Privacy Policy
Last updated: 20 October 2026
This Privacy Policy explains how ScaleGram CRM ("we", "us", "the Service") collects, uses, stores and protects the personal data of users and of the people whose information you manage in the Service. By using ScaleGram CRM you agree to this policy.
1. Who we are
ScaleGram CRM is a customer-relationship platform for trading affiliates that centralizes Telegram conversations, an affiliate pipeline and commissions. The data controller is Johann Dufaud (see the legal notice). For any privacy question you can contact us at [email protected].
2. Data we collect
- Account data: name, email address, password (hashed), workspace and team information, and two-factor authentication settings.
- Telegram data: when you connect your Telegram account, we access and store the conversations, contacts, messages and media required to display your inbox inside the Service. We act on your behalf, using your own Telegram session.
- Lead and CRM data: the contacts, leads, deposits, tags, notes, pipeline stages and other records you create or import.
- Usage and technical data: log data, IP address, browser type, and actions taken in the app (activity log).
- Cookies / local storage: we use browser local storage and authentication tokens to keep you signed in and remember your preference (language). We do not use third-party advertising cookies on this Service.
- Ad tracking data (optional feature): when you turn on tracking for a campaign, each click on your tracked links records the ad click identifiers (e.g. fbclid, ttclid, gclid), campaign parameters, IP address, browser, device and country, and the Telegram identifier of the person who then joins your channel, starts your bot or writes to you through that link. On landing pages, a first-party cookie keeps the ad parameters until the visitor presses the button.
3. How we use your data
- To provide, operate and secure the Service (authentication, real-time messaging, pipeline, analytics).
- To sync your Telegram conversations and keep your CRM up to date.
- To send service-related communications (e.g. team invitations, security notices).
- To improve reliability, prevent abuse and comply with our legal obligations.
4. Legal basis
We process personal data on the basis of the performance of our contract with you, your consent (for example when you connect Telegram), our legitimate interest in operating and securing the Service, and our legal obligations.
5. Sharing and service providers
We do not sell your personal data. We entrust it only to the providers that help us run the Service, and only as needed:
- DigitalOcean: hosting of the application and database, storage of media and attachments (DigitalOcean Spaces).
- Cloudflare: delivery and protection of the website and the application, and activation of the custom domains you connect to your pages.
- Anthropic (Claude): AI reply assistance is provided by ScaleGram. When a member asks for a suggestion, or for a message to be improved or translated, the necessary part of the conversation is sent to Anthropic to produce the answer. If your workspace saves its own Anthropic key, the request uses that key.
- Resend: delivery of transactional emails (address verification, invitations, password resets, notifications).
- Stripe: payment of paid options. Card data is processed by Stripe; we do not store it.
- Google: sign-in with Google if you choose it, and Google Fonts loaded by the website and the application (your browser then sends its IP address to Google).
- Telegram: sending and receiving your messages, through your own session.
The following services receive data only if you turn them on yourself:
- Google Sheets: export of your leads to a sheet in your Google account.
- Broker integrations (e.g. CellXpert): the CRM queries your affiliate account with the key you provide.
- Webhooks: the events you choose are sent to the address you enter.
- Ad platforms you connect (Meta, Google Ads, TikTok, Snapchat or a URL of your choice): when ad tracking is on, the conversions you select (join, first message, registration, deposit) are sent to them with the click identifier, IP address, browser, and hashed (SHA-256) lead details such as email or phone. If you enter a Meta pixel on a landing page, that pixel is loaded on the page. You remain responsible for having a legal basis for this sharing with the people concerned.
6. International transfers
Some of our providers may process data outside your country. When that happens, we rely on appropriate safeguards such as standard contractual clauses.
7. Data retention
We keep your data for as long as your account is active and as needed to provide the Service. You can delete leads, messages and other records at any time. When you close your workspace, we delete or anonymize your personal data within a reasonable period, except where retention is required by law.
For ad tracking, the IP address of a click is erased after 30 days; the other click data is kept as long as your workspace exists.
8. Your rights
Depending on your location, you may have the right to access, correct, export or delete your personal data, to restrict or object to certain processing, and to withdraw consent (for example by disconnecting Telegram). To exercise these rights, contact [email protected]. You may also lodge a complaint with the data protection authority of your country (in France, the CNIL: www.cnil.fr).
9. Security
We use technical and organizational measures to protect your data, including hashed passwords, optional two-factor authentication, isolated per-workspace data and encrypted connections. No method of transmission or storage is 100% secure, but we work to protect your information.
10. Children
The Service is intended for professional use by adults and is not directed at children under 16.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email. Continued use after changes means you accept the updated policy.
12. Contact
Questions about this policy? Email us at [email protected].