Last updated:
This notice concerns visits to our website, enquiries through our contact form or email, and Calendly meeting bookings. It also explains our planned use of GA4. It does not describe our customers’ own websites or replace a project-specific data processing agreement. Our AI-assisted business calls are covered by the separate notice linked below.
Who is responsible
ScaleCommerce Group AB, organisation number 559437-8761, operates All-In-One Ecom and is the controller for the processing described in this notice. Address: Kemistvägen 2 A, 183 79 Täby, Sweden. For privacy questions or requests, contact helena@theaioecom.com.
Enquiries and website forms
When you contact us, we use the information needed to understand and respond to your enquiry. A website form may ask for your name, email address, telephone number, company name and message, together with relevant project information that you choose to provide. We receive these details from you or from someone contacting us on your company’s behalf.
The contact form asks for your name, email address and message. Company name and telephone number are optional. Submissions are sent through Resend to scalecommercegroup@gmail.com. You do not need to provide contact details to browse the website. Please avoid including sensitive personal information in your message.
The intended purpose is to answer your enquiry, discuss the requested services and arrange any agreed follow-up. For a company representative, the proposed legal ground is our legitimate interest in responding to business enquiries. If you personally would be a party to an agreement, necessary steps requested by you before entering that agreement may instead provide the ground. Submitting an enquiry does not by itself mean consenting to website analytics or newsletter subscriptions.
Booking through Calendly
The booking link takes you to Calendly on a separate website; it is not embedded in our pages. When you make a booking, we receive the contact details, selected appointment time and any answers you provide in the booking flow so that we can arrange and conduct the meeting.
The same enquiry-handling purposes and proposed legal grounds above apply to our use of your booking information. Calendly also processes information under its own applicable privacy and cookie information. Review that information before completing a booking.
Planned analytics with GA4 and Google Tag Manager
We plan to use Google Analytics 4 (GA4) as our only visitor analytics tool, managed through Google Tag Manager (GTM). GTM manages the analytics tags; GA4 measures how the website is used. Neither is currently installed on this website.
The intended purpose is to understand which pages are useful and improve the website. Depending on the agreed configuration, analytics may include page visits, referral sources, interactions, device/browser information and cookie identifiers. The planned setup is for analytics, not advertising or remarketing.
The analytics implementation must exclude names, email addresses, telephone numbers and message contents. Contact-form values must not be placed in analytics events, the GTM data layer or URLs sent to Google. A form-submission event, if introduced, should record the interaction without including those field values.
Analytics consent and cookies
The current website has no GA4/GTM integration and sets no analytics or advertising cookies through its own code. Images and fonts are served with the website.
Before enabling analytics, we will introduce a choice to accept or reject optional analytics. The planned legal ground is consent. Analytics tags and optional analytics cookies must remain inactive until consent is given. Declining analytics must not prevent browsing, submitting an enquiry or following the booking link.
The planned consent controls will also let you change your choice or withdraw consent. Withdrawal does not affect the lawfulness of earlier consent-based processing. These controls are not yet implemented; the final cookie names, lifetimes and retention settings must be documented and tested before analytics is activated.
Website hosting and technical data
The website is hosted on Vercel. Serving and protecting a website involves technical information such as IP addresses, requested URLs, request times and browser or device information. Our proposed ground is our legitimate interest in delivering a reliable and secure website. The hosting configuration and retention of technical logs must be confirmed before this notice is finalised.
Who receives information
People handling your enquiry or meeting receive the information relevant to that work. Vercel hosts this website and Calendly handles bookings made through its service. Google will receive analytics information only once the planned analytics setup is enabled and you have consented.
Resend processes form submissions to forward them to our Google/Gmail inbox. Information may also be disclosed where a legal obligation requires it or where necessary to establish, exercise or defend legal claims.
Transfers outside the EU and EEA
Google/Gmail, Resend, Calendly and Vercel may involve processing outside the EU or EEA. The applicable locations, provider agreements and transfer mechanisms must be verified for the services and account configurations we actually use before this draft is finalised.
This draft does not claim that all information stays within the EU or that a particular safeguard has already been confirmed. You can contact helena@theaioecom.com for information about the arrangements applicable to your data.
Retention
Proposed criteria for enquiries and bookings: keep the information while needed to answer the request and complete agreed follow-up. If the enquiry leads to a customer relationship, information necessary for that relationship may need to be retained for the work and applicable legal obligations or claims. The retention limit for enquiries that do not become customers and the actual deletion process remain to be confirmed.
GA4 retention and cookie lifetimes will be set and documented before analytics is activated. A GA4 user/event-data retention setting is not the same as a cookie lifetime and does not apply to every aggregated report. We have not assumed a setting or claimed that analytics data is already being collected.
The hosting log and Calendly retention arrangements also need to be checked. The separate business-call notice continues to describe the existing retention rules for that service.
Resend states that email and log data is retained for 30 days on its Free, Pro and Scale plans. This is separate from how long we retain messages in our Gmail inbox; that retention period and deletion process still need to be confirmed.
Business calls
Our separate business-call notice describes AI-assisted calls, the source of business contact information, recordings, transcripts, service providers and how to object to further marketing calls.
Your rights
Depending on the processing and applicable legal conditions, you can request access, correction, erasure or restriction, object to processing based on legitimate interests, and request data portability where it applies. These rights are not absolute, for example where a legal obligation requires continued retention.
You can object to direct marketing at any time. Where processing is based on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal. Send requests to helena@theaioecom.com. We may need proportionate information to verify your identity.
You can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), or another competent supervisory authority.
Updates
We update this notice when the services or processing it describes change. The date at the top identifies the version. This draft must be completed against the actual operating arrangements before publication.