Last updated:
This notice covers our website, contact enquiries and meeting bookings. ScaleCommerce Group AB is responsible for this processing. It does not cover our clients’ own websites. Our separate notice for business calls is linked below.
Who is responsible
ScaleCommerce Group AB, organisation number 559437-8761, operates All-In-One Ecom and is the controller for the processing described in this notice. Address: Kemistvägen 2 A, 183 79 Täby, Sweden. For privacy questions or requests, contact helena@theaioecom.com.
Enquiries and website forms
We use your contact details and message to answer questions, discuss a project and arrange the follow-up you request. Information comes from you or a colleague contacting us on your behalf. Name, email address and a message are required to submit the form; company and phone number are optional. Without the required details, we cannot handle an enquiry through the form. You can browse without providing them.
For business contacts, we rely on our legitimate interest in responding to enquiries and discussing our services (Article 6(1)(f) GDPR). If you would personally be a party to a contract, we may instead process information necessary to take steps you request before entering that contract (Article 6(1)(b)). An enquiry does not subscribe you to a newsletter or give consent to analytics.
Form messages are delivered through Resend to our company inbox at scalecommercegroup@gmail.com. Please do not include sensitive personal information. The form does not save your message in browser storage or a website database.
Booking through Calendly
Our booking link opens Calendly on a separate website. It is not embedded here. We use your booking details, contact information and answers to scheduling questions to arrange the meeting and the follow-up you request, on the same legal grounds as enquiries.
Calendly processes booking information on our behalf and also processes some information for its own purposes, as described in its privacy notice. Its own cookie controls apply when you visit its website.
Analytics and cookies
GA4 and Google Tag Manager are not currently installed on this website. Our website code does not set analytics or advertising cookies. Images and fonts are hosted with the site.
If we introduce analytics, we will update this notice and provide a choice before optional analytics starts. You will be able to decline it and withdraw consent without losing access to the website, enquiry form or booking link. We will not send form contents or contact details to analytics tools.
When you choose a language, we save your preference in a first-party cookie called aioe_language for up to one year. It contains only sv or en and selects the language when you return to the main domain. You can change your choice with the language switcher or remove the cookie in your browser settings. It is not used for analytics or advertising.
Hosting and protection against abuse
Vercel hosts the website and processes technical information such as IP addresses, requested URLs, timestamps and browser information to deliver and protect it. Our legal ground is our legitimate interest in maintaining a reliable, secure website (Article 6(1)(f)).
We use Sanity to manage public website content and deliver images. Image requests send technical connection information, such as your IP address, to its delivery infrastructure. Sanity describes logging originating IP addresses to prevent abuse. Contact-form enquiries are not sent to Sanity.
The contact endpoint temporarily uses a salted hash of the requesting IP address to limit repeated submissions. This counter expires after 15 minutes and is kept in server memory. It is not used to track browsing. Our application does not deliberately write contact-form contents to its diagnostic logs.
Who receives your information
Your information is available to the people who handle your enquiry or meeting. We use Vercel for hosting, Resend for form-email delivery, Google/Gmail for our inbox and Calendly for bookings. These providers process the information needed to provide their services. Their notices also describe processing they carry out for their own purposes.
We may disclose information when required by law or when necessary to establish, exercise or defend legal claims. We do not sell information submitted through our contact form.
International transfers
Our service providers operate internationally, including in the United States. Resend stores message content and delivery data in the US. Your information is therefore not necessarily processed only within the EU or EEA.
The providers’ published transfer arrangements include the EU–US Data Privacy Framework for transfers covered by their certification and European Commission standard contractual clauses where applicable. Resend’s data processing addendum includes those clauses; Vercel’s addendum also sets out contractual transfer safeguards. Google and Calendly describe their applicable arrangements in the notices linked below.
These safeguards and their scope are explained in the linked documents. Contact helena@theaioecom.com if you would like further information or a copy of the safeguards relevant to our handling of your information.
Resend data processing addendum
Vercel data processing addendum
Google international transfer arrangements
How long we keep information
If an enquiry does not lead to a customer relationship, we delete our enquiry correspondence and associated booking records after six months without further contact. This applies to records we control in our inbox and booking tools. Information needed for a legal obligation or a specific legal matter may be retained longer, only for as long as that reason requires.
If you become a customer, we retain the information needed to deliver the agreed work, manage the relationship and meet applicable legal obligations. Information relevant to a dispute may be kept until the matter and any applicable limitation period have ended.
Resend states that email and delivery-log data is retained for 30 days on its Free, Pro and Scale plans. This is separate from our inbox retention. Vercel currently makes runtime logs available for one hour on our Hobby plan; that access window is not a promise that all provider security records or backups are erased within one hour. Providers may retain separate records for security, legal obligations and backup recovery under their own documented retention arrangements.
Automated decisions
We do not use your website enquiry or booking details to make solely automated decisions that have legal or similarly significant effects on you. The form’s abuse checks help protect delivery; if you cannot submit the form, you can email helena@theaioecom.com.
Business calls
AI-assisted business calls, including their contact sources, recordings and retention, are covered by a separate notice.
Your rights
Depending on the processing and applicable legal conditions, you can request access, correction, erasure or restriction, object to processing based on legitimate interests, and request data portability where it applies. These rights are not absolute, for example where a legal obligation requires continued retention.
You can object to direct marketing at any time. Where processing is based on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal. Send requests to helena@theaioecom.com. We may need proportionate information to verify your identity.
You can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), or another competent supervisory authority.
Updates
We update this notice when our services or processing change. The date at the top identifies the latest version. Contact helena@theaioecom.com with questions about this notice or your personal information.