OBSCALE

Trust / Privacy

How we handle your data.

DOC / OBS-PRIV

Effective 1 Jan 2026 · updated 13 Aug 2026

Obscale is a product company; this site sits alongside the other operating brands of the group. We treat personal data the way we'd want ours treated: collected only when necessary, never sold, deleted on request. This policy explains exactly what, why, and how.

1. Who we are

Obscale d.o.o. ("Obscale", "we", "us") is a limited liability company registered in Bosnia and Herzegovina, headquartered at Tuzlanski put bb, 75350 Srebrenik. We operate this website (obscale.com) and the products ScaleTrack (scaletrack.com) and ScaleCall (scalecall.ai). For purposes of EU GDPR, Obscale is the data controller for personal data collected on obscale.com.

Privacy questions: privacy@obscale.com

2. What we collect

2.1 Analytics

We load Google Analytics 4 and Microsoft Clarity in consent-denied mode by default (Google Consent Mode v2; Clarity consent off). In this mode no analytics cookies are set and no personal identifiers are collected. If consent is granted, anonymized usage data is collected: pages visited, session duration, approximate location (country / city level, IP anonymized), browser type, and interaction events.

2.2 Form submissions

When you submit a form on the contact or careers pages, we collect the data you provide: name, email address, company, topic, and message text. We use Web3Forms as the form-handling sub-processor.

2.3 Cookieless analytics

We run an internal, privacy-friendly analytics tool (Obscale Analytics, self-hosted Umami) that collects aggregate page-view counts without cookies, fingerprinting, or personal data.

2.4 Server logs

Our hosting providers collect standard server logs (IP, user agent, request timestamp) for security, abuse prevention, and capacity planning. Logs are retained for 30 days.

2.5 What we do not collect

We do not collect: payment card data, government IDs, social-media-graph data, advertising-identifier data, or behavioral data for retargeting. We do not run advertising pixels on this website.

3. Why we collect (lawful basis)

  • Consent: analytics cookies are set only if you grant consent.
  • Contract / pre-contract: form submissions for sales, partnership, careers, or investor inquiries.
  • Legitimate interest: security logging, fraud prevention, aggregate cookieless analytics for site improvement.
  • Legal obligation: tax records, accounting records, statutory disclosures.

4. How long we keep it

  • Analytics data (GA4 + Clarity): 14 months, then auto-purged.
  • Form submissions: 24 months from last activity, then archived or deleted on request.
  • Server logs: 30 days.
  • Career applications: 12 months unless you ask earlier deletion.
  • Tax / accounting records: 10 years (legal requirement, Bosnia and Herzegovina).

5. Who we share with (sub-processors)

We use the following sub-processors. All are bound by data processing agreements:

  • Google Ireland Ltd: Google Analytics 4 (EU region, IP anonymization on).
  • Microsoft Ireland: Clarity (heatmap and session replay, masking on for inputs).
  • Web3Forms (Cloudflare-hosted): form submission delivery.
  • Cloudflare Inc.: CDN, DDoS protection, edge hosting.
  • Hetzner Online GmbH: hosting (Germany, EU).

We never sell, rent, or trade personal data. We never share with advertisers or data brokers.

6. International transfers

Some sub-processors (Google, Microsoft, Cloudflare) may transfer data outside the EU/EEA. These transfers are covered by EU Standard Contractual Clauses (SCCs) and supplementary safeguards as required under GDPR Schrems II guidance.

7. Your rights (GDPR)

If you are in the EU/EEA, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion ("right to be forgotten")
  • Request portability (we provide your data in machine-readable format)
  • Object to or restrict processing
  • Withdraw consent at any time
  • Lodge a complaint with your local data protection authority

To exercise any right, email privacy@obscale.com. We respond within 30 days.

8. Cookies in detail

  • Strictly necessary: consent state, if set. No consent needed. Cleared on browser reset.
  • Analytics (consent-gated): _ga, _ga_* (Google Analytics), _clck, _clsk (Microsoft Clarity). Set only after consent. 14-month max lifetime.
  • Marketing: none. We do not run advertising cookies on obscale.com.

You can reset your consent by clearing site data in your browser or contacting us.

9. Children

This website is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has submitted data, contact us for deletion.

10. Security

We protect personal data with: TLS 1.3 in transit, AES-256 encryption at rest, role-based access control, audit logs, and regular security reviews. See our Security page for full details.

11. Changes to this policy

We update this policy when our data practices change. The "Last updated" date at the top reflects the most recent revision. For material changes, we notify users via a homepage announcement.

12. Contact

Privacy team: privacy@obscale.com
Postal address: Obscale d.o.o., Tuzlanski put bb, 75350 Srebrenik, Bosnia and Herzegovina