SisuScale

Fractional CxO Community

Privacy policy

This policy explains what personal data SisuScale collects, why, who it is shared with, how long it is kept and what your rights are. It covers sisuscale.com, the SisuScale platform and the SisuPeople pages on the same site.

Last updated [Date of publication — to confirm]

Who we are

The data controller is [Data controller legal entity — to confirm], company number [Registered number — to confirm], registered office [Registered office address — to confirm]. We are registered with the Information Commissioner's Office (ICO) under [ICO registration number and data protection fee status — to confirm].

You can contact us about your personal data at [Privacy contact email — to confirm].

What personal data we collect and why

We collect only what the platform needs. For each kind of data below we say why we use it, our lawful basis under UK GDPR, who receives it and how long we keep it. Nylas, Resend, Mux, Neon and Vercel act as our service providers (processors) and may use the data only on our instructions.

  • Account details

    Your name, email address, phone number (required for experts, optional for buyers), password (stored only as a hash), whether you are a buyer, expert or admin, and for buyers whether an admin has approved you.

    Why we use it
    To create and run your account, let you sign in and contact you about it.
    Lawful basis
    Contract: we need it to provide the platform to you.
    Who receives it
    Neon (database), Vercel (hosting), Resend (email delivery).
    How long we keep it
    Until your account is deleted.

  • Sign-in sessions and password resets

    A session token, the IP address and browser details (user agent) of each sign-in, the session expiry, and the short-lived token in a password reset link.

    Why we use it
    To keep you signed in and to protect accounts from misuse.
    Lawful basis
    Legitimate interests: keeping the platform and your account secure.
    Who receives it
    Neon, Vercel.
    How long we keep it
    A session lasts 7 days and is extended while you are active. Our code does not yet remove expired session or reset records on a schedule, so they stay until your account is deleted. [Decision needed: purge expired sessions and reset tokens after how long?]

  • Expert sign-up details

    The LinkedIn profile address and the private application note an expert gives when they sign up. Only admins can see them.

    Why we use it
    To decide whether to invite an expert onto the platform.
    Lawful basis
    Legitimate interests: vetting experts before they are shown to buyers, and steps at your request before a contract.
    Who receives it
    Neon, Vercel, Resend (the email that tells our admins a new expert has signed up).
    How long we keep it
    Until the account is deleted. [Decision needed: how long to keep the details of experts who are never published?]

  • Expert profile

    Headline, tagline and about text, the functions, focus areas and company stages an expert covers, day and hourly rates, whether they are VAT registered, weekly working hours and timezone, a profile photo, an intro video and documents such as a CV. The photo, text and intro video are public once the profile is published. Rates and documents are shown only to approved buyers, admins and the expert. A CV is never shown to buyers: an admin prepares a branded version and uploads it as a document.

    Why we use it
    To present the expert on the platform and let approved buyers decide whether to work with them.
    Lawful basis
    Contract.
    Who receives it
    Neon, Vercel (including Vercel Blob file storage), Mux (intro video).
    How long we keep it
    Until the expert removes it or their account is deleted. A replaced CV or intro video is removed from storage by our cleanup jobs.

  • Buyer profile

    A buyer's company name, short company description and funding stage.

    Why we use it
    To help experts understand who they are talking to.
    Lawful basis
    Contract.
    Who receives it
    Neon, Vercel.
    How long we keep it
    Until the account is deleted.

  • Messages

    The text of conversations between a buyer and an expert. Our admins can read conversations to oversee the platform. Notification emails say that a message arrived and never include its text.

    Why we use it
    To let buyers and experts talk, and to oversee activity on the platform.
    Lawful basis
    Contract, and legitimate interests in overseeing the platform and keeping it safe.
    Who receives it
    Neon, Vercel, Resend (the notification email only).
    How long we keep it
    A conversation is deleted when either person's account is deleted.

  • Engagements (Bookings)

    The dates, rate, description and status of a proposed or agreed engagement, any cancellation reason, and the commission and VAT figures that applied.

    Why we use it
    To arrange and run engagements, and to calculate what is owed.
    Lawful basis
    Contract, and legal obligation where we must keep financial records.
    Who receives it
    Neon, Vercel, Resend (status emails).
    How long we keep it
    A Booking is deleted when either person's account is deleted. [Decision needed: do invoicing or tax rules require us to keep financial records for longer after an account is deleted?]

  • Consultations

    The time of a free 30-minute call, what the buyer wants to discuss, its status, the video meeting link and a reference to the event in the expert's calendar.

