Privacy Policy

Privacy Policy

Last updated: October 3, 2026

This policy explains what data we collect on scall.me and in connection with our services, why, who we share it with, how advertising pixels and consent work, and what rights you have.

1. Data controller

The controller of your personal data is MEDIA DIGITAL BUSINESS L.L.C.-FZ (license number 015913191), with its registered office at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, operating the ScallMe brand (scall.me). Data protection contact: [email protected], phone +48 511 608 362 (Mon-Fri, 10 AM to 6 PM).

Invoices: at your request, the VAT invoice may be issued by an affiliated entity registered in Poland, INVERTED8 sp. z o.o., Brąswałd 49a, 11-001 Dywity, Poland, KRS 0000754135, NIP (tax ID) 7393920409, REGON 381618874. In that case INVERTED8 sp. z o.o. processes the data needed for invoicing and settlements as a separate controller, to meet its tax and accounting obligations (Art. 6(1)(c) GDPR).

Controller's representative in the European Union (Art. 27 GDPR): INVERTED8 sp. z o.o., Brąswałd 49a, 11-001 Dywity, Poland, KRS 0000754135, NIP (tax ID) 7393920409, REGON 381618874, email: [email protected] (subject: GDPR Representative). You can address any matter concerning your data to the representative, including by post to that address. The representative also liaises with supervisory authorities on our behalf.

We have not appointed a data protection officer. For any data protection matter, write to [email protected].

2. What data we process

  • Form data (contact, audit, quote, call booking): first and last name, email address, phone number, company name, website or store address, message content.
  • Data from the free website draft wizard (scall.me/demo): company name, city, industry, chosen sections and look of the website, information about your online presence with the addresses you provide of your website, social media profiles or Google Business Profile, and the phone number or email address the link should be sent to.
  • Technical data: IP address, browser and device type, the address of the page you came from, ad click identifiers (e.g. gclid, fbclid, oppref), and cookies and similar identifiers if you consent to them.
  • Correspondence data: the content of emails, text messages and messenger chats, and notes from phone and video calls.

3. Purposes and legal bases

  • Answering your enquiry and contacting you about it: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in replying to correspondence).
  • Preparing the free website and SEO audit or the free website draft, and contacting you about it by email, text message or phone: Art. 6(1)(b) GDPR.
  • Concluding and performing a contract, settlements and invoices: Art. 6(1)(b) and (c) GDPR.
  • Commercial and marketing information by email, text message, messengers and phone: Art. 6(1)(a) GDPR (consent) in conjunction with Art. 398 of the Polish Electronic Communications Law. Consent is voluntary and separate from consent to perform the service. You can withdraw it at any time by replying to any message or writing to [email protected].
  • Newsletter: Art. 6(1)(a) GDPR (consent).
  • Visit statistics (Google Analytics 4): Art. 6(1)(a) GDPR (consent in the cookie banner).
  • Measuring ad performance, remarketing and ad targeting (pixels and Conversions API): Art. 6(1)(a) GDPR (consent to the Marketing category in the cookie banner).
  • Booking and holding an online call (Calendly, Google Meet): Art. 6(1)(b) and (f) GDPR.
  • Website security, protecting forms against bots and abuse, and limits on submissions from one phone number, email address or IP address: Art. 6(1)(f) GDPR.
  • Establishing, pursuing or defending legal claims: Art. 6(1)(f) GDPR.

4. Advertising pixels and Conversions API

Pixels are pieces of code from advertising platforms. They let us check whether a visit from an ad ended in a submission and show ads to people who have visited the website. We run them only after you consent to the Marketing category in the cookie banner. Without that consent, pixels do not set cookies and do not send data.

The OpenAI Ads pixel (ads in ChatGPT) is currently active on the website. The website is also prepared to enable the Meta pixel (Facebook, Instagram) and the Google Ads conversion tag. You can always see the current list of active tools in the cookie banner settings.

Conversions API means sending the same information about a submission directly from our server, without going through the browser. This keeps measurement accurate even when the browser blocks scripts. The same rule applies: only with your consent.

When you submit a form and have given marketing consent, we may send the advertising platform (OpenAI, Meta, Google) your email address, phone number and first name in hashed form, that is converted with the SHA-256 algorithm into a string of characters from which the data cannot be read. The platform compares this hash with its users' accounts to attribute the submission to an ad. Together with the hash we may send your IP address, browser information, ad click identifier and event identifier. Google Ads hashes the data in your browser (enhanced conversions) and uses it only if you consent to sharing data for advertising.

Advertising platforms may combine this information with data they already hold about you and use it for their own purposes as described in their privacy policies. For collecting data on our website and passing it to a platform, we may be joint controllers with that platform (Art. 26 GDPR). Platform policies: Meta (facebook.com/privacy/policy), Google (policies.google.com/privacy), OpenAI (openai.com/policies/privacy-policy).

5. Google Consent Mode (v2)

We use Google Consent Mode. The cookie banner passes your choice to Google in four signals: analytics_storage, ad_storage, ad_user_data and ad_personalization. By default, all of them are set to denied.

Without consent, Google tools do not set cookies. Google may then receive a cookieless signal without identifiers (for example, that a page was visited), which is used for aggregated statistical modelling. Once you consent, the signals change to granted and the tags work in full.

6. Advertising profiling

If you consent to marketing cookies, advertising platforms may build audiences (for example, people who visited the website or people similar to them) and tailor ads to them. This is profiling within the meaning of the GDPR. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR).

You can withdraw your consent at any time in the cookie banner settings. You can also object to the processing of your data for direct marketing by writing to [email protected].

