2. Children’s Online Privacy Protection Act (“COPPA”)
   
   

Our Services are not designed for children under 13, and we do not intentionally or knowingly collect Personal Information from users who are under the age of 13 or from other websites or services directed at children. If we discover that a child under 13 has provided us with Personal Information, we will delete such information. 

3. Information You Provide to Us
   
   
• We collect Personal Information from you listed in Section 1 above.
• If you provide us feedback or contact us via email, we may collect your name, if stated, and email address, as well as any other content included in the email, in order to send you a reply.
• When you participate in one of our surveys, we may collect additional information that you knowingly provide. 
• We will maintain the information you send via email in accordance with applicable federal law.
• In compliance with the CAN-SPAM Act, all emails sent from our organization will clearly state who the email is from and provide clear information on how to contact the sender. In addition, all email messages will also contain concise information on how to remove yourself from our mailing list so that you receive no further e-mail communication from us. 
  
  
4. Collected via Technology
   
   
• To operate, secure, and improve the Services, Smallscale collects limited technical and usage information when users access or use the platform. This information may include: Browser type and version, device type and operating system, IP address and general location (city/state level only), login activity, timestamps, and session duration and/or pages or features accessed within the Services
• We collect this information using technologies necessary to provide the Services, including authentication tokens (such as JSON Web Tokens) and standard server logs. This information is used for platform functionality, security, troubleshooting, and performance optimization.
• Smallscale uses Google Analytics to understand aggregate usage patterns and improve the Services, and Sentry to monitor application errors and system performance. These tools may process technical identifiers such as IP address, timestamps, and interaction data in accordance with their respective privacy policies.
• Smallscale does not use cookies or tracking technologies for behavioral advertising, cross-site tracking, or marketing purposes. We do not use social media pixels, ad networks, or third-party advertising cookies, and we do not permit third parties to track users across other websites or services through the Smallscale platform.
  
  
5. Information We Do Not Collect
   
   

Smallscale does not intentionally collect:

• Government-issued identification numbers (e.g., Social Security numbers)
• Financial account or payment card information
• Biometric data
• Health or medical information
• Precise geolocation data 
• Personal information from children under 13
  
  

6. Use of Your Personal Information
   
   

In general, Personal Information you submit to us is used either to respond to requests that you make, or to aid us in serving you better. We use your Personal Information in the following ways: 

• to create, maintain, and secure user accounts and authenticate access to the Services;
• to send you Services as you requested;
• to identify users within the platform and associate users with their business or organization;
• to enable the creation, management, and display of business profiles;
• to support search, discovery, matching, and recommendation features based on user-provided business information and stated interests;
• to facilitate connections and communications between users through platform features;
• to administer partner-led programs, cohorts, or initiatives, including reviewing applications, tracking participation, and managing communications;
• to provide customer support and respond to inquiries or requests;
• to send administrative or service-related communications, such as security alerts, technical notices, or support messages;
• to monitor, secure, troubleshoot, and improve the performance, reliability, and functionality of the Services;
• to generate aggregated and/or de-identified analytics, reporting, and insights to improve the Services and measure program outcomes; 
• to comply with legal obligations, as part of our general business operations, and for other business administration purposes;
• to generate analytics, dashboards, and reports regarding platform usage, business participation, and program outcomes, which may be made available to authorized platform users, partners, sponsors, or program administrators in connection with the operations of the Services; and
• in very limited circumstances where we believe necessary to investigate, prevent or act regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or violations of this Privacy Notice.
  
  

Certain information contained in business profiles or program participation records may be visible to other authorized users of the platform as part of the platform’s discovery, networking, or program administration features. Users should only include information in their profiles that they are comfortable sharing within the platform. Smallscale does not use Personal Information to make automated eligibility, credit, employment, or legal decisions.

7. Use of Non-Personal Information
   
   

In general, we use Non-Personal Information to help us improve the Services and customize the user experience. We also aggregate Non-Personal Information in order to track trends and analyze use patterns on the Services. This Privacy Notice does not limit in any way our use or disclosure of Non-Personal Information and we reserve the right to use and disclose such Non-Personal Information for internal analytics, reporting and service improvement purposes.

8. How We Share Your Personal Information
   
   

As a general rule, we do not sell, rent, lease or otherwise transfer any information collected either automatically or through your voluntary action. We may disclose your Personal Information as described below and as described elsewhere in this Privacy Notice. 

