Last updated
This notice covers the Scale Rule Agent Platform: software with two assistants. The Enquiries assistant watches a business's email inbox and drafts replies to new enquiries. The Socials assistant drafts posts for a business's Facebook Page and Instagram account and shows how they performed. Both wait for a person at that business to approve each draft before anything is sent or posted. It does not cover this website, which has its own privacy notice.
Like the website notice, it is written in plain English and is specific about the things most notices leave vague.
Who is responsible
Scale Rule Consultancy Limited, a company registered in England and Wales, company number 17406773, registered office 26 Brook Road, Horsham, West Sussex RH12 5FY. The company trades as Scale Rule Consulting.
For anything in this notice, email hello@scaleruleconsulting.com.
Two kinds of people are involved, and the roles differ.
- The business that uses the platform (the client) decides what the platform is for and whose email and social accounts it handles. For the emails, contacts, enquiries and social media content that pass through it, the client is the data controller and Scale Rule is its processor, acting only on the client's written instructions under a data processing agreement.
- The people who email that business or interact with its social media (the client's customers and enquirers) have their messages read by the platform on the client's behalf. If you are one of them, the client is the right first contact for your rights, and I will help them answer you.
Nothing is sent or posted without approval
Every outgoing email and every social post is held as a draft, shown to a named approver at the client, and sent or posted only when they click approve. A rejected or ignored draft is never sent or posted.
What the platform reads from Google, and why
When a client connects a Gmail account, Google asks them to allow the following. Each one is there for a single, stated reason.
| Permission | What it lets the platform do | Why it is needed |
|---|---|---|
| Read email (Gmail) | Read new messages arriving in the connected inbox, including sender, subject and body | To spot a new enquiry and understand what the person is asking for, so a reply can be drafted |
| Send email (Gmail) | Send a reply from the connected account | To send a reply only after a named person at the client has approved it |
| Change labels (Gmail) | Mark a message as handled | So the same enquiry is not picked up twice |
| Calendar availability | See free and busy times, and add a booked meeting | Only where the client has switched meeting booking on: to offer real meeting times in a reply, and book one when the enquirer accepts |
| Your basic profile | Your name and email address | To know which account is connected and who approved what |
How information from Google is used, and the limits on it
The Scale Rule Agent Platform's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements. In plain terms:
- Gmail data is used only to provide the features described above to the client who connected the account.
- It is not used for advertising, not sold, and not passed to anyone except the processors listed below, who need it to run the service.
- It is not used to train, develop or improve general-purpose artificial intelligence or machine learning models, Scale Rule's or anyone else's.
- No person at Scale Rule reads a client's email, except where the client asks me to (for example to look into a fault), where it is needed for security, or where the law requires it.
What the platform reads from Facebook and Instagram, and why
When a client connects a Facebook Page, and the Instagram professional account linked to it, Facebook asks them to allow the following. Each one is there for a single, stated reason. The platform asks for nothing else.
| Permission | What it lets the platform do | Why it is needed |
|---|---|---|
| pages_show_list | See the list of Facebook Pages the person manages | So the client can choose which Page to connect |
| pages_read_engagement | Read the connected Page's name, details and existing posts | To match the style of new drafts to what the Page already posts, and to show which posts have gone out |
| pages_manage_posts | Publish a post to the connected Page | To publish a post only after a named person at the client has approved it |
| read_insights | Read performance figures for the Page and its posts, such as reach and reactions | To show the client how each approved post performed |
| instagram_basic | Read the linked Instagram account's name, profile and existing posts | So the client can confirm the right account, and to show which posts have gone out |
| instagram_content_publish | Publish a post to the linked Instagram account | To publish a post only after a named person at the client has approved it |
| instagram_manage_insights | Read performance figures for the Instagram account and its posts | To show the client how each approved post performed |
| public_profile | The name of the person who connects the Page | To know who connected it and who approved what |
The platform does not read private messages, does not read or reply to comments, and does not run adverts.
How information from Meta is used, and the limits on it
- Facebook and Instagram data is used only to provide the features described above to the client who connected the account.
