Privacy policy

Who this covers

This policy describes how Quintessence Group, Inc. (“Scoped”, “we”, or “us”) handles personal information through scoped.ai, Scoped Cloud at app.scoped.ai, the Scoped desktop and mobile apps, and support. The terms of service cover use of the product. Charter and Aether, our other products, have their own privacy notices.

We decide how account, billing, security, website, marketing, and support information is used. When your employer or another organization provides your workspace, it decides what work is stored and who can access it, and Scoped processes that workspace information to provide the service. That organization may have its own privacy notices and obligations. Ask its workspace administrator about requests involving shared work.

Information we collect

Information comes from you, from people who invite you or contribute to your workspace, from imports and clients you authorize, and from your use of the service.

Account and profile: Name, email address, job title, username, and preferences such as notification settings and timezone. Also email-verification status, workspace memberships, roles, and invitations. If you use a password, we store only a hash of it.
Sign-in with Google, Microsoft, or Slack: Where offered, and only if you choose it, we receive your name, email address, and account identifier from that provider. For Google, we also receive your profile photo address. We request only basic identity and keep none of the sign-in tokens the provider issues. We do not request access to your email, calendar, files, contacts, or Slack messages.
Account security: Sessions, including the IP address, browser, and sign-in method. Two-factor authentication secrets and backup codes, which are stored encrypted. Passkeys are not available. Short-lived verification codes, stored as hashes. API keys, stored as hashes, with the time each key was last used and a record of key changes.
Your team’s work: Issues, projects, initiatives, cycles, comments, labels, status updates, and activity recording who changed what. Attachments are a title and an external URL, never an uploaded copy of the linked file.
Information about your clients and contacts: Companies, contacts, deals, notes, follow-ups, and imported spreadsheets you or your teammates add. These can include other people’s names, email addresses, phone numbers, job titles, locations, social media profiles, and notes about your relationship with them. Scoped does not buy or enrich this information from other sources.
Quotes, invoices and your clients’ payments: The quotes and invoices you send, the client names and email addresses on them, the messages and reminders you send about them, and payment, refund, and dispute status reported by Stripe. Your clients pay on Stripe’s page, so Stripe, not Scoped, collects their card and bank details. Scoped holds this information on your behalf as part of your workspace.
Client emails: The template emails your workspace sends clients through Scoped, such as a welcome note, a quote follow-up, an inquiry reply, or a review request: the recipient address, the message as sent, who or which setting started it, and the delivery, bounce, complaint, link-click, and recorded-reply information that follows. When a recipient unsubscribes, Scoped keeps a keyed hash of their address so your workspace cannot email them again from a template. Scoped holds this information on your behalf as part of your workspace and does not read your mailbox or your clients’ mailboxes.
Workspace setup: Workspace name, industry, and primary use case.
How you found Scoped: When you navigate from scoped.ai to sign up, limited attribution information about your visit (for example, the marketing source, referring page, and originating domain) may be transferred to the application and associated with the workspace you create. This helps us understand which channels bring new accounts. The information is stored temporarily in your browser session until sign-up is complete. Third-party ad click identifiers are passed only while advertising measurement applies to you: in the United States unless you have turned it off or your browser sends Global Privacy Control, and elsewhere only if you have consented to advertising cookies.
Billing: Plan, trial and subscription status, and billing identifiers from Stripe. When an administrator starts a purchase, Stripe receives their email address and the workspace name. Stripe and Link, not Scoped, collect your payment details. Scoped shows your card type, last four digits, and invoices by reading them from Stripe when you open billing, and does not store full card numbers.
Agent and integration access: For agents and other clients you authorize: client details, permissions, workspace bindings, and token-related records. Changes a connected agent makes are recorded in workspace history with the tool it used.
Email we send: The account, billing, reminder, activity, and marketing messages we queue or send, with their delivery status. Email preferences, unsubscribe requests, and records of choices, including the notice shown and consent where you provide it, plus country evidence used for email eligibility. If an address permanently bounces or reports a message as spam, we keep a hash of it so we stop sending there.
Sales inquiries: Your name, work email, company if you provide it, and the message you send through the contact form, with limited attribution information about your visit when your browser session has it (never third-party ad click identifiers). We use this to answer your inquiry, and we record it as a contact and a deal in Scoped’s own workspace so we can follow up. Sending it does not subscribe you to marketing email.
Support requests: Your reply address, the category, subject, and description you send, any steps to reproduce, and diagnostic details (platform, app version, error code, page) only if you choose to include them. The support form does not accept attachments.
Technical and operational: Request records with paths, status codes, timings, and account or workspace identifiers. Load-balancer logs, which include IP addresses, browser information, and full request URLs (for example, search terms). Counters that limit repeated requests from an IP address. Error details, which may contain contextual information. Database backups contain copies of the records they protect.

