Get Free Audit

Privacy Policy

Last updated: 1 November 2026

This Privacy Policy explains how Scale SEO AI collects, uses, shares, stores and protects your personal data when you visit scaleseoai.com, contact us, or use our services. It also explains your rights and how to exercise them.

We publish this policy under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”). We also follow the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”) as their provisions come into force.

1. Who we are

Scale SEO AI provides search engine optimisation (SEO) and AI search optimisation services to small and medium businesses. For the personal data described in this policy, Scale SEO AI is the “Data Fiduciary” under the DPDP Act: we decide why and how your personal data is processed.

  • Legal name: Scale SEO AI, a sole proprietorship
  • Address: VPO Charna, Tehsil Nohradhar, District Sirmaur, Himachal Pradesh 173032, India
  • Email: contact@scaleseoai.com
  • WhatsApp: +91 70184 48727

2. This policy in brief

  • We collect only the details you choose to send us when you contact us or become a client, and basic technical logs our web host records for security.
  • We use Google Analytics, loaded through Google Tag Manager, to understand how visitors use this website. Analytics cookies are set only if you accept them, and we do not use advertising cookies.
  • We do not sell your personal data, and we do not share it with anyone for their own marketing.
  • You can ask to access, correct or erase your data, withdraw your consent, or raise a complaint with our Grievance Officer at any time.

3. Personal data we collect, and why

3.1 When you fill in our contact form, email us or message us on WhatsApp

What we collect: the details you choose to share, such as your name, business name or website address, phone number, email address, location, the service you are interested in, your WhatsApp profile name, and the contents of your messages and any files you send. When you use the contact form, we also record your consent, the date and time, your IP address and browser details, and the form runs a security check by Cloudflare Turnstile (see section 7), to protect it against spam and misuse.

Why: to reply to your enquiry, to prepare a free SEO audit if you ask for one, to send you a proposal, and to keep a record of our conversation. Contact form submissions are stored in our website’s database, which is hosted in India, and are also sent to us by email.

Legal basis: you give us this data voluntarily for these purposes and have not told us you object (section 7(a) of the DPDP Act), and where needed, your consent.

3.2 When you become a client

What we collect: the names, email addresses and phone numbers of your contact people; billing details such as your business name, billing address and GST number; and the correspondence, reports and records of the work we do for you.

Why: to provide the services you engage us for, to communicate with you, to invoice you and keep accounts, and to meet our tax and legal obligations.

Legal basis: data you provide voluntarily to receive our services, our agreement with you, and compliance with Indian law (for example, tax and accounting record-keeping).

3.3 When you visit this website

What is collected: like most websites, our hosting provider automatically records technical information in server logs, such as your IP address, browser and device type, the pages requested, and the date and time of each request.

Why: to deliver the website, keep it secure, and detect and prevent misuse, attacks and fraud.

Legal basis: keeping the website secure and complying with legal requirements on maintaining logs, including the DPDP Rules and directions issued by CERT-In.

3.4 Website analytics (only if you accept analytics cookies)

What is collected: if you accept analytics cookies, Google Analytics collects information about your visit. This includes the pages you view, how long you stay, the website or search that brought you here, the links and buttons you click, your device, browser and screen size, your approximate location (country and city, derived from your IP address), and a randomly generated identifier stored in a cookie. Google Analytics does not log or store IP addresses, and we do not send your name, email address or phone number to Google Analytics.

Why: to understand which pages are useful, improve the website, and measure whether our own marketing works.

Legal basis: your consent, which you give or refuse in our cookie banner and can withdraw at any time (see section 4).

3.5 Search performance data

We use Google Search Console and Bing Webmaster Tools to see how this website appears in search results. These services give us aggregated reports, such as the search queries that showed our pages, impressions and clicks. They do not place cookies on this website or identify individual visitors to us.

3.6 What we do not collect

We do not ask for “sensitive personal data or information” as defined in the SPDI Rules, such as bank account, credit card or debit card details, passwords to your personal accounts, health information, sexual orientation or biometric information. We do not take payments on this website. Please do not send us this kind of information.

When our work needs access to your website or marketing tools (for example Google Search Console, Google Analytics or your website’s admin area), we ask you to give us our own user access wherever the tool allows it, rather than sharing your password.

4. Cookies

Cookies are small text files that a website stores in your browser. This website uses the following:

  • Necessary: a cookie named ssai_consent that remembers whether you accepted or rejected analytics cookies, so that we do not ask you again on every page. It lasts 6 months and is always on, because the site needs it to respect your choice.
  • Analytics (only with your consent): Google Analytics cookies named _ga and _ga_<ID>. They distinguish one visitor from another and last up to 2 years. They are set only after you click “Accept” in our cookie banner.

Google Tag Manager is the tool we use to load Google Analytics. It does not set cookies of its own. We do not use advertising, remarketing or social media tracking cookies. WordPress, the software that runs this site, sets functional cookies only for our own team when they log in to manage the site.

Your choices: you can accept or reject analytics cookies in the banner shown on your first visit. You can change your choice at any time using the “Cookie settings” link at the bottom of every page. You can also block or delete cookies in your browser settings, or install the Google Analytics opt-out browser add-on. Rejecting analytics cookies does not affect your use of this website.

If we add any other kind of cookie in future, we will update this policy first and ask for your consent where the law requires it.

5. How we do not use your data

  • We do not sell or rent your personal data.
  • We do not share your personal data with other businesses for their own marketing.
  • We do not send you promotional messages unless you have asked for them or agreed to receive them. You can opt out at any time by replying “STOP” or emailing us.
  • We do not make decisions about you based only on automated processing.

