Privacy Policy

Scale Foundry Pty Ltd

ABN 97 702 730 201 · ACN 702 730 201

1. Overview

Scale Foundry Pty Ltd (Scale Foundry, we, us, our) handles personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). This policy explains how we collect, use, disclose and store personal information through our website, our online diagnostic tools and our client work.

We work business-to-business. Most of the information we hold is about people in their professional capacity: founders, executives and team members of the businesses we talk to or work with.

2. What we collect

We collect personal information that's reasonably necessary to engage with you and deliver our services, including:

• name, email address and phone number
• company name, company website, industry and your role
• information you submit through contact forms, enquiries, bookings or content downloads
• information you or your colleagues share in calls, meetings, interviews and workshops

Diagnostic data. When you complete our free Scale Readiness Snapshot or another online diagnostic tool, we collect your answers to the questionnaire along with the contact and company details you enter to receive your report. When you engage us for the paid diagnostic or other client work, we also collect the information needed to deliver it, which may include descriptions of your revenue processes, systems, team structure and performance, business metrics you choose to share, and material from documents, reports or systems you give us access to. This is mostly business information, but it can include personal information about you and your team (for example names, roles and views expressed in interviews).

Website and tool usage data. When you visit our website or use our diagnostic tools, we collect information about how you use them, such as pages and screens viewed, clicks, scrolls, time spent, which step of a questionnaire you reached, the site or campaign that referred you, approximate location (city or region level), browser and device type. See Section 9.

We don't intentionally collect sensitive information (such as health information or political opinions), and we ask that you don't include it in your answers.

3. How we collect it

We collect information:

• directly from you, when you submit forms, use our diagnostic tools, make enquiries, book a call or sign up for updates
• during business interactions such as calls, meetings and diagnostic interviews
• from publicly available sources (for example your company website and public market information) when preparing diagnostics or research
• automatically, through cookies and analytics tools on our website and diagnostic tools (see Section 9)

Where practical, we collect information directly from you rather than from third parties.

4. How we use it

We use personal information to:

• respond to enquiries and arrange follow-ups
• run our diagnostic tools and produce diagnostic reports, scorecards and recommendations
• deliver advisory, design and implementation work
• understand how our website and tools are used, and improve them
• build and maintain our anonymised benchmarks (see below)
• send you your report and relevant business communications (see Section 8)

We only use personal information for purposes you'd reasonably expect in a business-to-business context, or with your consent.

Anonymised benchmarks. Your diagnostic answers are kept private. We also use them, anonymised and combined with answers from other businesses, to build and refine industry benchmarks and to improve our frameworks and scoring. Before answers go into a benchmark we remove your name, email address, company name and website and anything else that identifies you or your business. Benchmark results are only ever reported in aggregate, and nothing we share or publish from them identifies you, your colleagues or your business. If you'd prefer your answers weren't included, email hello@scalefoundry.com.au and we'll exclude them from future benchmark updates.

Client materials. You're responsible for having the right to share any documents, reports, recordings or other information you give us. We assume you have the authority to share it with us so we can deliver our services. Please don't include personal information about your own customers unless we've asked for it and you're entitled to share it.

5. AI tools and your data

Our work is human-led and AI-augmented. We use third-party AI services to help process diagnostic inputs, research publicly available information about your market, structure analysis and draft working documents. Where your information is processed by AI tools:

• We use commercial services under terms that limit the provider's use of the data to providing the service to us.
• We use AI providers whose commercial terms provide that customer data isn't used to train their models. We won't use your information to train AI models available to others without your prior written consent.
• Some AI providers store or process data outside Australia (see Section 6).
• Substantive outputs are reviewed by one of us before they're relied on or delivered.

6. Who we share it with, and where it's stored

We don't sell personal information.

We share information with service providers who help us run the business, only to the extent they need it to provide their service to us:

Type of provider

What they do for us

Where data may be stored or processed

Cloud software and data storage

Email, documents, diagnostic form processing and storage

United States and other countries where the provider operates

Website analytics (Google Analytics 4)

Understanding how our website and tools are used

United States and other countries where Google operates

Session recording (Microsoft Clarity)

Recordings and heatmaps of our website and diagnostic tools

United States and other countries where Microsoft operates

Email service provider

Sending your report and our emails, managing our mailing list

European Union

AI services

Diagnostic analysis and research

United States

Hosting and report generation

Hosting our website and tools, generating reports

United States and Singapore

We may also share information with professional advisers (lawyers, accountants, insurers) where reasonably required, and with authorities where required by law.

