Privacy Policy

Last updated: 6 November 2026

Privacy Policy

Effective Date: 6 November 2026

This Privacy Policy explains how SCALE PATH TECHNOLOGY SOLUTIONS - L.L.C - S.P.C, a limited liability company - sole proprietorship company registered in Abu Dhabi, United Arab Emirates, under Economic Licence No. CN-6267667 (ScalePath, GCC, we, us), collects, uses, discloses, and protects information in connection with Garage Cost Control.

Garage Cost Control, also referred to as GCC, is a garage management system available through garagecc.app and related pages, dashboards, applications, and services.

This Privacy Policy should be read together with our Terms of Use and Disclaimer.

Capitalized terms not defined here have the meaning given in the Terms of Use.

1. Roles: Who Is Responsible for What Data

It is important to understand the different roles involved.

Account and Billing Data

For account, workspace, subscription, billing, and payment-related information, we act as the data controller.

This means we decide why and how this information is processed for purposes such as account creation, billing, support, security, and legal compliance.

Tenant Content

For Tenant Content, the Tenant acts as the data controller, and we act as a data processor on the Tenant's instructions.

Tenant Content may include:

customer records;
vehicle records;
work orders;
invoices;
appointments;
expenses;
inventory records;
uploaded photographs;
documents;
notes;
any Tenant Customer information the Tenant chooses to enter into the Service.

The Tenant is responsible for having a lawful basis to collect, store, use, and process Tenant Customer information in the Service.

The Tenant is also responsible for honoring any rights its Tenant Customers may have under applicable law.

We are not a party to the relationship between a Tenant and its Tenant Customers. More detail is provided in our Disclaimer.

2. Information We Collect

We collect information needed to provide, operate, secure, and improve the Service.

Legal acceptance records. When you confirm that you accept our Terms of Use, this Privacy Policy, our Disclaimer, and the applicable billing terms, we record that acceptance — the date and time, the version of each document in force at that moment, the language it was presented in, the flow it was given from, and the account and Workspace it relates to. Where our infrastructure already receives them, the IP address and browser user agent of that request are recorded with it.

Account Information

We may collect:

name;
email address;
phone number;
password in hashed form;
user role;
Workspace details;
language preference;
login and account status.

We do not store passwords in plain text.

Workspace and Tenant Content

Tenants and Authorized Users may enter or upload information such as:

customer records;
vehicle records;
work orders;
invoices;
appointments;
inventory;
expenses;
staff records;
photographs;
documents;
notes;
service history;
payment status records;
other information entered into the Workspace.

Billing Information

We may collect and store:

selected Subscription plan;
billing status;
payment history;
invoice records;
for business customers outside the UAE: business name, billing address, any tax or business number given, whether the business is tax registered, the names screened against sanctions lists, and the country of the request, phone number and payment method;
Add-on purchases;
subscription changes;
failed payment records.

Card details are processed by our payment processor, currently Stripe, and are not stored directly by us.

Technical and Usage Data

We may automatically collect:

IP address;
browser type;
device information;
operating system;
log data;
session activity;
diagnostic information;
security events;
error information;
usage patterns within the Service.

This information helps us operate, secure, diagnose, and improve the Service.

Communications

We may collect communications you send to us, including:

support messages;
billing questions;
legal or privacy requests;
feedback;
emails;
messages sent through contact forms.

Where the Service provides WhatsApp links, templates, or communication tools, the Tenant remains responsible for the content and use of those communications.

Approximate country from your IP address. When you visit our home page, our own server looks up which country your IP address most likely belongs to, using a geolocation database kept on that server (MaxMind GeoLite2 Country). Your IP address is not sent to MaxMind or to any other third party for this. While you browse, the detected country is used only to choose the language we show you first and the prices we show you, and it is not saved — except that a language chosen from it may be remembered as your language preference. If you register a Workspace, the country detected at that moment is kept with your registration record as one of the signals we use to confirm the operating country you give us; the operating country you give us, not the detected one, decides the price a Workspace is billed. We never ask your browser or device for its location. The country detected at registration is kept for as long as the Workspace exists and is deleted with it.

GeoLite attribution. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.

