providing the service. It does not replace a Batch Scale customer’s own storefront, workforce, or customer privacy notice.
1. Scope and roles
Batch Scale acts as a controller or business for public-site visitors, prospects, account owners, billing contacts, support contacts, and its own security and service administration. For personal information a customer places in its workspace about customers, workers, suppliers, or other people, the customer ordinarily determines the purposes and means of processing and Batch Scale acts as its processor or service provider under the agreement and DPA.
2. Information you provide
We may collect identifiers and contact details; account credentials; business and workspace profiles; subscription, invoice, tax-status, and payment-provider metadata; support, sales, demo, migration, beta, and security communications; marketing preferences and consent evidence; and Customer Data entered or uploaded to the service.
3. Customer Data
Customer Data may include customer and supplier contacts, addresses, order and fulfillment records, worker assignments, product and production records, recipes or formulations, inventory, tax identifiers, invoices, receipts, quality documents, uploaded images and files, storefront content, communications, and other records selected by the customer. Customers should not enter unnecessary sensitive personal information and must not use Batch Scale for regulated health, complete payment-card, or other specially protected data unless a signed agreement expressly authorizes it.
4. Information collected automatically
We may collect IP address, browser and device type, operating system, referral and page information, timestamps, request identifiers, authentication and session events, feature interactions, diagnostic data, security events, and cookie or local-storage identifiers. Essential data supports authentication, fraud and abuse prevention, preferences, routing, availability, and troubleshooting. Optional public analytics is disabled until a visitor affirmatively allows it.
5. Information from other sources
We may receive information from an account administrator, authorized integration, payment or point-of-sale provider, infrastructure or security provider, referral source, and publicly available business source. Connected providers may send account identifiers, authorization state, catalog, sales, payment, refund, or other records within the scope you authorize. Their terms and notices also apply.
6. Purposes of processing
We use information to provide and configure the service; authenticate users; provision workspaces and domains; process requested integrations; operate subscriptions; respond to sales, beta, migration, privacy, security, and support requests; send transactional messages; send permitted product communications; personalize onboarding; measure optional public analytics; detect, investigate, and prevent abuse or incidents; maintain logs, backups, and business records; enforce agreements; comply with law; and evaluate or complete a corporate transaction subject to appropriate safeguards.
7. Legal bases where GDPR or UK GDPR applies
Depending on the activity, we rely on performance of a contract or steps requested before contracting; compliance with legal obligations; legitimate interests in operating, securing, supporting, and improving a business service; and consent for processing that requires it, such as optional analytics or specified marketing. Where we rely on consent, it may be withdrawn without affecting prior lawful processing. Counsel-approved records must identify and balance each legitimate interest before relevant launch.
8. Required and optional information
Fields marked as required are needed to create or secure an account, provide the requested service, or respond to the request. If required information is not provided, we may be unable to complete that activity. Optional profile, marketing, analytics, or integration information may be declined without losing unrelated core functions.
9. Disclosure of information
We may disclose information to contracted service providers supporting hosting, storage, backup, security, monitoring, communications, support, analytics, billing, and domain operations; to integrations you authorize; to professional advisers under confidentiality duties; to authorities or other parties when legally required or reasonably necessary to protect rights, safety, and service integrity; and in a financing, merger, acquisition, reorganization, or asset transfer subject to appropriate protections.
10. Sale, sharing, targeted advertising, and automated decisions
Batch Scale does not sell personal information for money. Counsel and production configuration must determine whether optional analytics or any future advertising activity constitutes “sale,” “sharing,” or targeted advertising under an applicable law. Batch Scale does not currently use personal information to make decisions producing legal or similarly significant effects through solely automated processing. If these practices change, we will update this notice and provide required controls before enabling them.
11. Cookies and analytics
Essential cookies and similar storage support sessions, security, request protection, routing, and preferences. If allowed, Google Analytics may receive online identifiers and usage information to measure public-site use. The Cookie Policy identifies current categories and controls. Browser controls may delete stored preferences.
12. Marketing communications
We separate service and transactional messages from marketing where practical. You can withdraw marketing permission or use the unsubscribe method in a marketing message. We retain suppression information needed to honor the request. Withdrawing marketing permission does not stop essential account, security, transaction, or legal notices.
13. Retention
We retain information only for documented business, contractual, security, dispute, and legal purposes. Before customer-data launch, Batch Scale must approve and enforce a record-level schedule covering prospects and consent evidence; accounts and acceptance records; Customer Data; billing and tax records; support tickets; security and access logs; analytics; uploaded files; and backups. When deletion is required, primary records will be deleted or deidentified and protected backups will expire on the documented rotation unless isolation, legal hold, or security needs require longer retention.
14. Security
We use administrative, technical, and organizational measures designed to protect information, including tenant-scoped access, authentication controls, transport security, input and upload controls, activity evidence, and operational monitoring appropriate to the deployment. No system guarantees absolute security. Do not send passwords, private keys, complete payment-card details, or unnecessary sensitive information through ordinary email or support forms.
15. International processing
Information may be processed where Batch Scale and its providers operate. Before offering the service where transfer restrictions apply, Batch Scale will document locations and use an applicable mechanism, such as an adequacy decision, EU Standard Contractual Clauses, the UK transfer addendum or agreement, or another lawful safeguard. A copy or description may be requested, subject to necessary redactions.
16. Your privacy rights
Depending on jurisdiction and our role, you may have rights to know or access information; correct inaccurate information; delete information; receive portable information; restrict or object to processing; withdraw consent; opt out of sale, sharing, targeted advertising, or qualifying profiling; appeal a denied request; and receive equal service without unlawful discrimination. Rights are subject to identity verification, scope, exemptions, and applicable law.
17. How to submit a request
Email [email protected] with the subject “Privacy request” and identify the relationship or workspace involved. Do not send identity documents or sensitive records until we provide a secure method. We may verify account control, contact information, authority, and request scope. An authorized agent may be required to provide written authorization and identity evidence. If we process the information only for a customer, we may direct the request to that customer or assist it under the DPA.
18. Appeals and complaints
If applicable law provides an appeal right, reply to the decision with the subject “Privacy appeal” and explain the concern. A reviewer not responsible for the original decision should evaluate it. You may also complain to the regulator with jurisdiction over you. Operational owners, response deadlines, verification rules, and regulator routes remain launch-blocking procedures until approved and rehearsed.
19. Children
Batch Scale is a business service not directed to children, and account owners must be at least 18. We do not knowingly collect personal information directly from children through the public service. Customers must not use the service to collect children’s information unless they have a lawful basis, provide required notices and parental choices, and the agreement permits the processing.
20. U.S. state disclosures
If a comprehensive U.S. state privacy law applies, a jurisdictional supplement will describe covered categories, sources, purposes, recipients, retention criteria, statutory rights, appeal routes, and any sale, sharing, targeted-advertising, sensitive-data, or financial-incentive practice. Batch Scale must not claim an exemption or publish a definitive “not sold/shared” statement until counsel verifies thresholds and actual provider configuration.
21. Changes and prior versions
We will version this Policy, update the revision date, preserve prior approved versions, and provide additional notice of material changes where required. If a change introduces a new purpose requiring consent, we will request that consent before the new processing.
22. Controller and contact
Controller legal name not yet configured
Business address not yet configured
[email protected]