Scaled Future Privacy Policy

Last Modified: August 3rd, 2026

This is the Privacy Policy for Scaled Future, a registered business name of Esgrape Oy ("Scaled Future", "we", "us", or "our"), covering the website www.scaledfuture.com (the "Site") and our consulting engagements.

Scaled Future is a consulting practice that designs and operates AI-driven growth machines for its clients. Our services are delivered on the Relevantbase platform, which is operated by the same company under the business name Relevantbase. This policy covers the Scaled Future website and consulting relationship only. If you are a user of the Relevantbase platform, the Relevantbase Privacy Policy governs that service and the data processed within it.

If you have questions about this policy, email jouni@scaledfuture.com.

1. Data Controller

Esgrape Oy, operating under the business name Scaled Future

• Business ID (Y-tunnus): 2083680-9
• Address: Helsinki, Finland
• Email: jouni@scaledfuture.com
• Contact person for data protection matters: Jouni Leskinen, CEO

2. What We Collect

2.1 Website usage

We measure how the Site is used with our own first-party analytics — we do not use Google Analytics, and we run no advertising, remarketing or cross-site tracking tags on this Site.

Whether we set cookies depends on your choice in the cookie banner.

• If you accept, we set two first-party cookies: rb_vid, which distinguishes one returning browser from another and expires after 13 months, and rb_sid, which groups page views into a single visit and expires after 30 minutes of inactivity. These let us count returning visitors and understand journeys through the Site. They are set by us, readable only on our own domains, and never shared with advertising networks. Legal basis: your consent, Article 6(1)(a) GDPR.
• If you decline, nothing is stored on your device. So that our visitor counts remain meaningful, each event instead carries a rotating server-side identifier: a one-way hash of your IP address, browser user-agent, the site, and a secret that changes every day. It lets us tell two visits apart on the same day without ever storing your IP address and without placing anything on your device. Because the secret rotates daily, the identifier cannot be recomputed or linked across days — recognising you tomorrow is impossible by design, not merely by policy. Legal basis: our legitimate interest in operating and improving our website, Article 6(1)(f) GDPR.

Each event records which of the two methods identified it, so the populations are never mixed.

You can change your choice at any time using the Cookie preferences link in the footer.

For each page view we record:

• The page path and page title
• The referring URL, and campaign parameters if you arrived via a tagged link (for example utm_source, or an advertising click identifier)
• A derived traffic channel (direct, search, social, referral, AI assistant, campaign)
• Your device type (desktop, mobile, tablet), browser user-agent string, and screen and window size
• The country your request came from, derived by our load balancer
• Engagement signals: how far down the page you scrolled and how long the page was actively in view
• The date and time of the request

We do not store your IP address. Country is derived at the network edge and only the two-letter country code is retained.

Requests identified as automated (bots, crawlers, scanners, monitoring tools) are discarded and never stored.

2.2 Information you send us

If you email us, respond to a proposal, or enter into a consulting engagement, we process the contact and business information you provide — typically your name, email address, telephone number, employer, and role, together with the content of your correspondence.

2.3 What we never do on this Site

• We do not sell personal data.
• We do not run advertising, remarketing, audience-list or cross-site behavioural tracking.
• We do not build profiles of individual visitors.
• We do not use website analytics data to train AI models.

3. Why We Process It, and On What Legal Basis

Where we set the rb_vid and rb_sid cookies we do so only after you accept them, as required by the ePrivacy rules on storing information on your device. Declining leaves the Site fully functional; only the ability to recognise returning visitors is lost.

4. Where Your Data Is Held

The Site runs on Google Cloud Platform in the europe-west3 (Frankfurt, Germany) region. Website analytics events are stored in Google BigQuery in the same region. Correspondence is held in Google Workspace.

All processing described in this policy takes place within the European Union or the European Economic Area. Where a service provider may process data outside the EEA, we rely on European Commission adequacy decisions, Standard Contractual Clauses, or the EU–US Data Privacy Framework as applicable.

5. Who Receives It

We may also disclose personal data to competent authorities where they have a legal right to receive it, or where disclosure is necessary to establish, exercise or defend legal claims.

6. How Long We Keep It

• Website analytics events: 26 months from collection, after which they are deleted.
• Correspondence and enquiries: for as long as needed to deal with your enquiry, and for up to 24 months afterwards.
• Engagement records: for the duration of the engagement, and afterwards for the period required by Finnish accounting and tax law (currently six years from the end of the accounting period).

7. Security

Data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using Google Cloud's default AES-256 encryption. Access to analytics data and correspondence is restricted to personnel who need it, and the website's own service account can write analytics events but cannot read any other data.

8. Your Rights

Under the GDPR you have the right to request access to your personal data (Article 15), rectification of inaccurate data (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and to object to processing based on legitimate interests (Article 21). Where processing rests on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, email jouni@scaledfuture.com. We will respond within one month.

Where you have declined cookies, our website analytics contains no identifier that would let us locate records relating to you, so in practice we cannot action an access or erasure request against that data — Article 11 of the GDPR does not require us to acquire additional information solely to identify you. Where you have accepted cookies, quote the value of your rb_vid cookie (visible in your browser's developer tools under Storage, or we can help you find it) and we can locate and delete the associated events.

You also have the right to lodge a complaint with a supervisory authority:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) Lintulahdenkuja 4, 00530 Helsinki, Finland www.tietosuoja.fi · tietosuoja@om.fi

9. Children

The Site and our services are intended for business users and are not directed at children under 18. We do not knowingly collect personal data from children.

10. Links to Other Sites

The Site links to other websites, including relevantbase.com. This policy does not apply to sites we do not operate, and we are not responsible for their content or privacy practices.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always published at https://scaledfuture.com/privacy, and the "Last Modified" date above reflects the most recent change. Material changes will be communicated to active clients directly.