ScaleUpAI Workspace

Privacy, in plain English.

We use information only to provide, secure and improve the services our customers choose. This notice explains what we hold, why we hold it and the controls available to you.

Last updated: 11 August 2026

Who is responsible

ScaleUpAI Workspace (“ScaleUpAI”, “we”, “us”) is responsible for the personal information described in this notice. Questions or rights requests can be sent to bill@scaleupai.co.uk.

Information we may hold

  • Names, business contact details, account details and security records.
  • Business, application and supporting information supplied through an enabled Workspace service.
  • Approved business knowledge, strategy, plans, posts, publishing choices and performance information used within the Social Media Workspace.
  • Technical and audit information needed to protect accounts, investigate faults and retain a reliable record of important actions.
  • Social-platform identifiers and encrypted authorisation tokens when a customer chooses to connect an account.

We do not intentionally request special-category information unless it is genuinely required, lawful and agreed for a particular service.

Why we use information

We use information to provide the contracted Workspace service, manage approvals and information flow, secure accounts and documents, keep audit records, support customers, meet legal duties and improve the reliability of the service.

Our lawful bases will normally be performance of a contract, compliance with legal obligations and our legitimate interests in operating and protecting the service. Where consent is the appropriate basis, it can be withdrawn.

LinkedIn and other connected platforms

We will

  • Send you to the platform’s own secure authorisation screen.
  • Request only the permissions needed for the service you have chosen.
  • Encrypt the authorisation token and restrict its use to the correct customer Workspace.
  • Publish only content that has completed the agreed approval process.
  • Record connection, approval and publishing activity so it can be checked.
  • Allow the connection to be revoked.

We will never

  • Ask for or store your LinkedIn or social-media password.
  • Change your password, email address, account ownership or security settings.
  • Lock you out of your account or transfer ownership of your Page.
  • Spend advertising money without a separate, clear approval.
  • Publish an unapproved draft.

LinkedIn and any other connected platform process information under their own privacy terms. Disconnecting in ScaleUpAI stops future use by the Workspace; you can also revoke access directly within the platform.

AI-assisted work

AI assistance is used only within the controls shown in the relevant Workspace. For social-media drafting, only the exact public-safe brief approved for that purpose may leave the Workspace. Confidential strategy, finance information, documents, personal information and passwords must not be included in that brief. AI output remains a draft until it completes the approval process.

Who may process information

We use carefully selected hosting, private storage, security scanning, AI and connected-platform providers where needed to deliver the service. This currently includes Laravel Cloud, Amazon Web Services, OpenAI and LinkedIn. They may process information only for the relevant service and subject to their contractual and security controls.

Where a supplier processes information outside the UK, we use the safeguards made available under applicable UK data-protection law and the supplier’s contractual terms.

Security and retention

We use access controls, mandatory multi-factor authentication for privileged accounts, encrypted connections and cookies, private object storage, malware scanning, tenant separation, session controls and security audit records.

Customer application and content records are retained for the period agreed for the service, with operational retention set no longer than 90 days unless a contract or legal duty requires otherwise. Connected-platform tokens are removed when the connection is revoked or no longer required. Security, billing and audit records may be retained longer where necessary to meet legal, contractual or security obligations.

Your choices and rights

You may have rights to access, correct, erase, restrict or receive your personal information, and to object to certain uses. You may withdraw consent where processing relies on consent.

You have the right to object to the use of your personal information for direct marketing at any time.

Contact bill@scaleupai.co.uk. We may need to confirm your identity before acting. You may also complain to the Information Commissioner’s Office.

Changes to this notice

We will update this page when our services, suppliers or legal responsibilities materially change. The latest revision date will always appear at the top.