Privacy Policy

What personal data we process, why, on what legal basis, who receives it, and how long we keep it. Plain words.

Last updated: 6 November 2026

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer, as we are not required to. For any privacy question, write to the address above. More in our Legal Notice.

2. In short

• One advertising tool: the Meta Pixel, to measure our Meta ads (section 5). Visitors from the EU, the EEA, the UK and Switzerland are asked first, and nothing from Meta loads before they say yes. If the pixel is loaded when you send our application form, Meta also receives a hashed form of your e-mail address (advanced matching). With the same consent, our server reports your sign-up and your completed application to Meta as well (Conversions API). You can change your choice any time under "Cookie settings" at the bottom of our pages. No other analytics, no social media plugins. Fonts are served from our own server.
• Your application data is stored on our own rented server in Germany, in our own instance of the e-mail software Listmonk and its database. No mailing-list or CRM service sees it.
• For your page analysis we send only your shop's web address and its public pages to an AI model provider in the USA. Never your e-mail address, your name or your questionnaire answers.
• We don't open-track or click-track our e-mails. Every e-mail to you has an unsubscribe link.
• We don't sell your data. Apart from the Meta Pixel described in section 5, we don't use it for advertising.

3. Visiting our website

Hosting

Our website and all services described here run on a virtual server rented from Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany, in a data centre in Germany. Contabo provides the infrastructure and processes data only on our behalf (Art. 28 GDPR).

Server logs

When you open a page, your browser automatically sends data that our servers record in log files. Requests pass two programs on our server:

• The reverse proxy in front of all websites on the server records your IP address, date and time, the page or file requested, the HTTP status code, the amount of data sent, the referring page (referrer), your browser's identification (user agent), which internal service answered and how long it took.
• Our web server for this website records only a shortened IP address (IPv4 without the last block, IPv6 only the first three groups), date and time, the page requested without any query string, status code, amount of data and user agent. No referrer, no full IP address.

We need this to deliver the website, to find errors and to detect and defend against attacks. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website). We don't combine log data with other data and don't use it to identify visitors.

Both logs are size-limited: when they reach their limit (3 files of 10 MB each), the oldest entries are overwritten. Our web server's log is also deleted whenever we publish a new version of the website. We keep log data no longer than needed for these purposes.

Fonts and other resources

All fonts, images and scripts come from our own server. The only third-party connection is the Meta Pixel on our landing page and thank-you page, and only as described in section 5 (with the same consent, our server also reports two events to Meta, section 5). Our legal notice and this privacy policy never load it.

Abuse protection on forms

When you send one of our forms, our server uses your IP address to limit how many submissions come from one address per hour (for example at most 5 contact messages). The address is held only in the service's working memory as a counter, is dropped once it is older than an hour (checked with every new submission), is never written to a file or log, and is discarded when the service restarts. Some forms also have a total limit per hour for all senders together, which needs no IP address. Legal basis: Art. 6(1)(f) GDPR (protection against spam and abuse).

Country lookup for the cookie banner

To decide whether we must ask for your consent before loading the Meta Pixel, our landing page and thank-you page ask our server which region you are visiting from. The server looks up your IP address in a country database stored on our own server and answers only "EU/EEA/UK/Switzerland", "elsewhere" or "unknown" (unknown means: we ask). No third party is involved. The lookup itself does not store or log your IP address or the result. Like every page request, the request for it appears in the server logs described above. Legal basis: Art. 6(1)(c) and (f) GDPR (showing the consent request where the law requires it).

The country database is the free "IP to Country Lite" database by DB-IP: IP Geolocation by DB-IP, licensed under CC BY 4.0. We update it monthly.

