Privacy Policy

Scaling It Privacy Policy

Last updated: 8 October 2026
Effective date: 8 October 2026
Business: Scaling It | ABN: 49 616 366 294
Privacy and support: support@scalingit.au
Contact page: https://www.scalingit.au/contact

1. About this policy

Scaling It helps Australian small businesses and sole operators understand, improve and manage their business systems. This Privacy Policy explains how we collect, use, store, share and protect information when you visit www.scalingit.au, use the Scaling It app at app.scalingit.au, complete a Starter Quiz or assessment, buy Solution Options, subscribe to a plan, or contact us.

"Scaling It", "we" and "us" refer to the business named above. We aim to handle personal information consistently with the Australian Privacy Principles under the Privacy Act 1988 (Cth), including where particular obligations may not legally apply to our business.

This policy covers website visitors, quiz participants, account holders, Implementation Assistants, and people who purchase Solution Options without an account.

2. Information we collect

Depending on how you use Scaling It, we may collect:

Contact and account information: name, email address, business name, ABN where provided, contact details, account role and authentication-related records. Passwords are handled by our authentication provider and are not available to us in readable form.

Business and system information: business size, industry, objectives, applications, subscriptions, processes, data practices, AI use, staff capabilities, budgets, challenges, implementation preferences and questionnaire or assessment answers.

Website information you choose to provide: your business website address and relevant publicly available business information, where you agree to its review for business context.

Project information: results, Snapshot and SCORE records, Solution Options, Blueprints, Roadmaps, guidance, implementation notes, decisions, issues, evidence, feedback, reports and saved artefacts.

Communications: enquiries, support requests, information you send to Ask Scaling It and correspondence about your account or purchases.

Purchases and billing: plan, payment status, transaction amount, billing references, invoice details and relevant payment-provider identifiers. Stripe processes payment card information. We do not receive or store your full card number.

Technical and security information: IP address, browser and device information, session identifiers, sign-in activity, error logs and information used to protect the website and app from misuse.

Please provide only information necessary for your use of Scaling It. Do not enter other people's sensitive personal information, patient or clinical records, privileged legal material, regulated financial records, identity documents, passwords, access codes, API keys or other security secrets. Scaling It is not designed to process that material.

3. Website visits and the Starter Quiz

You can browse our public website and complete the Starter Quiz without creating an account. Quiz answers and results are associated with the quiz session. If you choose to create a Free account before leaving that session, relevant answers can be carried into the new account. Do not assume that an anonymous quiz session can be recovered after leaving it.

Information submitted through website forms is used to respond to the relevant enquiry or request. If you subscribe to optional updates, we use the contact details provided for those messages, and you can unsubscribe.

4. How we use information

We use the information we collect to:

  • operate the website, Starter Quiz and app, and create or manage accounts;

  • assess how a business system supports business objectives, and produce the relevant Snapshot, SCORE, Solution Options and other results;

  • prepare customised plans, guidance, artefacts, Evaluation outputs and Briefings;

  • respond to questions and support requests, including those submitted by an authorised Implementation Assistant;

  • process purchases, manage subscriptions, issue invoices and send essential account communications;

  • maintain security, prevent fraud or misuse, investigate errors and improve service reliability;

  • meet applicable legal, tax, record-keeping and regulatory obligations.

We do not sell your personal information or use your business questionnaire answers and project records to target advertisements. Optional email updates are sent only where you have subscribed or otherwise permitted them.

5. How AI is used

Scaling It uses AI services provided by Anthropic to help produce parts of the app experience, including Solution Options, written guidance, answers, summaries and Briefings. We send only the business information and other context reasonably needed for the relevant task. A recommendation may combine your answers with system records, approved reference material and available product information.

Under Anthropic's standard commercial API terms, inputs and outputs are not used to train its models by default. Anthropic may retain API inputs and outputs for a limited period under its commercial retention and safety arrangements. Scaling It does not promise immediate deletion of copies retained by an independent service provider.

AI-generated material can be incomplete, inaccurate or unsuitable for particular circumstances. You should review important recommendations and instructions before acting on them. Information supplied for AI generation is not, by itself, evidence that an action occurred or that a business result was achieved.

