SCALE Privacy Policy

Version of 4 November 2026.

1Who we are

SCALE by split/build (the "Service") at https://scale.splitbuild.net is provided by ApplePie creative agency OG ("ApplePie", "we", "us"), Wagramer Straße 110, 1220 Wien, Austria, commercial register no. FN 681220 w, Commercial Court of Vienna (Handelsgericht Wien). Our full legal notice is at https://scale.splitbuild.net/imprint.

Contact for everything about your data: support@splitbuild.net. You can also write to alex@applepie.digital or call +43 676 7252812.

This policy applies only to the service at scale.splitbuild.net operated by ApplePie. The service at scale.splitbuild.ru is operated by a different, independent controller under its own privacy policy; accounts and data are not shared between the two services. This address has no public sign-up: access is limited to demo accounts that ApplePie creates (section 6a).

2The two roles we act in

For your account — the data an account needs to exist and the Service needs to run: email address, name, settings, access logs — ApplePie is the controller and decides how it is processed.

For workspace content — tasks, projects, files, conversations, calls, client records — the workspace that holds it is the controller (usually your employer or client) and ApplePie acts as its processor. We process that content only on the workspace's documented instructions, to run the Service, and never for our own purposes. The terms for this role are in our Data Processing Agreement: https://scale.splitbuild.net/dpa.

If you want to know what a workspace holds about you, ask its administrator: we do not disclose the contents of someone else's workspace, even to a member of it.

3What we process

Account data. Email address, name, password (stored only as a bcrypt hash — the original cannot be recovered), avatar, time zone, language, email verification status, last sign-in time.

Workspace content. Everything you create in the Service: projects, tasks, comments, files and links, knowledge pages, time entries, client and deal records, quotes, financial entries.

Integration data — only for integrations you connect yourself: Telegram chats you link, project mailboxes, call recordings and transcripts, Zoom meetings our bot joins at your instruction, Google Calendar events, and — if you connect Google Docs — the name, link and comments of the files you link.

AI-assistant connections — only if you connect an AI assistant (section 7): the connection record (which assistant, which permissions you approved, when it was created and last used) and the log of requests the assistant made.

Technical data. Shortened IP address (the last part is removed: IPv4 to /24, IPv6 to /48), device and browser details, request logs with a request identifier, timing and outcome of actions. Logs exist to investigate failures and abuse and are kept for 7 days (section 8). We do not log the content of sign-in requests.

Emails you send us. If you request access or ask for support by email (alex@applepie.digital or support@splitbuild.net), we process your address, the message and our reply to answer you. These messages are handled in ApplePie's business mailbox, provided by Google Workspace (Google Ireland Limited; data may be processed in the United States, on the basis of the EU–US Data Privacy Framework or Standard Contractual Clauses).

We do not collect special categories of personal data (health, religious or political views, biometrics), and we ask you not to place them in the Service.

4Why we process it, and on what basis (GDPR Art. 6)

We do not use your data for marketing, profiling or advertising.

5No advertising analytics, no tracking

The Service uses only the cookies and browser storage it cannot work without: your session and interface settings (language, theme). There are no analytics, advertising or tracking scripts and no session recording, so there is nothing to consent to or opt out of.

6Who receives data, and transfers outside the EU

We do not sell personal data and do not share it for anyone's advertising. We rely on the providers below; each receives only the minimum its function needs.

We disclose data to public authorities only where the law obliges us to. Integration providers receive data only when the corresponding feature is enabled; a workspace administrator can disable any of them.

6aDemo environment and data location

SCALE at scale.splitbuild.net is currently a demonstration environment operated by ApplePie creative agency OG. Sign-in is possible only with demo accounts that ApplePie creates and owns and hands to reviewers of AI-assistant marketplaces. The workspace contains fictitious data only; please do not enter real personal data.

The Service is hosted by Timeweb in the Russian Federation, a third country without an EU adequacy decision. Apart from the demo account data (owned by ApplePie, section 3) and the emails you send us (section 3), the only personal data we process about people using this environment are technical data (shortened IP address, browser details, request logs). We need them to operate and secure the Service (Art. 6(1)(f) GDPR). We keep them for 7 days and then delete them automatically.

We plan to move the Service to hosting within the EU before inviting any real users. Questions: support@splitbuild.net. You may lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, www.dsb.gv.at).

7Connecting AI assistants (MCP)

The Service can be connected to AI assistants such as Claude, ChatGPT or Grok through the Model Context Protocol. The server address is https://scale.splitbuild.net/api/external/v1/mcp and sign-in uses OAuth 2.1. This is optional and always started by you.

What the assistant receives. Only what you allow. On the consent screen you choose the permissions (scopes) and the workspace. The assistant can then read and, if you allowed writing, change data only within those permissions and only what you yourself may see or change in the Service — your own access rights still apply to every request. Nothing is shared before you approve.

What goes to the model provider. What the assistant reads through the connection becomes part of your conversation with that assistant, and the provider of the assistant (for example Anthropic or OpenAI) processes it under its own terms and privacy policy, not under ours. We do not control that processing. Do not connect an assistant to a workspace whose content you may not share with that provider.

What we store. The connection record and a log of the requests, for security and so you can see what is connected (section 3).

How to revoke access. Open Scale → Integrations → Connected apps and disconnect the assistant; a workspace administrator can also turn the connector off for the whole workspace. Disconnecting stops the assistant at once. You can also remove the connector in the assistant itself. Data the assistant already read stays in your conversation with it; delete it there.

8How long we keep data

• Workspace content — for as long as the workspace exists.
• An account — until it is deleted. After deletion: 30 days to recover from a mistake, then permanent erasure.
• Technical and request logs — 7 days, then deleted automatically (maximum 14).
• Demo accounts — for as long as the demonstration environment runs; they are deleted when it is closed or moved to EU hosting.
• AI-assistant connections — until you disconnect them; the access token expires on its own and is revoked at disconnection.
• Integration access tokens — until the connection is revoked.

9How we protect data

Passwords are stored as bcrypt hashes. Third-party tokens are encrypted at rest. Connections use TLS. Access is scoped by workspace and by area (project, finance, conversations), and both the application and the database enforce it. Actions in the Service are logged.

No measure is absolute. If a breach affects your data, we will tell you without undue delay and, where the law requires, the supervisory authority within 72 hours.

10Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict its processing (Art. 18);
• receive it in a portable format (Art. 20);
• object to processing based on our legitimate interest (Art. 21);
• not be subject to a decision based solely on automated processing (Art. 22);
• withdraw consent at any time (Art. 7(3)); this does not affect processing already carried out.

Write to support@splitbuild.net; we answer within one month (Art. 12). A request about the contents of someone else's workspace is forwarded to that workspace's administrator, who is its controller.

You may lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde (https://www.dsb.gv.at), Barichgasse 40–42, 1030 Wien, or the authority of your own country of residence.

11Children

The Service is built for work and is not intended for anyone under 16.

12Changes

We will announce material changes in the interface or by email before they take effect. The version date appears at the top of this document.