4. Cookies and similar storage

Technically necessary cookies and storage, which need no consent:

• tsov: set only while the website is in a password-protected preview, after a guest enters the preview password. It stores a hash of the password, not the password itself, and expires after 30 days.
• tso_admin: a session cookie for our own admin area. It is set only for the operator after logging in and expires after 12 hours. Visitors never receive it.
• tso_einwilligung (in your browser's local storage, not a cookie): your choice in the cookie banner ("Accept" or "Decline") and when it expires. We keep it for 6 months; then we ask again. It never leaves your browser.
• tso_t (session storage, deleted when you close the tab): the internal link between the thank-you page and your application, so that the questionnaire still works if you reload the page. It is sent only to our own server.

Legal basis: § 25 (2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as this storage is strictly necessary for a service you or we explicitly use, and Art. 6(1)(f) GDPR.

Only with your consent (or, outside the EU, the EEA, the UK and Switzerland, unless you decline): the Meta Pixel sets the cookies _fbp and _fbc (the latter only after a click on a Meta ad) and we store the markers tso_pixel_lead and tso_pixel_bewerbung and the random event IDs tso_pixel_id_lead and tso_pixel_id_bewerbung in local storage, so that we report a sign-up or a completed application to Meta only once. Details in section 5.

5. Meta Pixel

On our landing page and our thank-you page we use the Meta Pixel, a tool of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (for visitors outside the EU, the EEA, the UK and Switzerland: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA), together "Meta".

Purpose

We use it to measure how well our ads on Facebook and Instagram work, and to show our own ads to suitable groups of people (for example people similar to those who applied, or not again to people who already applied). We don't use it for anything else and don't receive any personal profiles from Meta, only aggregated reports.

What is processed

• which of our pages you view and these events: page view, reaching the offer and application form on the landing page, arriving on the thank-you page after a sign-up, and completing the application questionnaire;
• the address of the page and the referring page on our website, date and time;
• information about your device and browser (for example browser type, operating system, screen size, language);
• your IP address, which Meta processes when your browser connects to Meta;
• the cookie _fbp (an identifier Meta sets on our domain, valid for 90 days), the cookie _fbc if you came to us by clicking a Meta ad (it holds the click identifier, also 90 days) and, if you are logged in to Facebook or Instagram in the same browser, Meta's own cookies, which let Meta link the events to your Meta account;
• when you send our application form: your e-mail address in hashed form (see below).

Advanced matching (hashed e-mail address)

We have switched on Meta's automatic advanced matching. When you send our application form, the pixel reads the e-mail address you typed in, turns it in your browser into a hash (a fixed-length code produced with SHA-256; Meta can't read the address from it, but can recognise it if it belongs to a Meta account) and sends only this hash to Meta. Meta compares it with the hashes of addresses of its own users, so that it can count your application towards the right ad even if the cookies alone aren't enough. This happens only if the pixel is loaded, that is only with your consent (or, outside the EU, the EEA, the UK and Switzerland, if you haven't declined).

Our code never sends Meta your shop link, your name, your questionnaire answers or our internal number for you, and never your e-mail address in readable form. It switches off the pixel's automatic event collection and removes our internal number from the page address before the pixel loads.

Server-side transmission (Conversions API)

When the pixel reports your sign-up (on the thank-you page) or your completed application questionnaire, our thank-you page also tells our own server, and our server sends the same event directly to Meta through Meta's Conversions API. Ad blockers and browser settings often stop the pixel; this way the event still arrives. Both reports carry the same random event ID, so Meta counts the event only once.

Our server sends: the event (sign-up or completed application), date and time, the event ID, the address of our thank-you page, your e-mail address in hashed form (SHA-256, after removing spaces and capital letters), your IP address, your browser's identification (user agent) and the cookies _fbp and _fbc if your browser has them. Never your shop link, your name, your questionnaire answers or our internal number for you, and never your e-mail address in readable form.

This happens only under the same conditions as the pixel: with your consent (or, outside the EU, the EEA, the UK and Switzerland, unless you decline; our server checks your region itself), never if your browser sends the Global Privacy Control signal, and never after you choose "Decline". Legal basis, joint controllership and transfer to the USA: as for the pixel (below). We keep only a marker that the event was sent (event ID and time, no personal data beyond our internal number); it is deleted with your application.

