Privacy Policy

Scalebase Studio is a web design and development studio based in Manila, Philippines, working with clients in the United States, Australia, the United Kingdom, the United Arab Emirates, and the Philippines. For the purposes of data protection law, we are the controller of the personal information described in this policy.

You can reach us about anything in this policy at scalebase.studio@gmail.com.

We only collect what we need to answer your inquiry and run our business.

When you submit the contact form

• Your full name and email address
• Optionally, your phone number and business name
• Whether you are starting fresh or already have a site or store, and whether it is a website or an online store
• The plan you are considering, or the URL of your current site and what you need help with
• How you heard about us, and anything you write in the message field, if you choose to tell us
• A record that you agreed to these terms and to being contacted about your enquiry

When you become a client

• Billing details and invoicing records
• Content, brand assets, and source material you send us, including answers to our intake questionnaire
• Access credentials for accounts we need to build or maintain your site, such as your domain, hosting, platform, analytics, Search Console, or Google Business Profile
• Notes and recordings from consults, strategy calls, and walkthroughs

Collected automatically

• Standard server logs: IP address, browser and device type, referring page, and pages viewed
• Aggregate analytics about how the site is used: page views, time on page, and broad location at city level
• Cookie preferences, stored locally in your browser

We do not collect special category data (health, biometric, political, religious), and we ask that you do not send it to us.

• Replying to your inquiry within one business day and sending a calendar link for your consult
• Preparing for the consult, including a free review of your existing site if you shared its URL
• Scoping, delivering, maintaining, and supporting work you engage us for
• Handling content update requests and sending monthly reports on retainer plans
• Sending invoices and keeping accounting records
• Improving the website and understanding which pages are useful
• Sending occasional studio updates, only if you explicitly opt in, and every email has a one-click unsubscribe
• Meeting legal, tax, and regulatory obligations

Our legal bases are: your consent (for marketing and non-essential cookies), performance of a contract (client work), legitimate interests (answering inquiries, running and improving the studio), and legal obligation (tax and records).

The sites and stores we build collect information from your own visitors and customers through forms, bookings, checkouts, analytics, and CRM or email platform integrations. For that information, you are the controller and we act only on your instructions as a processor.

• Your domain, hosting, and platform accounts are registered in your name, and visitor data is stored in those accounts, not ours
• We access it only as needed to build, fix, maintain, or report on the site
• Payments run through the gateways you choose, such as GCash, Maya, or PayMongo. We never see or store card details
• You are responsible for your own site's privacy policy and cookie notice; we can set these up as part of the build

When an engagement ends, we remove our access and delete any copies of your visitor data we hold within 30 days.

Essential cookies keep the site working. They remember your cookie choice and protect our forms from spam. These cannot be switched off.

Analytics cookies are optional and only set after you accept them. We use Google Analytics 4, which does not store IP addresses, and we do not run advertising or cross-site tracking pixels on this site.

You can change or withdraw your cookie choice at any time by clearing cookies for this site in your browser, which brings the cookie banner back on your next visit.

We never sell your personal information. We share it only with service providers who help us operate, each bound by a data processing agreement:

• Hosting and infrastructure providers for this site
• Email and calendar providers used to reply and schedule consults
• Analytics and form-handling providers
• Payment and accounting providers for invoicing

Our social profiles on LinkedIn, Instagram, Facebook, and X are run by those platforms under their own privacy policies. If you message us there, they process that information too.

We may also disclose information where required by law, or as part of a business transfer, in which case we will tell you before your information becomes subject to a different policy.

Because we work across the Philippines, the US, Australia, the UK, and the UAE, your information may be processed outside the country where you live. Where data leaves the UK or EEA, we rely on adequacy decisions or Standard Contractual Clauses, and we require equivalent safeguards from our providers.

• Inquiries that do not become projects: 24 months, then deleted
• Client project records and correspondence: for the life of the engagement plus 7 years, for tax and legal reasons
• Account credentials: removed when the engagement or retainer ends
• Marketing subscriptions: until you unsubscribe
• Server logs: 90 days
• Analytics data: 14 months, in aggregate form

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct anything inaccurate
• Ask us to delete it, where we have no legal reason to keep it
• Object to or restrict how we use it
• Receive a portable copy of information you gave us
• Withdraw consent at any time, without affecting earlier processing
• Opt out of the sale or sharing of personal information (we do neither)

Email scalebase.studio@gmail.com and we will respond within 30 days. If you are not satisfied, you can complain to your local data protection authority: the National Privacy Commission in the Philippines, or the ICO in the UK.

We use encrypted connections, access controls, two-factor authentication on our tools, and least-privilege access for the team. Client credentials are kept in an encrypted password manager, never in email or chat. No system is perfectly secure, but if a breach affects your information we will notify you and the relevant regulator within 72 hours of becoming aware of it.

Our services are for businesses. We do not knowingly collect information from anyone under 16. If you believe a child has provided us with information, email us and we will delete it.

When we make material changes we will update the date at the top of this page and, where the change affects how we use information you have already given us, notify you by email. Continuing to use the site after an update means you accept the revised policy.