    Why we use it
    To book the call, send invitations and reminders, and let either person cancel.
    Lawful basis
    Contract.
    Who receives it
    Neon, Vercel, Resend (invitation, reminder and cancellation emails with a calendar file), Nylas and the expert's Google or Microsoft calendar (see Google calendar data).
    How long we keep it
    A Consultation is deleted when either person's account is deleted. Past and cancelled Consultations are otherwise kept. [Decision needed: delete past Consultations after how long?]

  • Calendar connection (experts only)

    Which calendar provider an expert connected (Google or Microsoft), the email address of that calendar account, the Nylas reference for the connection (called a grant) and whether it is working. We do not store the expert's calendar contents or their Google or Microsoft passwords or tokens.

    Why we use it
    To read when the expert is busy so buyers are offered only free slots, and to put Consultations in the expert's calendar.
    Lawful basis
    Consent: an expert chooses to connect and can withdraw consent at any time with Disconnect.
    Who receives it
    Nylas (connection provider), Google or Microsoft, Neon, Vercel.
    How long we keep it
    Until the expert chooses Disconnect, which also revokes access at Nylas. Deleting an account removes our record of the connection. An expert can always remove SisuScale's access from their Google or Microsoft account settings.

  • Event responses

    Whether you said you are attending, maybe attending or not attending an event, with the time you responded. For people who attend, a calendar invitation sent by email.

    Why we use it
    To plan events and keep attendees' calendars up to date.
    Lawful basis
    Contract for members using the platform, and legitimate interests in running community events.
    Who receives it
    Neon, Vercel, Resend (invitations and updates).
    How long we keep it
    Until you change your response or your account is deleted. Responses to a deleted event are deleted with it.

  • Emails and delivery records

    Your email address and the content of emails we send you, plus a record of whether each notification email was sent or failed, and daily reminder records for unread messages.

    Why we use it
    To send account, message, booking, Consultation and event emails, and the reminder about unread activity.
    Lawful basis
    Contract for emails you need to use the platform, and legitimate interests for unread-activity reminders. We do not send marketing newsletters from the platform.
    Who receives it
    Resend (email delivery), Neon, Vercel.
    How long we keep it
    Delivery records are deleted with the message or booking they relate to. [To confirm: how long Resend keeps copies of sent emails.]

  • Partner offer requests

    When someone uses a partner offer page (for example FounderCatalyst or The Startup Foundry) to ask for a free consultation, the name, email address, company, website, LinkedIn address, funding stage, phone number, promo code and request they enter. If they ask for a SisuScale account at the same time, it becomes account details. The request is not saved in our database: it is emailed to our team.

    Why we use it
    To respond to your request and introduce you to a suitable expert.
    Lawful basis
    Steps at your request before entering a contract, and legitimate interests in running our partnerships.
    Who receives it
    Resend (the email to our team and the confirmation to you), and our team's mailbox.
    How long we keep it
    [Decision needed: how long are partner requests kept in the team mailbox?]

  • Website usage and performance

    Pages visited, referrer, rough location, device and browser type, and page speed measurements. See Cookies and analytics for what is switched on.

    Why we use it
    To understand how the site is used and to keep it fast and working.
    Lawful basis
    Legitimate interests for Vercel Web Analytics and Speed Insights. Google Analytics, if switched on, depends on consent: see Cookies and analytics.
    Who receives it
    Vercel, and Google if Google Analytics is switched on.
    How long we keep it
    Set by Vercel and Google. [To confirm: Vercel analytics retention for our plan, and the Google Analytics data retention setting.]

  • Error logs

    When something fails unexpectedly the server writes an error entry that identifies the account, booking or expert involved by its internal ID. Logs do not contain email addresses, names, passwords, tokens or message text.

    Why we use it
    To find and fix faults.
    Lawful basis
    Legitimate interests: keeping the platform working and secure.
    Who receives it
    Vercel (runtime logs).
    How long we keep it
    [To confirm: runtime log retention on our Vercel plan.]

We do not sell personal data, and we do not make decisions about you by solely automated means.

Who we share data with

These are the outside services that handle personal data for us. We share data with others only where the law requires it or you ask us to.

  • Neon

    Hosts our PostgreSQL database, which holds almost everything described above.

    Location: [To confirm: Neon database region]

  • Vercel

    Hosts the website and runs scheduled jobs. Also provides Vercel Blob file storage (profile photos, event banners and private documents), Web Analytics, Speed Insights and runtime logs.

    Location: [To confirm: Vercel function and Blob regions]

  • Resend

    Delivers the emails we send, including calendar invitations.