How we use it

Provide your account and workspace, authenticate access, preserve project history, and carry out actions you or authorized members and clients request.
Manage plans, trials, subscriptions, and billing.
Send the client emails you, your settings, or an agent you connect start, honor each recipient’s unsubscribe, and show you what happened to each one.
Send email verification, invitations, password recovery and security codes, billing notices, reminders, and the activity notifications you turn on, and respond to sales inquiries and support requests.
Suggest help articles that fit your workspace’s primary use case.
Send account setup guidance and other marketing emails as described below, using account and workspace information to decide eligibility, timing, and relevant content, and honor email preferences and unsubscribe requests.
Understand which sites, campaigns, and pages bring sign-ups and sales inquiries.
Detect abuse, enforce permissions, investigate errors, maintain reliability, and recover from incidents.
Meet applicable legal obligations, resolve disputes, and protect the rights and safety of users and the service.

We do not sell personal information for money. We do not use or share workspace content for targeted advertising or to train machine-learning models. In the United States, unless you turn it off, the advertising providers described below may use public website activity, and a notice that you created a Scoped Cloud account, to measure ads and build audiences; elsewhere only if you allow advertising. This can constitute sharing for targeted advertising under applicable privacy law.

Where data-protection law requires a legal basis, we rely on: performing our agreement with you, for account, service, and billing delivery; legitimate interests in secure operation, support, and preventing misuse, balanced against your rights; compliance with legal obligations; and consent where required. For workspace content handled on an organization’s instructions, that organization is responsible for its legal basis. Accepting our terms is not consent to every use of personal information.

Account and authentication details are needed to provide Cloud access. Other content is your choice, although omitting it may limit the features you can use.

Account and marketing emails

Getting started emails. Where permitted by applicable law, eligible account holders may receive setup tips without a separate opt-in. You can unsubscribe at any time.
Inactive accounts in the United States. People with a verified email address who have claimed a workspace but have no recorded work activity may receive getting started guidance and occasional product updates without a separate opt-in. This email program is limited to recipients whose United States location is recorded with supporting evidence, and stops when they start working in Scoped or unsubscribe.
Separate opt-in categories. Trial-upgrade offers and the optional “Product guidance and updates” email category require a separate opt-in. Accepting our terms or reading this policy does not provide that consent.

We use information such as email-verification status, workspace membership and role, country where recorded, setup choices, plan and trial status, and whether and when you create projects, tasks, or other work to decide which of these emails you are eligible for and when to send them. We keep preference and sending records to apply your choices and avoid duplicate messages. These account-email preferences are separate from website analytics and advertising cookie choices.

Every marketing email includes an unsubscribe link. Account settings also provide email preference controls for setup tips and the available optional categories. Unsubscribing from marketing does not stop verification, password recovery, security, or billing messages needed to operate your account. For help with an email preference, contact support@scoped.ai.

Cookies, storage and icons

Scoped Cloud uses cookies that keep you signed in and protect sign-in and support forms. These cookies are necessary for the service to work. Browser storage remembers preferences such as your selected workspace, table layouts, and collapsed groups. Clearing cookies signs you out, and clearing browser storage resets those preferences.

On scoped.ai, optional Google Analytics measures visits to public pages and clicks on the sign-up and walkthrough buttons under analytics. Under advertising, Meta can measure visits to public pages, sign-up interest and booked walkthroughs, and may use them to build website audiences. An enabled provider receives browser and request information and may set its own identifiers. We do not send workspace content or account email from this website, and a sign-up click is not a verified registration. We do not use session replay here. When you create a Scoped Cloud account and advertising measurement applies to you, Scoped Cloud tells Meta that an account was created, with a hashed copy of your email address, your browser’s user agent and any ad click identifier, so we can measure which ads lead to sign-ups. It never sends workspace content. Scoped Cloud keeps its own privacy choices at app.scoped.ai/cookies. The desktop and mobile apps have no advertising measurement.