3. How We Use Information

We use information to:

provide, operate, and maintain the Service;
create and manage accounts and Workspaces;
authenticate users;
enforce tenant isolation and role-based access;
process Subscriptions, Add-ons, invoices, and payments;
communicate about billing, support, account status, suspension, cancellation, and service updates;
send transactional communications, including verification emails, password resets, staff invitations, receipts, and system notices;
provide customer support;
diagnose technical issues;
monitor security and prevent abuse;
improve reliability, usability, and performance;
comply with legal obligations;
enforce our Terms of Use;
protect our rights, users, Tenants, and the Service.

We do not sell personal information.

We do not use Tenant Content to train third-party AI models.

We also record and use legal acceptance records to evidence your acceptance of our terms and to identify which version of those terms applies to you.

Legal bases. We process account, billing and Workspace information to provide the Service under our contract with you; technical information such as IP addresses on the basis of our legitimate interests in operating and securing the Service and in showing you a relevant language and prices first; records we must keep, to comply with our legal obligations; and our own visit statistics and Google Analytics only with your consent, which you can withdraw at any time.

4. Tenant Isolation and Security

Each Workspace is intended to operate as an isolated tenant environment.

We use reasonable technical and organizational measures designed to protect information against unauthorized access, alteration, disclosure, or destruction.

These measures may include:

encrypted connections;
hashed credentials;
access controls;
tenant separation controls;
role-based permissions;
infrastructure security measures;
logging and monitoring where appropriate.

Platform personnel may access Tenant Content only where reasonably necessary to:

provide support;
investigate technical issues;
prevent abuse;
improve service reliability;
comply with law;
enforce our terms.

Such access is limited to authorized personnel and may be logged.

No method of transmission, hosting, or storage is completely secure. We cannot guarantee absolute security.

5. How We Share Information

We do not sell personal information.

We share information only where necessary to provide, operate, secure, bill, support, or legally protect the Service.

Our service providers may include:

Payment processing: Stripe, to process subscription payments and billing.
Hosting and infrastructure: Hostinger, to host and operate the Service.
Email delivery: Hostinger or related email providers, to send transactional emails.
Storage and technical services: secure service providers used to store uploaded files, operate the application, monitor performance, or provide support.
Website analytics: Google Analytics, on public website pages only and only with consent.

We may also disclose information:

if required by law, court order, regulator, or legal process;
to protect our rights, users, Tenants, Tenant Customers, or others;
to investigate fraud, abuse, security incidents, or unlawful activity;
in connection with a merger, acquisition, restructuring, sale of assets, or transfer of the Service.

If the Service or company is transferred to another entity, we will require the successor to honor the commitments in this Privacy Policy or provide appropriate notice.

6. International Transfers

Information may be processed or stored in countries other than the country where the Tenant or Tenant Customer is located.

Where we transfer personal information across borders, we take steps intended to ensure that information receives an appropriate level of protection, consistent with applicable law.

By using the Service, the Tenant understands that information may be processed through hosting, infrastructure, payment, email, and support providers used to operate the Service.

Our hosting provider, Hostinger, stores backups of our servers in Malaysia.

7. Data Retention

We generally retain account information and Tenant Content while the Workspace remains active.

After cancellation or termination, we may retain Tenant Content for up to thirty (30) days to allow export, account recovery, or completion of administrative processes, unless a longer period is required by law or agreed in writing.

After that period, Tenant Content may be deleted from active systems.

Backup copies may remain for a limited period, typically up to ninety (90) days, before being overwritten or deleted in the ordinary course of backup rotation.

Billing, tax, audit, security, and legal records may be retained for longer where required by applicable law or legitimate business purposes.

If a Subscription is suspended or terminated for non-payment as described in our Terms of Use, Tenant Content may become inaccessible and may later be deleted in accordance with these retention practices.

Legal acceptance records are retained for as long as they may be needed to evidence the agreement they relate to, which may be longer than the Workspace itself.

Server access logs. Our web server keeps a log of requests made to the Service. Each entry records the IP address the request came from, the date and time, the page or resource requested (with the private part of customer tracking links removed), the response status and size, the referring page and the browser's user agent. Server error logs may also record the IP address of a request. We use these logs for security, abuse prevention and troubleshooting. They are rotated daily and deleted after 14 days. Specific log entries may be kept longer where they are needed to investigate a security incident or to comply with a legal obligation.

