Scale OvaScale OvaBeta
Create with OVA
Scale OvaScale OvaBeta
Create with OVA

Privacy Policy – Scale Ova

Last updated: April 2026

1. Purpose of this Policy

This privacy policy aims to inform users of the website https://scale-ova.ai about the collection, use, sharing, and protection of their personal data, in compliance with the General Data Protection Regulation (GDPR – Regulation EU 2016/679) and French Act No. 78-17 of 6 January 1978 on Information Technology, Data Files, and Civil Liberties.

2. Identity of the Data Controller

SAS MV GROUP

SIRET: 991 674 805 00015

Address: 5b rue des Alouettes, 89100 Soucy, France

Email: contact@scale-ova.ai

Website: https://scale-ova.ai

RCS: Sens — Share capital: 10 euros

3. Data Collected

We collect the following categories of data:

  • Identification data: surname, first name, email address, postal address, billing details.
  • Payment data: processed exclusively via Stripe. No banking data (card number, CVV) is stored on our servers.
  • Technical data: IP address, browser type and version, operating system, connection and access logs.
  • Usage data: history of generated themes, use of templates, service usage statistics.
  • AI-related data: prompts sent to the OVA assistant, generated content (Liquid themes, CSS, images), AI conversation history, tokens consumed, and image credits used.
  • Customer support data: messages sent, attachments, support ticket and conversation history.
  • Connected Shopify shop data: shop information (name, plan, currency, timezone) and aggregated commercial performance metrics (gross sales, order count, average order value, top-selling product). This data is collected via the official Shopify API and stored as daily aggregates. No personal data of the shops' end customers (name, email, address) is collected or stored.

4. Purpose of Data Collection

The collected data is used for the following purposes:

  • Providing access to the Scale Ova service and ensuring its proper functioning
  • Generating Shopify themes via the OVA AI assistant and storing conversation history
  • Managing billing, payments, and subscriptions via Stripe
  • Providing technical support and customer service
  • Improving the service, features, and AI performance
  • Analysing aggregated usage and commercial performance of connected shops to understand our customer base and improve the service
  • Sending transactional communications (confirmations, payment alerts, notifications)
  • Complying with legal and regulatory obligations
  • Preventing fraud, abuse, and ensuring the security of the service

5. Legal Basis for Processing

The processing of your data is based on:

  • Performance of the contract: provision of the Scale Ova service, theme generation, subscription management
  • Legal obligations: billing, accounting, retention of connection data
  • Your consent: marketing communications, newsletter (where applicable)
  • Our legitimate interest: service improvement, security, abuse prevention, error monitoring

6. Recipients and Subprocessors

Data may be shared with the following subprocessors, strictly for the purpose of providing the service:

  • Stripe, Inc. (United States): payment processing and subscription management. Stripe is GDPR-compliant.
  • PulseHeberg SAS (France): server and infrastructure hosting. Data hosted in France.
  • Amazon Web Services – AWS SES (United States): transactional email delivery (confirmations, payment alerts). Transfer governed by Standard Contractual Clauses (SCCs) adopted by the European Commission.
  • Sentry (United States): error monitoring and service stability tracking. Transfer governed by Standard Contractual Clauses (SCCs) adopted by the European Commission.
  • PostHog (European Union): audience analytics and user experience improvement, in cookieless mode. Data hosted in the EU.
  • Shopify Inc. (Canada / Ireland): e-commerce platform hosting our users' shops. Shop information and aggregated metrics (sales, orders) are retrieved via their official API. Transfer governed by their GDPR-compliant Data Processing Addendum.

No personal data is sold, rented, or transferred to third parties for commercial or advertising purposes.

7. Data Retention

  • Account-related data: retained for the duration of the active subscription, then 3 years following cancellation or last account activity.
  • Billing data: 10 years in accordance with accounting and tax obligations.
  • AI-related data: conversation history and generated content retained for the duration of the active account. Deleted within 3 months of account deletion.
  • Technical data (logs): 12 months in accordance with applicable regulations.
  • Support data: retained for the duration of the contractual relationship, then 3 years after the last exchange.

8. User Rights

In accordance with the GDPR (Articles 15 to 22), you have the following rights:

  • Right of access: to obtain confirmation of the processing of your data and to receive a copy
  • Right to rectification: to correct inaccurate or incomplete data
  • Right to erasure: to request deletion of your data, subject to legal retention obligations
  • Right to object: to object to the processing of your data based on legitimate interest
  • Right to restriction of processing: to request the suspension of processing in certain cases
  • Right to data portability: to receive your data in a structured, commonly used format

To exercise your rights, please contact us at: contact@scale-ova.ai. Proof of identity may be required to verify your identity. We are committed to responding within one month. In the event of a disagreement, you may lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertes).

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure, including: encryption of data in transit (TLS/SSL), secure authentication, access controls, regular backups, and continuous security monitoring.

10. Cookies and Tracking Technologies

Scale Ova does not use any third-party, advertising, or profiling cookies. Only cookies strictly necessary for the operation of the service (authentication session, CSRF token) are used.

  • Scale Ova uses PostHog, an audience analytics tool, in cookieless mode (data is stored in the browser's localStorage, not via cookies). This allows us to measure service usage and improve the user experience.
  • PostHog may record anonymised session replays (form fields, emails, and passwords are automatically masked).
  • No third-party, advertising, or profiling cookies are used.

Analytics data collected by PostHog is hosted in the European Union (PostHog EU). None of this data is sold or shared with third parties for advertising purposes.

11. International Data Transfers

Certain personal data may be transferred to the United States through the use of the following subprocessors: AWS SES (transactional emails) and Sentry (error monitoring). These transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission, in accordance with Article 46 of the GDPR, to ensure an adequate level of protection for your personal data. Primary data hosting is provided by PulseHeberg SAS in France.

12. Modifications to the Policy

This privacy policy may be updated at any time to reflect changes in the service or applicable regulations. Users will be notified of material changes by email or by notice on the website. The date of the most recent update is indicated at the top of this document.

13. Contact

For any questions regarding this privacy policy or to exercise your rights: contact@scale-ova.ai — SAS MV GROUP, 5b rue des Alouettes, 89100 Soucy, France.