• Third Party Service Providers. We may share your Personal Information with third party service providers to provide you with the Services that we offer you; to conduct quality assurance testing; to perform marketing; to run data analysis; to facilitate creation of accounts; to provide technical support; and/or to provide future services to you.  We share information with trusted third-party service providers that help us operate the Services, including: 
• Amazon Web Services (AWS): cloud hosting and data storage
• Auth0: user authentication and access management
• SendGrid: transactional email delivery 
• Sentry: error monitoring and performance diagnostics
• Google Maps: location lookup and mapping functionality
• Github: source code management, version control and collaboration among authorized personnel
• LastPass: manage and store access credentials for internal systems and third-party services
• Jira:  internal project management, and workflow coordination
• Figma:  product design, prototyping and collaboration on user interface 
• Apple: provides operating system, development tools and app distribution infrastructure
• Active Campaign: used for limited communications and contact management
• Quickbooks: internal accounting, financial recordkeeping and business operations
  
  

These providers process information solely on our behalf and pursuant to contractual obligations.

• Integrations and Third-Party Services. We integrate third-party Application Programming Interface (“API”) in connection with the Services that we offer you.  The information collected by Smallscale when using the API, is processed in compliance with this Privacy Notice. Information collected by third-party API partners is governed by their privacy policies and Smallscale does not own or control those third parties. In certain cases, Smallscale may provide authorized partners, program administrators, or clients with access to certain platform data through reporting tools, dashboards, or application programming interfaces (APIs). Such access is limited to information necessary to administer programs, provide platform functionality, or generate analytics and insights related to platform participation.

• Business Transfers. If (i) Smallscale is acquired by, merges with, or receives investment from another company or (ii) if any of the Smallscale’s assets are or may be transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, we may transfer the information we have collected from you to the other company. As part of the business transfer process, we may share certain of your Personal Information with lenders, auditors, attorneys and consultants.

• Other Disclosures. Regardless of any choices you make regarding your Personal Information (as described below), we may disclose Personal Information if it believes in good faith that such disclosure is necessary (a) in connection with any legal investigation; (b) to comply with relevant laws or to respond to subpoenas or warrants served on us; (c) to protect or defend our rights or property, or the rights or property of users of the Services; (d) to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person and/or (e) to investigate or assist in preventing any violation or potential violation of the law, this Privacy Notice, or any agreements you may have with us, as applicable.

9. Links to Third Party Websites and Third Party Providers
   
   

As part of the Services, we may provide links to or compatibility with other websites or applications; however, we are not responsible for the privacy practices employed by those websites or the information or content they contain nor are we liable for third party products, services, acts and/or omissions. This Privacy Notice applies solely to information collected by us in relation to the Services and your use of the Services. Therefore, this Privacy Notice does not apply to your use of a third-party website accessed by selecting a link on our Site or App or via the Services. To the extent that you access or use the Services through or on another website or application, then the privacy policy of that other website or application will apply to such access and/or use. We encourage our users to read the privacy statements of other websites before proceeding to use them. 

10. Service Communications
    
    

Smallscale may send administrative or service-related communications, such as account notices, security alerts, or updates related to the Services. Users cannot opt out of service-related communications while maintaining an active account.

11. Your Rights and Choices

If applicable privacy laws allow, you may have rights over your Personal Information.  This includes, but is not limited to:

• Right to Know. You have the right to request disclosure about our Personal Information collection practices during the prior 12 months, including the categories of Personal Information we collected, the sources of the information, our business purposes for collecting or sharing the information and the categories of third parties with whom we shared such information. You may request a copy of the specific pieces of Personal Information we may have collected about you in the last 12 months.
• Right to Delete.  You may request that we delete (and direct our service providers to delete) your Personal Information, subject to certain exceptions.
• Right to Opt-Out.  You have the right to opt-out of any ‘sales’ of your Personal Information, if a business is selling your information. For clarity, we do not sell your Personal Information. 
• Non-Discrimination. You have the right to not be discriminated against for exercising these rights.