Consent and legal basis

Visitors from the EU, the EEA, the UK and Switzerland (and anyone whose region we can't determine) see a banner first. Nothing is loaded from Meta, not even the pixel script, until you click "Accept". Legal basis: your consent, Art. 6(1)(a) GDPR and § 25 (1) TDDDG (for the UK and Switzerland, the UK GDPR and the Swiss data protection act apply accordingly). Declining has no disadvantages.

Visitors from other countries see no banner; the pixel loads unless you decline under "Cookie settings". Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in measuring and improving our advertising. If your browser sends the Global Privacy Control signal, we treat it as "Decline" and don't load the pixel, wherever you are.

We remember your choice for 6 months (see section 4). If your browser can't store it, we ask again on your next visit and never assume a yes.

Withdrawing consent

You can change your choice or withdraw your consent at any time with effect for the future: click "Cookie settings" at the bottom of our pages and choose "Decline". We then stop sending events and delete the _fbp and _fbc cookies. You can also delete cookies and local storage in your browser.

Joint controllership with Meta

For the collection of the data on our website and its transmission to Meta, we and Meta Platforms Ireland Ltd. are joint controllers (Art. 26 GDPR). We have agreed with Meta who fulfils which obligations: Meta's Controller Addendum. Meta is responsible for the further processing after the transmission. You can exercise your rights towards us or towards Meta; we forward requests that concern Meta. How Meta processes data and how you can object there: Meta's Privacy Policy; your ad settings: facebook.com/adpreferences.

Transfer to the USA

Meta may transfer data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. states that it is certified under the EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss-U.S. framework), so transfers are based on the European Commission's adequacy decision (Art. 45 GDPR); in addition, Meta relies on standard contractual clauses (Art. 46(2)(c) GDPR). See section 15.

6. Your application

What we collect

When you apply for a founding spot or early access, you give us your shop link and your e-mail address. We store them in our own instance of the newsletter software Listmonk on our server, together with:

• your shop's domain and the shop link as you entered it (without any query string),
• the time of your sign-up and that it came from our landing page,
• the part of your e-mail address before the @ as a display name (Listmonk requires a name),
• the status of your confirmation (unconfirmed, confirmed, unsubscribed) with timestamps,
• when you confirm: the time and the IP address from which the confirmation link was opened, as proof of your confirmation,
• a counter for repeated sign-ups with the same address,
• later: the status of your application (for example open, complete, founder, waitlist, not a fit).

Legal basis: Art. 6(1)(b) GDPR. You ask to take part in our founding-spot or early-access programme; processing your application is a step prior to entering into that arrangement. Recording the proof of confirmation is based on Art. 6(1)(c) and (f) GDPR (our duty and interest to be able to prove the double opt-in).

Double opt-in

After you send the form, we e-mail you a confirmation link. Only when you click it do we start your page analysis and send you further e-mails. This makes sure nobody signs up someone else's address. If you sign up again before confirming, we send the confirmation e-mail again, at most twice and at most once per 24 hours.

If you don't confirm, we send one reminder after 48 hours. Unconfirmed sign-ups are deleted automatically 14 days after the first sign-up. Signing up again does not extend this.

If you don't get a founding spot

Applications without a founding spot are deleted completely 12 months after the sign-up: your entry in Listmonk, the decision, questionnaire answers and the analysis record. Founders' data stays as long as the founding spot lasts. Addresses on our block list (people who asked never to be e-mailed again) stay on it.

7. The application questionnaire

After signing up, you can complete your application on our thank-you page, or later through a personal link in our e-mails. The questions cover your reporting currency, sales and Meta ad spend ranges, paid outside help, recent events with your ads, how you win new customers, optionally your break-even ROAS, number of new creatives and where your business is based, and two short free-text answers about what you want solved.