Vercel, which hosts this website, counts page views and measures how quickly pages load under analytics: in the United States unless you turn analytics off, and elsewhere only if you allow it. It sets no measurement cookies. You can turn analytics off at any time through Your privacy choices. Each measurement records the page, the referring site, your browser, operating system, device type, network speed, and approximate location; a visit is recognized only by a hash of the request that is discarded within 24 hours. We do not send account details or workspace content to this measurement service, and we remove query strings and fragments from measured URLs.

In the United States, optional analytics and advertising tags load unless you turn them off, and a notice says so on your first visit. Everywhere else, optional tags do not load until the relevant choice is saved. A necessary cookie records only whether your connection is in the United States, for one day, so the right rule applies here and in Scoped Cloud. Your browser’s Global Privacy Control keeps advertising off even if you previously accepted it. A host-only cookie remembers your website choices for 180 days; a choice made in the United States applies only while you are there, and elsewhere we ask you again. Turning advertising off also sets a cookie, shared with Scoped Cloud, that keeps it off there too for about 13 months. You may change your choices in Your privacy choices; the page then reloads to remove loaded optional scripts. Hosting and download providers still process request information to deliver and protect their services.

Limited attribution information about your visit is held temporarily in your browser session on scoped.ai until sign-up is complete, as described under Information we collect. Third-party ad click identifiers are kept only while advertising measurement applies to you, as described above.

To show company icons, the web and mobile apps load each company’s small website icon directly from that company’s domain. The icons on the connected-agents page load from the providers’ own sites. As with any web request, those sites receive your IP address and browser information. The desktop app does not make these requests.

Connected agents and integrations

You can authorize external AI agents and other clients through the Model Context Protocol (MCP) or an API key. Consent identifies a workspace and the permissions requested. A connected client can read information or take actions within the access you grant and your own permissions. Its actions become part of workspace history. Charter, another Quintessence Group product, connects the same way when a workspace authorizes it. It can then read and update the records its permissions cover, including clients and deals.

Data returned to a connected client leaves Scoped. That provider’s privacy terms, retention, model-training settings, and other policies govern its copy. Review those terms before connecting. Revoking a connection stops future access through that grant. It does not recall information already received or undo completed changes.

Desktop and mobile apps

Desktop. Desktop workspace records stay on your computer or in an external database you choose. They are not automatically copied into Scoped Cloud, and the desktop app does not require a Scoped account. An optional local password is stored only as a hash. The app stores database connection credentials in the operating system’s credential store. It includes no automatic telemetry, analytics, or crash-report uploads. It writes local runtime files and saves the workspace exports and diagnostic bundles you request. Diagnostics redaction is best effort, so review a bundle before sharing it.

Downloading the app creates requests to the download host, and an update check you start contacts the download service. Connections to a database or an agent you choose are separate from telemetry. Removing the app does not by itself erase your database, credential store entries, exports, or backups. See the desktop recovery guide for recovery and removal guidance.

Mobile. The mobile app signs in to Scoped Cloud and keeps its session in the device’s secure storage. Voice commands and the chat assistant run entirely on your device, using speech-recognition and language models built into the app and the operating system. Audio is never recorded to storage or sent to Scoped or any other service. Transcripts stay in the app’s memory until you save them as work, and chat history is cleared when the app restarts. Actions and searches the assistant runs on your behalf go to Scoped Cloud like any other request.

Location and security

Scoped Cloud is hosted by Amazon Web Services in the United States (Northern Virginia). Our providers and support operations may process information in other locations. Using the service from another country therefore involves transferring your information to the United States, whose data-protection laws may differ from those where you live. Contact us for information about how a transfer that concerns you is handled.

Our safeguards include access controls, hashed passwords, encrypted two-factor secrets, session revocation, HTTPS, and encrypted database storage. These are safeguards, not a promise of perfect security or end-to-end encryption. You also help protect your information by securing your accounts, reviewing membership, and choosing agent permissions carefully.

How long information stays

Workspace records remain while the workspace exists unless they are deleted through an available deletion process. Archiving is not deletion: archived work stays in the workspace. Session and token expiration ends access but does not necessarily erase every associated record at that moment.