- It is not used for advertising, not sold, and not passed to anyone except the processors listed below, who need it to run the service.
- It is not used to train, develop or improve general-purpose artificial intelligence or machine learning models, Scale Rule's or anyone else's.
- No person at Scale Rule looks at a client's Page or Instagram data, except where the client asks me to, where it is needed for security, or where the law requires it.
What the platform keeps
- Connection details: secure access tokens from Google and Meta, so the platform can keep working without asking the client to sign in every time. They are stored encrypted.
- Enquiries it has picked up: the sender's name and email address, the message, and the platform's assessment of what the person wants.
- Social content: draft posts, the posts that were published, and their performance figures.
- Drafts and approvals: each draft reply or post, who approved or rejected it, and when.
- An audit trail: a record of every action the platform took, which cannot be edited afterwards. This exists so the client can always see exactly what was sent or posted in their name.
Each client's data is kept separate from every other client's at the database level, so one client can never see another's.
Where it is held, and who else sees it
The platform's servers and database run on Google Cloud in London, United Kingdom, so the data it keeps is stored in the UK. The platform uses these processors.
- Google Cloud, runs the platform's servers and database. London, United Kingdom.
- Anthropic, PBC, provides the Claude AI model, which reads the text of an enquiry to classify it and draft a reply, and drafts social posts. Under Anthropic's commercial terms, it does not train its models on this data. United States.
- Google, provides Gmail, Calendar and the push notification that tells the platform a new email has arrived. United States.
- Meta Platforms Ireland Limited, provides Facebook and Instagram, publishes approved posts and returns their performance figures. Ireland and United States.
- Resend, sends the approval-request email to the client's approver. United States.
- Slack, delivers approval requests, only where the client already uses Slack and asks for approvals to go there. United States.
- HubSpot or Google Sheets, only where the client has asked for enquiries to be logged in their own CRM or spreadsheet. United States.
Where data goes outside the UK, it is protected by UK adequacy regulations where they apply, or otherwise by the standard contractual clauses with the UK addendum, set out in each processor's data processing agreement.
How long it is kept
- Enquiry messages and drafted replies: 90 days after the enquiry is dealt with.
- Social content (drafts, published posts and their performance figures): 90 days after the post is published or the draft is rejected. This is the platform's copy only; a published post stays on Facebook or Instagram until the client removes it there.
- The audit trail: 6 years, the normal period for business records, because it is the client's proof of what was sent or posted in their name and who approved it.
- Google and Meta access tokens: deleted as soon as the client disconnects, or within 30 days of the contract ending.
- Everything else for a client: deleted within 30 days of the contract ending, unless the client asks for a copy first.
Switching it off
A client can disconnect any account at any time. Disconnecting deletes the access the platform held.
- Any account: tell me, and I will disconnect and delete the access token straight away.
- Gmail: directly in the Google account, at myaccount.google.com/permissions (opens in a new tab), which stops the platform reading anything immediately.
- Facebook and Instagram: directly in Facebook, under Settings and privacy, then Settings, then Business integrations, by removing Scale Rule Agent Platform. This stops the platform reading or posting anything immediately.
Deleting your data
To have the data the platform holds about you or your business deleted, email hello@scaleruleconsulting.com with the subject "Delete my data" and the account or Page it relates to. I will confirm the request within 5 business days and delete the data within 30 days, then confirm in writing that it is done.
When a client removes the platform in Facebook, Meta tells the platform, which then deletes that account's access token and the social content it holds. The audit trail is kept for 6 years as described above, because it is the client's legal record of what was posted in their name.
Your rights
You can ask to see, correct, delete or restrict what is held about you, to receive it in a portable format, or to object. If you emailed or interacted with a business that uses the platform, contact that business first, as they decide how your information is handled; I will help them answer. You can also email hello@scaleruleconsulting.com and I will pass your request on and support it.
If you are not happy, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes to this notice
When it changes, the date changes with it, and if the change is material I will say what changed rather than quietly reissue it.