6. Who may receive information

We use service providers to operate Scaling It. The current principal providers are:

  • Supabase: Account authentication, database and project storage. Sydney, Australia.

  • Replit: App hosting, United States.

  • Anthropic: AI processing, United States.

  • Stripe: Payment processing, Australia and overseas.

  • Postmark: Transactional email delivery, United States.

Some information may therefore be processed or accessed outside Australia, particularly in the United States. We take reasonable steps to use providers with appropriate security and confidentiality arrangements. Their handling of data is also subject to their applicable terms, policies and legal obligations.

An Implementation Assistant invited by an account holder may access only the workspace and project information their role permits. We may also disclose information to professional advisers, contractors assisting with legitimate service operations, or authorities where legally required or otherwise permitted by law.

We do not give unrelated users access to your business's workspace records.

7. Purchasing Solution Options without an account

If you buy a standalone set of Solution Options, we collect the questionnaire information needed to produce the results and the email and transaction details needed to deliver and account for the purchase. We send the results and a private access link by email. Please keep that link confidential.

Your standalone questionnaire answers and results are scheduled for deletion seven days after purchase, unless you subscribe to the Basic Plan within that period and successfully transfer them into your account. We state the relevant expiry date in the purchase email. Payment and transaction records that must be kept for accounting, security or legal purposes are separate and may be retained for longer.

8. Retention and account deletion

Active accounts: We retain account, business and project information while your account is open and as needed to provide the service.

Account deletion: When you request account deletion, we aim to remove personal information and business records from active application systems within seven days. Some billing, transaction, security or other records may need to be retained where the law requires or permits this. We will not present legally retained records as active account content.

Standalone purchases: Questionnaire answers and results follow the seven-day rule described above, unless transferred to an account. Transaction records may be kept separately.

Business and tax records: Most relevant transaction records are retained for at least five years, or longer where required by law.

Backups: Information removed from active systems may remain in protected backup copies until those backups rotate or expire. We restrict ordinary access to backups and do not use them to restore deleted account data except where necessary for legitimate recovery or legal requirements.

A request to delete information cannot override a legal obligation to keep specific records.

9. How we protect information

We use safeguards appropriate to a small online service, including protected connections, access controls, authentication, restricted administration privileges and security logging. The app requires an additional sign-in verification step. We limit project access to authorised workspace members and service personnel who need it for legitimate operational purposes.

No online service can guarantee complete security. Please keep your sign-in details private, use the required verification controls and contact us promptly if you suspect unauthorised access.

Where the Australian Notifiable Data Breaches scheme applies and a data breach is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by law. We may also contact affected people about other significant security incidents when notification would help them protect their information.

10. Cookies and website technology

The website and app may use cookies or similar browser storage for session management, sign-in, security, preferences and essential functionality. If analytics or performance measurement tools are enabled, they may collect technical usage information to help us understand and improve the service.

You can manage cookies and stored site data using your browser settings. Disabling essential cookies or storage may prevent some features from working. We do not use business questionnaire answers or private project content for advertising profiles.

11. Access, correction and choices

You can view or update much of your information through the app. For information you cannot access or correct yourself, please contact support@scalingit.au.

We aim to acknowledge access and correction requests within seven days, and to complete straightforward requests in that period where reasonably practicable. If a request needs identity verification, further investigation or consultation, we will explain the expected timeframe and respond within a reasonable period.

You may also request account deletion through the available account settings or by contacting support if you cannot access your account. We may need to verify your identity before acting on a request.

You can unsubscribe from optional marketing or newsletter emails at any time. Essential messages about security, purchases, account access or the services you use may still be sent.

12. Questions and complaints

Please send privacy questions or complaints to support@scalingit.au or use https://www.scalingit.au/contact. We aim to acknowledge your message within seven days and resolve straightforward matters promptly. If investigation takes longer, we will tell you what to expect.

If you remain dissatisfied with how a privacy matter is handled, you may contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au or 1300 363 992. The OAIC's ability to investigate depends on the circumstances and the laws applying to the business.

13. Changes to this policy

We may revise this policy when our services, providers, legal requirements or information practices change. The latest version and update date will be displayed on the website and in the app. We will notify account holders about significant changes affecting their information by email or another suitable notice.