You can make the following choices regarding your Personal Information:

1. Access To Your Personal Information. You may request access to your Personal Information by contacting us at the address below. If required by law, upon request, we will grant you reasonable access to the Personal Information that we have about you.  We will provide this information in a portable format, if required.  Note that California residents may be entitled to ask us for a notice describing what categories of Personal Information (if any) we share with third parties or affiliates for direct marketing.  
2. Changes To Your Personal Information. We rely on you to update and correct your Personal Information. Please contact us at the address below immediately if there are any changes to your Personal Information. Note that we may keep historical information in our backup files as permitted by law.  
3. Deletion Of Your Personal Information.  Typically, we retain your Personal Information for the period necessary to fulfill the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law, or as otherwise described in this Privacy Notice. You may, however, request information about how long we keep a specific type of information, or request that we delete your Personal Information by contacting us at the address below. If required by law we will grant a request to delete information, but you should note that in many situations we must keep your Personal Information to comply with our legal obligations, resolve disputes, enforce our agreements, or for another one of our business purposes.  
   
   

If you decide to delete your in-App account, you may do so by selecting “Delete My Account” on your profile page. Deleting your Smallscale’s account in-App will:

• Sign you out immediately
• Remove or anonymize any identifiable user information
• Remove your email from our mailing lists.

You will receive an email when account deletion is completed.

4. Objection to Certain Processing.  You may object to our use or disclosure of your Personal Information by contacting us at the address below.  
5. Online Tracking.  We do not currently recognize automated browser signals regarding tracking mechanisms, which may include ‘Do Not Track’ instructions. 
6. Promotional Emails. You may choose to provide us with your email address for the purpose of allowing us to send free newsletters, surveys, offers, and other promotional materials to you, as well as targeted offers from third parties.  You can stop receiving promotional emails by following the unsubscribe instructions in e-mails that you receive.  If you decide not to receive promotional emails, we may  still send you communications related to your use of the Services and administrative purposes for reasons such as providing you with updates to this Privacy Notice.
7. Revocation Of Consent.  If you revoke your consent for the processing of Personal Information, then we may no longer be able to provide you Services. In some cases, we may limit or deny your request to revoke consent if the law permits or requires us to do so, or if we are unable to adequately verify your identity. You may revoke consent to processing (where such processing is based upon consent) by contacting us at the address below.
8. How to Exercise your Right(s). You may enquire about your Personal Information by contacting us as described below in Section 17 below, and we’ll generally respond to all access requests within 30 days of the receipt of all necessary information. As required by law, we will require you to prove your identity before providing you with the Personal Information we hold about you.  We may verify your identity by phone call or email. Depending on your request, we will ask for information such as your name or other account information. We may also ask you to provide a signed declaration confirming your identity. Following a request, we will use reasonable efforts to supply, correct or delete Personal Information about you in our files. In circumstances where we are not able to provide access, or if additional time is required to fulfill a request, we will advise you in writing.
   
   

In some circumstances, you may designate an authorized agent to submit requests to exercise certain privacy rights on your behalf.  We will require verification that you provided the authorized agent permission to make a request on your behalf.  You must provide us with a copy of the signed permission you have given to the authorized agent to submit the request on your behalf and verify your own identity directly with us.  If you are an authorized agent submitting a request on behalf of an individual you must attach a copy of the following information to the request:

• A completed written notice indicating that you have authorization to act on the consumer’s behalf signed by you and the consumer.
• If you are a business, proof that you are registered with the appropriate Secretary of State to conduct business in that state.
  
  

If we do not receive this information, the request will be denied.

Smallscale may not release certain types of information based upon exemptions specified in applicable laws. Where possible, we will sever the information that will not be disclosed and provide you with access to the remaining information. Should we be unable to provide access to or disclose Personal Information to you, we will provide you with an explanation, subject to restrictions.

In certain circumstances, such as where the request is excessive or unfounded, we may charge you an administration fee for access to your Personal Information. We may also charge for additional copies. We will advise you of any fees before proceeding with a request. You may learn more about the process or obtain assistance in completing an access request by contacting us as described below.

12. Security of Your Personal Information and Personal Data

We implement security measures designed to protect your information from unauthorized access, alteration, disclosure and/or destruction. Because the internet is not a completely secure environment, we cannot warrant the security of any information a user transmits to us or guarantee that information on the Services may not be accessed, disclosed, altered, and/or destroyed by breach of any of our physical, technical and/or managerial safeguards.  Any account you have on our Site or App is protected by your account password and we urge you to take steps to keep your Personal Information safe by not disclosing your password and by logging out of your account after each use. We further protect your information from potential security breaches by implementing certain technological security measures; however, these measures do not guarantee that your information will not be accessed, disclosed, altered or destroyed by breach of such firewalls and secure server software. While we use reasonable efforts to protect your Personal Information, we cannot guarantee the Services are absolutely secure. 