7. Artificial intelligence in audits and drafts

We prepare the free audit and the free website draft with the help of artificial intelligence models (currently Claude by Anthropic). The model receives the information needed for the analysis: company name, industry, city, website address, publicly available information about the company, website measurement results and the content of your request. We take the measurements with Google PageSpeed Insights and Ahrefs, which receive the address of the website being analysed.

8. Data from public sources and publishing the draft

If you provide a link to your Google Business Profile or a social media profile, we may use the information about your company that is publicly available there (name, address, opening hours, ratings, photos) to prepare the draft or the audit. If your company is in our database built from public Google Maps data, we may use that data for the same purpose.

We publish the draft at a temporary technical address on the demo.websystemz.com domain. The address contains your company name, and the page carries a noindex tag telling search engines not to index it. Someone who knows your company name could guess the link. We delete the draft on request, and in any case no later than 90 days after sharing it.

9. Recipients and processors

We entrust data to providers acting on our behalf, under data processing agreements or the providers' data processing terms:

  • SEOHOST (Poland): hosting of the scall.me website.
  • Cloudflare (USA): content delivery network and protection of the website and forms against attacks and bots (Cloudflare Turnstile).
  • Hetzner Online (Germany): the server that runs request handling and the client panel.
  • Google (Ireland, USA): Google Analytics 4 and Site Kit, Google Ads, Gmail, Calendar, Google Meet, PageSpeed Insights.
  • Airtable (USA): request database.
  • Brevo (France): transactional email.
  • MailerLite (Lithuania): newsletter.
  • SMS-Fly: text message delivery.
  • Telegram: internal team notifications about new requests.
  • Calendly (USA): call booking.
  • Anthropic (USA): Claude AI models used in audits and drafts.
  • Ahrefs (Singapore): search visibility data for the audit.
  • WhatsApp (Meta): contact, if you message us on WhatsApp.

Once you consent to marketing cookies, data also goes to the advertising platforms described in section 4 (OpenAI and, once enabled, Meta and Google Ads). We may disclose data to public authorities where required by law.

10. Transfers outside the EEA

The controller is based in the United Arab Emirates, and some providers operate outside the European Economic Area, mainly in the USA. For transfers to the USA we rely on the European Commission adequacy decision for the EU-US Data Privacy Framework for companies certified under it, and otherwise on the standard contractual clauses (SCC) adopted by the European Commission, together with additional safeguards such as encryption in transit.

You can obtain information about the safeguards used and a copy of them by writing to [email protected].

11. How long we keep data

  • Enquiries and correspondence: until the matter is closed, and then until claims become time-barred (usually 3 years for business-related matters).
  • Requests from the draft wizard and the audit form: 24 months from the last contact.
  • Website draft: until deleted at your request, no later than 90 days after sharing.
  • Contracts and accounting documents: for the period required by tax and accounting law (in Poland, 5 years from the end of the year in which the tax obligation arose).
  • Data processed on the basis of consent: until consent is withdrawn. We keep records of when consent was given and withdrawn until claims become time-barred, so that we can demonstrate compliance.
  • Data in Google Analytics 4: no longer than 14 months. The lifetime of individual cookies is described in the Cookie Policy.
  • Data sent to advertising platforms: for the period set out in those platforms' rules.

12. Your rights

You have the right to access your data and receive a copy, to rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest (including direct marketing and related profiling), and to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

To exercise your rights, write to [email protected]. We will reply within one month. You can also lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

13. Providing data is voluntary

Providing data is voluntary, but without it we cannot answer your enquiry, prepare an audit or a draft, send the newsletter or book a call.

14. Cookies and the consent banner

The cookie banner is run by the WPConsent plugin on our own server. Your choice is stored in the wpconsent_preferences cookie. The list of cookies and their lifetimes is described in the Cookie Policy.

Cookie Policy

15. New advertising tools in the future

In the future we may enable further advertising and analytics tools, in particular TikTok Pixel and TikTok Events API, Microsoft Advertising UET and Microsoft Clarity, LinkedIn Insight Tag and Pinterest Tag. We will enable each of them only with your consent in the cookie banner, on the terms set out in sections 4 to 6, including the sending of hashed contact data through their server-side interfaces.

Before we launch a new tool, we will update this policy and the Cookie Policy with the provider, purpose, scope of data, any transfer outside the EEA and the retention period, and the tool will appear in the banner settings.

15a. Usługa start-live (domena i hosting)

Przy zamówieniu domeny i hostingu dla strony z naszego kreatora (start.scall.me) przetwarzamy imię, nazwisko albo nazwę firmy i NIP, adres, e-mail i telefon w celu wykonania umowy (art. 6 ust. 1 lit. b RODO). Dane abonenta przekazujemy rejestratorowi domen OVH SAS (Francja) i rejestrowi domeny (dla .pl: NASK), a dane płatności obsługuje Stripe Payments Europe Ltd. (Irlandia), który jest odrębnym administratorem w zakresie płatności. Zapisujemy czas i adres IP akceptacji regulaminu jako dowód zawarcia umowy. Dane przechowujemy przez okres świadczenia usługi i 6 lat po jej zakończeniu (rozliczenia). Sprzedawcą tej usługi jest MEDIA DIGITAL BUSINESS L.L.C.-FZ (Dubaj, ZEA); regulamin: scall.me/regulamin-start-live.

16. Changes to this policy

We update this policy when our services, tools or the law change. The date of the last change is shown at the top of the page, and the current version is always available at this address.