Answers are mostly ranges, and every money question offers "Prefer not to say". Please don't write personal data about other people in the free-text fields.

We store your answers in a file on our server, linked to your application by an internal number (not your e-mail address). The personal link in our e-mails carries only a signed internal number. Answers we can't link to an application (for example from an outdated link) are stored without that link.

Legal basis: Art. 6(1)(b) GDPR. The answers are your application; we need them to decide on it. Giving them is voluntary, but without them we can't consider your application.

Questionnaire answers are deleted automatically 90 days after you give them.

8. Page analysis and fit check

What happens

After you confirm your e-mail address, our server opens your shop's public pages (your homepage and/or one product page) with an automated browser, exactly as any visitor would, and takes screenshots. The browser runs isolated on our server and reaches the internet only through our own outgoing proxy.

To write your analysis, we send only your shop's web address and the public content of those pages (screenshots, visible text, headings and measured page facts) to an AI model. We never send your e-mail address, your name or your questionnaire answers. The result is checked automatically and e-mailed to you, at the earliest 5 to 10 minutes after your confirmation.

Public shop pages can themselves contain personal data, for example an owner's name in the shop's legal notice or names in customer reviews. We don't look for such data; it may be part of what the model sees.

The AI provider

We use OpenRouter, Inc. (USA) to access the AI model. OpenRouter forwards the request to the model provider Anthropic, PBC (USA). According to OpenRouter, it does not use inputs or outputs to train models, and storing prompts and responses in its logs is switched off unless the customer turns it on; OpenRouter does store request metadata (such as time, model and cost), not the content. See OpenRouter's privacy policy and Anthropic's privacy policy. On transfers to the USA, see section 15.

Fit check

Separately, our server checks your shop's public homepage and public product list to see whether it runs on Shopify and sells physical products. This check runs entirely on our server; no third party is involved. Its result (fits, doesn't fit, unclear, with reasons) helps us review your application.

Legal basis and storage

Legal basis: Art. 6(1)(b) GDPR. You request the free page analysis with your application, and the fit check is part of reviewing it.

Screenshots and model responses are deleted after 90 days. After 90 days we also shorten the analysis record to your internal number and its status, so that we don't analyse the same shop twice. Shop link, analysis text and fit result are then gone.

9. E-mails we send you

All e-mails come from access@thescalingorder.com; replies go to business@thescalingorder.com. Depending on where you are in the process, you receive:

• the confirmation request (double opt-in), and once, after 48 hours, a reminder if you haven't confirmed;
• a confirmation that your application is in and your analysis is on its way;
• your page analysis, 5 to 10 minutes after confirmation at the earliest (or a note that it follows, if it is delayed);
• once, 24 to 48 hours after confirmation, a reminder if your application questionnaire is still open;
• our decision: a founding spot, a place on the waitlist for early access in waves, or that your shop is not a fit right now;
• later, e-mails about your founding spot or early access, for example when your wave opens.

Legal basis: Art. 6(1)(b) GDPR for e-mails that belong to your application and the programme you applied for. Where an e-mail goes beyond that, it is based on your consent given by confirming the double opt-in (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

Unsubscribe at any time with the link at the bottom of every e-mail, or by writing to us. Through the same link you can manage your preferences, request a copy of your data and delete your data yourself; within a minute we then also delete your decision, questionnaire answers and analysis record. If you unsubscribe, we keep your address marked as unsubscribed so that we don't e-mail you again (Art. 6(1)(f) GDPR).

We have switched off open and click tracking in our e-mail software. We don't know whether or when you open our e-mails or click links in them.

We send e-mails through the mail server of ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, who processes them on our behalf (Art. 28 GDPR).

10. How we decide

We review every complete application by hand. In our admin area we see your shop, e-mail address, confirmation status, questionnaire answers, the fit check and the page analysis. A person decides; we record who decided and when.