Business evidence for customers outside the UAE. We keep these details only to show why UAE VAT was not charged on a sale and that we sold to a business in the country it stated, and we use them for nothing else. Details on which no payment was made are deleted after ninety (90) days. Details on which a payment was made are kept for five (5) years after the end of the calendar year of the last invoice that relied on them, longer only during a dispute with a tax authority, even if the Workspace is deleted sooner, and are then deleted. The IP address and browser details are removed after ninety (90) days; the country of the request stays with the record. Names are checked against a local copy of sanctions lists, and your name and business are not sent to any screening provider. Access is limited to the Workspace owner and the staff who handle billing and tax.

8. Your Rights

Depending on your location and applicable law, you may have rights to:

access your personal information;
correct inaccurate personal information;
request deletion of personal information;
request export of personal information;
object to certain processing;
restrict certain processing;
withdraw consent where processing is based on consent.

For account-level requests, contact us using the details in Section 12.

For Tenant Customer information contained in Tenant Content, requests should generally be directed to the relevant Tenant first, because the Tenant is the controller of that information.

Where required by applicable law, we will support the Tenant in responding to valid requests relating to Tenant Content.

9. Tenant Customer Information

Tenants may use the Service to store information about their own customers.

This may include:

names;
phone numbers;
email addresses;
vehicle details;
vehicle service history;
invoices;
payments;
notes;
photographs;
appointment information;
quote and approval records.

The Tenant is responsible for informing its Tenant Customers about how their information is collected and used.

The Tenant is also responsible for obtaining any required consent or lawful basis for entering Tenant Customer information into the Service.

We do not have a direct contractual relationship with Tenant Customers.

10. Cookies and Similar Technologies

We use cookies or similar technologies that are necessary to operate the Service. These do not require consent and may be used to:

keep users signed in;
remember session status;
remember language preference;
remember your choice in our cookie banner;
improve security;
support essential platform functionality.

These preferences are kept in your browser for up to 12 months: your language and display currency in cookies, and your cookie banner choice in local storage. Your language preference may first be set automatically from the approximate country of your visit (see section 2); you can change it at any time with the language selector.

Our own visit statistics. These statistics are optional, and we record them only after you select "Accept" in our cookie banner, the same choice that governs Google Analytics. With your consent, to understand how visitors move through our public website and sign-up, we record a small number of events in our own database: which step happened (for example viewing pricing, starting sign-up, starting checkout or contacting us), where on the page it happened, the plan, billing cycle and trial-or-paid choice involved, the page language, a country you chose for pricing or entered during sign-up, and the campaign source and name in the link you arrived from (utm_source and utm_campaign). To connect the events of one visit, your browser keeps a random identifier in session storage, created only after you accept and deleted when you close the tab. A completed sign-up, an opened checkout and a confirmed payment are counted only if you had accepted when you signed up or opened checkout. If you select "Reject", or later withdraw your consent through "Cookie settings", we record no further events and the identifier is deleted from your browser. These records contain no IP address, browser details, name, email address or account identifier, are not shared with any third party, and are deleted after 12 months.

Analytics on our public website. With your consent, we use Google Analytics, provided by Google LLC, on our public website pages (such as our home, pricing, product tour, contact, sign-in and sign-up pages) to understand how visitors use them. It is not used inside a Tenant's Workspace, and it is not used for advertising or to build advertising profiles. Google Analytics collects information such as pages visited, device and browser type, approximate location and cookie identifiers. This information is processed by Google, including outside the United Arab Emirates. Analytics data is retained for 2 months.

Analytics cookies are only set, and our own visit statistics only recorded, if you select "Accept" in our cookie banner. You can change your choice at any time through "Cookie settings" at the bottom of our website. We do not use third-party advertising cookies or cross-site tracking cookies.

11. Children's Privacy

The Service is intended for business use by adults.

The Service is not directed at children.

We do not knowingly collect personal information from children.

If you believe a child has provided personal information to us, contact us so we can take appropriate action.

12. Changes to This Privacy Policy and Contact

We may update this Privacy Policy from time to time.

When we update it, we will update the effective date above.

For material changes, we may provide reasonable notice, such as by email or through an in-app notice.

This Privacy Policy is available in English, Arabic, Urdu, Spanish and French. If the versions differ, the English version prevails.

Questions or requests about this Privacy Policy can be directed to:

Support: support@scalepath.me
Privacy: info@scalepath.me

You may also contact us through garagecc.app or scalepath.me.

Garage Cost Control

Garage Management System

Product

Company

Legal