    Location: [To confirm: Resend sending region]

  • Mux

    Stores and streams expert intro videos and the community video.

    Location: [To confirm: Mux storage location]

  • Nylas

    Connects an expert's Google or Microsoft calendar to SisuScale. It acts on our instructions as our processor, and holds the connection for each expert.

    Location: Europe (London) region.

  • Google and Microsoft

    Provide the calendars experts connect. They hold the calendar itself under the expert's own agreement with them.

    Location: Under their own terms.

  • Google Analytics

    Website analytics, only if switched on for the site.

    Location: [To confirm: whether it is enabled in production]

Other people on the platform see what you choose to share with them: an expert's published profile is public, approved buyers see an expert's rates and documents, and a buyer and expert in a conversation see each other's messages and Consultations. SisuScale admins can see accounts, messages, Bookings and Consultations in order to run the platform.

Google calendar data

Experts can connect a Google or Microsoft calendar so that buyers can book a Consultation into a free slot. The connection is made through Nylas, and the sign-in screen asks for your permission first. This section describes exactly what we do with it.

  • What we ask for. For Google we ask for the calendar.readonly and calendar.events permissions. For Microsoft we ask for Calendars.ReadWrite, User.Read and offline_access. We ask for no email permissions of any kind.
  • SisuScale reads busy times and the events it creates. We read when you are busy so that buyers are offered only free slots, and we read back the Consultation events we put in your calendar. We do not store your calendar contents.
  • SisuScale writes Consultations and the events the expert attends. A Consultation is written to your primary calendar as an event with a Google Meet or Microsoft Teams link. The event title includes the buyer's first name, and its description holds the topic they said they want to discuss.
  • SisuScale never reads email. We never access Gmail, Outlook mail, contacts or any other part of your Google or Microsoft account.
  • Event details are never shown to buyers. Buyers see only which time slots are free, never the titles, times or details of your other events.
  • You stay in control. Choose Disconnect on your SisuScale profile to end access, or remove SisuScale from the permissions of your Google or Microsoft account at any time.
  • Google API Services User Data Policy. SisuScale's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
  • Google user data is not used to train AI models. We do not use it for advertising or sell it. We use it only to provide the calendar features described here, and the only party it passes to is Nylas, which handles it for us as a service provider.

Cookies and analytics

  • Essential cookies. Signing in sets a session cookie so you stay signed in, and connecting a calendar sets a short-lived cookie that protects the connection step. They are needed for the platform to work.
  • Vercel Web Analytics and Speed Insights. These measure page views and page speed without using cookies.
  • Google Analytics. The site can load Google Analytics, which sets cookies and sends information about your visit to Google. [To confirm: whether Google Analytics is enabled in production, and how consent is asked for. There is no consent banner yet.]

International transfers

Some of our providers are based in, or process data in, countries outside the UK, including the United States. When personal data leaves the UK we make sure it is protected by an approved safeguard, such as the UK Extension to the EU-US Data Privacy Framework (Nylas is certified under it) or the UK International Data Transfer Agreement or Addendum. [To confirm: the transfer mechanism for each of Neon, Vercel, Resend, Mux and Google.]

How long we keep data

The retention period for each kind of data is shown above. In summary:

  • Most account data is kept until your account is deleted.
  • When an account is deleted, its profile, messages, Bookings, Consultations and event responses are deleted from our database, and its files in Vercel Blob and videos in Mux are then deleted. If that cleanup fails it is retried daily.
  • Disconnecting a calendar removes our record of it and revokes access at Nylas.
  • We have not yet set fixed time limits for data about inactive accounts, past Consultations, closed Bookings or partner requests. [Decision needed: retention periods for these, and Neon backup retention.]

Your rights

Under UK data protection law you have the right to:

  • be told what we hold about you and get a copy of it;
  • have inaccurate data corrected, which you can do yourself on your profile;
  • have your data erased, which includes deleting your account;
  • restrict how we use your data, or object to our use of it where we rely on legitimate interests;
  • receive your data in a portable format; and
  • withdraw consent at any time, for example by choosing Disconnect on a calendar connection.

To use any of these rights, email [Privacy contact email — to confirm]. We will reply within one month. Accounts are deleted by our team on request. We may need to check your identity first.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

We will update this page when what we collect or share changes, and change the date at the top. If a change affects how we use Google calendar data, we will tell experts who have connected a calendar.

Contact

Questions about this policy or your data: [Privacy contact email — to confirm]. Our registered office is [Registered office address — to confirm].