There is no automated decision-making within the meaning of Art. 22 GDPR. The fit check and the analysis only assist the person who decides.

Legal basis: Art. 6(1)(b) GDPR.

11. Operator alerts

So that we notice errors quickly, our server sends technical alerts and a daily status report to the operator, by e-mail and through the messaging service Telegram (Telegram Messenger Inc. / Telegram FZ-LLC). These messages never contain e-mail addresses or names. They contain at most an internal applicant number, counts and technical error messages; we remove e-mail addresses and web links from them before sending.

Telegram processes these messages on its own servers, which can be located outside the EU. Without access to our database, the internal numbers can't be linked to a person. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a reliable, secure service).

12. Contact form and e-mail

If you write to us through the contact form on our Legal Notice page, we receive your e-mail address, your message and, if you give it, your name. Our server forwards them by e-mail to business@thescalingorder.com; the form itself stores nothing and doesn't log your address or message. To prevent abuse, we accept at most 5 messages per IP address and 30 messages in total per hour (see section 3). The same applies when you e-mail us directly.

We use these data only to answer you. Legal basis: Art. 6(1)(f) GDPR (our interest in answering enquiries), and Art. 6(1)(b) GDPR if your enquiry concerns an application or a contract.

We keep your message as long as needed to deal with your enquiry and then delete it, unless statutory retention obligations require us to keep it longer.

13. If we contacted you first

This section gives the information required by Art. 14 GDPR to people we write to without prior contact, mainly founders and decision makers of online shops in the USA, the UK and Australia. The GDPR applies because we are based in the EU.

Which data

Your name, your business e-mail address, your role, the company and shop you work for, and publicly visible information about the shop.

Where it comes from

Publicly available business sources: your shop's website, public business directories, and contact-finding services that compile publicly available business contact data (for example Hunter).

Why

To contact you once by e-mail, as one business to another, about our software for Shopify brands, and to follow up if you reply.

Legal basis

Art. 6(1)(f) GDPR. Our legitimate interest is presenting our product to businesses it is relevant for. We limit this to business contact data and to a small number of messages.

How long

If you don't reply within 90 days, we delete your data. If you reply, we keep it as long as our conversation needs. If you object, we delete your data and keep only your e-mail address on a suppression list, so that we never contact you again (Art. 6(1)(c) and (f) GDPR).

Recipients

Our e-mail provider and our hosting provider (section 14), and the contact-finding service we used to find your address.

14. Service providers

We pass personal data only to the following providers, and only as far as described above:

We use our own software (Listmonk, our application service and analysis) on our own server; no other provider has access to it. The country lookup for the cookie banner also runs on our server, with a database file from DB-IP; DB-IP receives no data from us.

15. Transfers outside the EU

For the page analysis, the shop's web address and public page content go to OpenRouter and Anthropic in the USA. No e-mail addresses, names or questionnaire answers are transferred. According to OpenRouter's privacy policy, it relies on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) for transfers from the EU.

For Telegram, see section 11: only internal numbers and technical messages leave the EU.

For the Meta Pixel, Meta may transfer data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. states that it is certified under the EU-U.S. Data Privacy Framework, so the European Commission's adequacy decision applies (Art. 45 GDPR); see section 5.

16. How long we keep data

If you delete your data through the link in our e-mails, or we delete your application, your decision, questionnaire answers and analysis record are deleted with it within a minute.

17. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• have your data deleted (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• receive your data in a portable format (data portability, Art. 20 GDPR),
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR); for the Meta Pixel under "Cookie settings" at the bottom of our pages.

To use any of these rights, write to business@thescalingorder.com. Many things you can do yourself through the link in our e-mails: unsubscribe, get a copy of your data, or delete it.

18. Right to complain

You can complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work or where the alleged infringement took place. The authority responsible for us is:

19. Changes

We update this policy when our services or the law change. The current version is always on this page, with its date at the top.