6. Data we handle on behalf of our clients

When we work on a client’s website or marketing accounts, we may be able to see personal data that belongs to that client’s own customers or website visitors (for example, in analytics reports or form submissions). In that case, the client is the Data Fiduciary and we act as their “Data Processor”. We process that data only to perform the agreed services, only on the client’s instructions, and under our agreement with them. People whose data is held by our clients should contact that client directly about their rights.

7. Who we share your data with

We share personal data only with the service providers we need to run our business, and only as much as they need. They are required to protect it.

  • Website hosting: Hostinger, which hosts this website and its server logs.
  • Email: ImprovMX, which receives email sent to contact@scaleseoai.com and forwards it to our inbox; Google (Gmail), which hosts that inbox; and Brevo, which delivers the emails we send from contact@scaleseoai.com.
  • Website analytics and search tools: Google (Google Analytics, Google Tag Manager and Google Search Console) and Microsoft (Bing Webmaster Tools). Google processes analytics data on our behalf as described in section 3.4. You can read how Google uses this data at policies.google.com/technologies/partner-sites. We have turned off sharing of analytics data with Google for its own products and for advertising.
  • Spam protection: Cloudflare Turnstile, which checks that contact form submissions come from a person and not an automated program. To do this, Cloudflare processes technical information such as your IP address and browser and device characteristics when you use the form. It is used only for this security check, not for advertising. See Cloudflare’s privacy policy.
  • Messaging: WhatsApp (operated by Meta), if you choose to contact us on WhatsApp. Your use of WhatsApp is also governed by WhatsApp’s own terms and privacy policy.
  • Professional advisers: our chartered accountant, auditors and legal advisers, where needed for accounting, tax and legal compliance.
  • Government and law enforcement authorities: only when the law requires it, or when we receive a lawful order or request from an authorised agency.

If our business is reorganised, merged or sold, personal data may be transferred to the new owner. The new owner will remain bound by this policy, or must give you notice of any change.

8. Where your data is stored, and transfers outside India

Our website is hosted on servers located in India. Some service providers, such as Google (for analytics and email), Cloudflare (for spam protection), WhatsApp, ImprovMX and Brevo (for email), may store or process data outside India, including in the United States. We transfer personal data outside India only as permitted by section 16 of the DPDP Act, and never to a country or territory that the Government of India has restricted.

9. How long we keep your data

  • Enquiries that do not lead to an engagement: up to 12 months from our last contact with you, and then deleted.
  • Client records: for the length of our engagement, and afterwards for as long as Indian tax, GST and accounting laws require us to keep invoices and business records.
  • Google Analytics data: 14 months from your last visit, after which Google deletes it automatically. Reports we have already prepared contain only aggregated figures.
  • Server logs: for at least one year, as required by the DPDP Rules and CERT-In directions, and then deleted in the ordinary course.

When we no longer need personal data for the purpose it was collected for, or when you withdraw your consent, we erase it, and ask our service providers to erase it, unless the law requires us to keep it.

10. How we protect your data

We take reasonable security safeguards to protect personal data against unauthorised access, loss, misuse, alteration and disclosure, as required by section 43A of the Information Technology Act, 2000 and section 8(5) of the DPDP Act. These include encrypted connections (HTTPS) to this website, limiting access to personal data to the people who need it for their work, and choosing service providers that protect data.

No method of transmitting or storing data is completely secure. If a personal data breach occurs, we will inform affected people and the Data Protection Board of India in the manner and within the time required by the DPDP Act and DPDP Rules. We will also report to CERT-In where the law requires it.

11. Your rights

Under the DPDP Act, you have the right to:

  • Access: get a summary of the personal data we hold about you, how we use it, and who we have shared it with (section 11).
  • Correction and erasure: ask us to correct, complete or update your data, or to erase data we no longer need (section 12).
  • Withdraw consent: withdraw consent you have given us at any time, as easily as you gave it (section 6(4)). Withdrawing consent does not affect processing that took place before you withdrew it.
  • Grievance redressal: complain to our Grievance Officer about how we handle your data (section 13).
  • Nominate: nominate another person to exercise your rights if you die or become unable to act (section 14).

To exercise any of these rights, email contact@scaleseoai.com or our Grievance Officer (section 13 below). We may need to verify your identity before acting on your request. We will respond within one month, which is within the timelines set by the SPDI Rules and the DPDP Rules.

If you choose not to give us certain data, or you withdraw your consent, we may not be able to respond to your enquiry or provide our services.

12. Children

Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data without the verifiable consent of a parent or lawful guardian, please contact us and we will delete it.

13. Grievance Officer

As required by Rule 5(9) of the SPDI Rules and section 8(10) of the DPDP Act, our Grievance Officer handles complaints and questions about your personal data:

  • Name: Naveen Sharma
  • Designation: Grievance Officer, Scale SEO AI
  • Email: contact@scaleseoai.com (subject line: “Privacy grievance”)
  • Address: VPO Charna, Tehsil Nohradhar, District Sirmaur, Himachal Pradesh 173032, India

We will acknowledge your grievance promptly and resolve it within one month of receiving it. If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act, after first using our grievance process.

14. Links to other websites

This website links to other websites and services, such as WhatsApp and Google. We are not responsible for their privacy practices, so please read their privacy policies.

15. Changes to this policy

We may update this policy when our practices or the law change. The latest version will always be on this page, with its “last updated” date. If we make a significant change to how we use your personal data, we will tell you directly where we can, and ask for fresh consent where the law requires it.

16. Governing law and jurisdiction

This policy is governed by the laws of India. Subject to the powers of the Data Protection Board of India, the courts at Nahan, Himachal Pradesh, will have exclusive jurisdiction over any dispute arising from it.

17. Contact us

If you have any questions about this policy or your personal data, email contact@scaleseoai.com or message us on WhatsApp.