Support requests: the message, reply address, and diagnostics are erased after 90 days, including copied text in the linked internal support item, its comments, activity history, and notifications. A reference, status, and abuse-prevention hashes remain so we can track the request without retaining its message.
Logs: application and load-balancer logs are kept for up to 90 days, and network logs for 30 days.
Security records: counters that limit repeated sign-in, verification, and email attempts are keyed by IP address, or by a keyed hash of an IP address, email address, or account, and are deleted within hours.
Billing and email records: subscription records stay with the workspace. Payment event records, trial eligibility, and email delivery and suppression records are kept to operate billing and email, meet legal obligations, and resolve disputes. Stripe and Link keep their own records under their own terms.
Email choices: preference, unsubscribe, and suppression records are kept as needed to honor your choices and your clients’ unsubscribes, prevent repeat sends, and handle delivery problems. Suppression records can include a hash of an email address rather than the address itself.
Terms acceptance: your sign-in account keeps its current Terms version and acceptance time while the account exists. A separate minimal record containing an account identifier, Terms version, acceptance time, and source is kept for two years after acceptance, including after account deletion. It contains no name, email address, IP address, or workspace content.
Everything else: account, sales, support, and security information is kept for as long as needed for the purposes above, including resolving requests, investigating misuse, and meeting legal obligations.

Deletion from the active database does not immediately remove backup copies. Automated database backups are kept for 14 days. A database snapshot taken before each release is also kept until newer releases replace it, which can be longer. Deleted information can therefore remain in backups for a period after deletion.

Export and deletion

Export work. Workspace owners and administrators can export supported workspace records as JSON. Exports include attachment titles and URLs, not the linked files. They exclude authentication secrets and sessions, agent grants and tokens, pending invitations, and password-reset records. Each export describes its omissions.
Manage access. Cloud account controls let you review and revoke sessions, connected agents, and API keys. Workspace administrators manage membership. Revocation does not delete copies already exported or shared.
Delete a Cloud workspace. The workspace’s sole owner confirms the workspace name and their password. Any paid subscription must have ended first. The workspace and its workspace-owned records are then removed from the active database. Export first if you need to keep a copy.
Delete a Cloud account. Transfer or resolve sole ownership of your workspaces first. Account deletion removes your sign-in account, sessions, security settings, and memberships, and revokes associated access. It does not delete shared work you authored. The historical profile is reduced to an internal identifier, a generated non-deliverable address, the name “Deleted member,” and record timestamps. Your name, email address, job title, username, preferences, and personal notification and delivery records are removed. Rejoining creates a new profile.

Account and workspace deletion therefore do not erase every personal record. Billing records held by Stripe and Link, payment event and trial records, email delivery records, and backups are handled as described above. Contact us to request further removal or anonymization. We will assess what applicable law requires and explain any limits. The Cloud controls above do not delete data in a database you operate, on another person’s device, or in independent copies held by an agent provider or the host of a linked attachment.

Your privacy rights

Depending on your location and which laws apply, you may have rights to access, correct, delete, or receive a portable copy of personal information; object to or restrict certain processing; withdraw consent where processing is based on consent; or complain to a data-protection authority. Withdrawal does not affect earlier lawful processing. Some US state laws also provide rights relating to sale, targeted-advertising sharing, or sensitive information, and a right to appeal a denied request. We do not sell personal information or share it for targeted advertising, except that in the United States, unless you opt out, Meta may use public website activity and a notice that you created a Scoped Cloud account to measure ads and build website audiences. To opt out, use Your privacy choices on scoped.ai or in Scoped Cloud; we treat Global Privacy Control as an opt-out. Outside the United States this happens only if you allow advertising.

Send a request to support@scoped.ai. We may need to verify your identity and, where relevant, an authorized representative’s authority. We will respond under the rules and timeframes that apply to the request and will not discriminate against you for exercising your rights. These rights have exceptions, and we will explain a refusal where required.

If an organization controls the workspace information in your request, contact its administrator as well. We may need to direct the request to that organization or help it respond.

Children

Scoped is a business tool for people 18 and older, as the terms of service require. It is not directed to children, and we do not knowingly collect personal information from them. If you believe a child has provided personal information, contact us so we can investigate and delete it where appropriate.

Changes to this policy

The effective date at the top of this page identifies the current version. When we make material changes, we will explain them and give notice before they take effect where reasonably practicable, and we will obtain consent where the law requires it. A revised policy does not by itself authorize uses that require your consent.

Contact

Privacy questions or requests: support@scoped.ai.

Quintessence Group, Inc.
PO Box 5047, Breckenridge, CO 80424, United States

Your work. Your context. Your privacy.