13. How we Retain Your Personal Information

We will retain your Personal Information for as long as your account remains active or as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. The precise periods for which we keep your Personal Information vary depending on the nature of the information and why we need it. To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use and/or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal requirements.  

In some circumstances we may anonymize your Personal Information (so that it can no longer be associated with a user) for research or statistical purposes in which case we may use this information indefinitely without further notice.  We may retain information (including without limitation your personally identifiable information) for a commercially reasonable time for backup, archival, audit purposes, and/or to comply with legal obligations, resolve disputes and enforce agreements. In some cases, if you choose not to provide us with requested information, you may not be able to use the Services. You can request further details of retention periods for different aspects of your Personal Information by contacting us. 

Please note that in the course of providing the Services, we collect and maintain aggregated, anonymized, or de-personalized information which we may retain indefinitely.

14. Accessibility
    
    

If you are visually impaired, you may access this Privacy Notice through your browser’s audio reader.

15. Changes to This Privacy Notice
    
    

We reserve the right to change this Privacy Notice or any agreement you entered into with Smallscale from time to time. We may notify you of significant changes to this Privacy Notice by sending a notice to the primary email address specified by you or by placing a prominent notice on the Site and/or App.  Significant changes will go into effect thirty (30) days following such notification. Non-material changes or clarifications will take effect immediately. The last updated date refers to the date that the current Privacy Notice was last substantively modified.

You should periodically check the Site and/or App and this Privacy Notice for updates.

16. Other Jurisdictions

Smallscale is located in the United States. The Services are hosted in, provided from the United States, and intended for those that reside in the United States.  Personal information that you submit through the Services may be transferred outside of the jurisdiction in which you live.  Your Personal Information may be transferred to other jurisdictions that do not have the same data protection laws as the jurisdiction in which you initially provided the information. The following provisions may apply to you depending on where you are located.

Nevada.  

This notice is provided to you pursuant to state law. Nevada state privacy laws permit us to make marketing calls to existing users, but if you prefer not to receive marketing calls, you may be placed on our internal opt-out list by emailing us at hello@smallscale.app or you may also contact the Nevada Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E. Washington St., Ste 3900, Las Vegas, NV 89101; telephone 702-486-3132; email: AGCinfo@ag.nv.gov. We do not make marketing calls to existing users.

Texas.  If you have a complaint, first contact us by visiting our Site or through our App. If you still have an unresolved complaint regarding the company’s money transmission or currency exchange activity, please direct your complaint to the Texas Department of Banking: 2601 North Lamar Boulevard, Austin, TX 78705-4294; 1-877-276-5554 (toll free); www.dob.texas.gov.
 

Vermont. 

In accordance with Vermont law, we will not share information we collect about you with companies outside of Smallscale except as described herein, or otherwise required or permitted by law. 

Virginia. 

This Section is only applicable to you if you are a resident of the state of Virginia (“Virginia Residents”).  If you have a complaint, first contact us at hello@smallscale.app.  We will respond within 45 days after receipt of your request, and such time may be extended for an additional 45 days if it is reasonably necessary.  We will notify you of any extension within the initial 45-day period. If you are not satisfied with our responses, you have the right to appeal.  We will respond within 60 days of receipt of your appeal.  If you still have an unresolved complaint, please direct your complaint to the Virginia Attorney General at service@oag.state.va.us or call (804)786-2071. 

California. 

At this time, California Privacy laws (California Consumer Privacy Act, California Privacy Rights Act) do not apply to us, but we will still protect your Personal Information as outlined in this Privacy Notice. If you feel this is incorrect, please contact us at hello@smallscale.app. 

17. Contact Information

If you have any questions, comments, or complaints concerning our privacy practices, please contact us by sending an email to hello@smallscale.app or send correspondence via mail to:

Smallscale
17 E Monroe St, Suite 232
Chicago, IL 60603
hello@smallscale.app

We will attempt to respond to your request and to provide you with additional privacy-related information.