Overseas disclosure. Because of the providers above, your information is likely to be stored or processed outside Australia, mainly in the United States, the European Union and Singapore. Where information goes overseas, we take reasonable steps to make sure it's handled consistently with the Australian Privacy Principles, including by using reputable providers under contractual protections.

7. Data security and data breaches

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. This includes using reputable platforms, restricting access to the people who need it, multi-factor authentication and standard security practices. No system is completely secure, and we can't guarantee the security of information sent to or from our systems.

Notifiable Data Breaches scheme. If a data breach occurs that's likely to result in serious harm to anyone, we'll assess it and, where required by the Privacy Act 1988 (Cth), notify the people affected and the Office of the Australian Information Commissioner (OAIC).

8. Emails from us

We use an email service provider to send email. When you complete the Scale Readiness Snapshot or another diagnostic tool, we'll email you your report and a short follow-up about your results. We may also send relevant business communications, such as insights and service updates, where you've agreed to receive them or would reasonably expect them.

Our email service provider holds your name, email address, company name and high-level details of your result (such as your overall score) so we can send these emails. It doesn't hold your questionnaire answers. It may also record whether an email was delivered, opened or clicked, which helps us understand what's useful.

You can unsubscribe at any time using the link in any email, or by emailing hello@scalefoundry.com.au. Unsubscribing from marketing emails won't stop us sending you something you've specifically asked for, such as a report you've just requested.

9. Cookies, analytics and session recordings

Our website and diagnostic tools use cookies and similar technologies. Cookies are small files stored by your browser.

Google Analytics 4. We use Google Analytics 4 across our website and our diagnostic tools to understand how people find and use them, for example how many people start the diagnostic, where they drop off and which pages or campaigns brought them to us. Google Analytics uses cookies (such as _ga) to recognise your browser across visits and across our website and diagnostic tool, which run on different subdomains. It collects information such as pages and steps viewed, time spent, referring site or campaign, approximate location and device type. We look at this information in aggregate and don't use it to identify you. Google's use of this data is covered by Google's own privacy policy. You can opt out using the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Microsoft Clarity session recordings. We partner with Microsoft Clarity to see how people use our website and diagnostic tools, through behavioural metrics, heatmaps and session recordings. A session recording is a replay of how you moved through the page: your clicks, taps, scrolling and the screens you saw. We use it to find and fix the parts of our website and tools that are confusing or broken. Clarity is set up to mask what you type, so your name, email address, phone number, company, website, message and other typed text aren't captured in recordings. Clarity uses first- and third-party cookies (such as clck and clsk) and similar technologies. Microsoft also uses data collected through Clarity for site optimisation, fraud and security purposes and advertising, as described in the Microsoft Privacy Statement at privacy.microsoft.com. Recordings are kept for a limited period under Microsoft's standard retention settings.

Managing cookies. You can block or delete cookies in your browser settings, and use tools such as browser tracking protection or content blockers to stop analytics and recordings from loading. Blocking these won't stop the diagnostic tools from working.

10. How long we keep it

We keep personal information only as long as it's reasonably needed for business or legal purposes:

• Enquiry and mailing list data: until you unsubscribe, or the information is no longer current or useful
• Diagnostic answers and client engagement records: for the period we need them to deliver and support our work with you, and generally up to seven years afterwards, or longer where the law requires, consistent with tax, accounting and professional record-keeping obligations
• Analytics data and session recordings: for the retention periods set in Google Analytics and Microsoft Clarity
• Anonymised benchmark data: kept indefinitely, because it no longer identifies anyone

When personal information is no longer needed, we take reasonable steps to delete or de-identify it.

11. Access, correction and complaints

You can ask to access or correct the personal information we hold about you, or ask us to delete your diagnostic answers, by emailing hello@scalefoundry.com.au. We'll respond within a reasonable time (usually 30 days), subject to any legal limits.

If you have a privacy complaint, contact us first and we'll investigate and respond. If you're not satisfied with our response, you can complain to the OAIC at www.oaic.gov.au.

12. Changes to this policy

We may update this policy from time to time. The latest version will always be on our website, with the "last updated" date shown at the top.

13. Contact

For privacy enquiries, please contact:

Privacy Officer Scale Foundry Pty Ltd hello@scalefoundry.com.au