Privacy policy

This policy covers the website getscayla.com and the Scayla service.

Welcome to Scayla. We treat your privacy, and that of your business data, as a top priority. This policy explains, as plainly as we can, what data we collect, why, how we protect it, to whom it may be disclosed, what rights you have and how to exercise them. It is addressed to the store owner who installs and manages the service ("you", "the User" or "the Merchant").

Scayla is a business (B2B) tool for online store owners. It is not intended for children.

1. Who we are, and who controls the data

Scayla is an SEO/GEO system for online stores. Its purpose is to make a store visible and recommended in Google Search and in AI answer engines (ChatGPT, Gemini, Perplexity, Claude).

You can sign up for Scayla and use it directly in the web app at app.getscayla.com. The service also supports two platforms, and the way each connects is different:

• Shopify: an application embedded in the store's admin (app.scayla.co.il, inside Shopify Admin), installed from the Shopify App Store.
• WordPress / WooCommerce: a free plugin called Scayla Connect, installed from the wordpress.org plugin directory (or by uploading the zip), which connects the site to the service. The connection is described in full in section 3.5.

The service runs on these domains: app.getscayla.com (the web app), getscayla.com (this website), app.scayla.co.il (the Shopify-embedded app) and wp-api.scayla.co.il (the service interface for WordPress sites). Scayla also operates a Hebrew-language website at scayla.co.il.

Database owner, service operator and data controller ("we" or "the service operator"):

• Legal entity: Lior Zabari Ltd.
• Company number: 516967395 (Israel)
• Operator website: getscayla.com
• Email for contact and privacy enquiries: hello@getscayla.com

Lior Zabari is the company's contact person for privacy and accessibility enquiries. Further details, including response times, are in sections 11 and 16.

2. Our privacy principles

• We collect only the data necessary to provide and operate the service (data minimisation).
• We use data solely for the purposes described in this policy, and solely to deliver the service for your store.
• Scayla contains no advertising. We do not sell your data and we do not share it with third parties for commercial purposes.
• We do not use your data, including data received from Google, to train general-purpose AI models.
• Control stays with you: you can disconnect any source at any time, remove the Shopify app, or disconnect a WordPress site from the site itself (deleting the service user or deactivating the plugin immediately revokes the service's access).

3. What data we collect

3.1 Store owner details

• On Shopify: the email address and store details (name, domain) received from Shopify at install time.
• On WordPress / WooCommerce: the email address and site address you provide when signing up.
• When you sign up directly in the web app (app.getscayla.com): an email address and a password. We store the password only as a hash, never as plain text. If you sign in with Google, we keep only the email address of that Google account. Your workspace, the websites you add and the team members you invite are kept in the same database.
• On both platforms: the brand contact details you fill in during onboarding.

3.2 Store data on Shopify (through the Shopify scopes you approved: write_content, write_products, write_files, write_online_store_navigation)

• Products, collections, blog articles, images and alt text, and URL redirects. These are used to analyse SEO/GEO status and to generate and apply improvements to your store, as described in section 4. Every change is reversible.

3.3 Google data you connect (read-only scopes, via separate OAuth per source)

• Google Search Console (webmasters.readonly): search queries, clicks, impressions and positions for your site.
• Google Analytics 4 (analytics.readonly): traffic and conversion data for your GA4 property.
• Google Business Profile (business.manage, when enabled): locations, ratings and reviews for your business.

This data is used to measure visibility, track rankings, identify opportunities and measure ROI.

3.4 OAuth tokens

• Google refresh/access tokens are stored separately per store and are used only to read the sources above on your behalf. We request read-only scopes wherever the feature allows.

3.5 Site data on WordPress / WooCommerce (through the Scayla Connect plugin)

The following is a complete and accurate list of what leaves your site for Scayla, and when, as of Scayla Connect 1.0.8.

a. At pairing. You start this from Scayla; it arrives at your site as an authenticated request. The response sends:

• the site address and its REST API address
• WordPress and WooCommerce version numbers
• the permalink structure
• which SEO plugin was detected (Yoast SEO / Rank Math / none)
• the login name of the dedicated service user just created
• once only, in that one response: the API token the site mints for Scayla. The site itself stores only a SHA-256 hash of it, never the token.

b. While the service operates (each time Scayla's servers call the site with the paired token): the content being worked on. That is: titles and descriptions of products, posts, pages and categories; SEO titles and meta descriptions; image alt text; FAQ questions and answers; and redirect paths. In addition:

• Authors: the user ID, display name and role of the site's users who may publish. Never a login name, an email address or any other profile field.
• Changes: in a check every few minutes while the site is connected: which kinds of items changed on the site since the last check (products or categories), the ids of items that were deleted, and when each category was last edited.
• On sites that run Elementor, and only while you have post creation turned on: the colours and fonts of the Elementor kit, the global variables and classes, and the types of Elementor widgets available on the site; the newest 60 images in the media library (URL, size, title and alt text); and up to 5 published Elementor pages or posts (id, title and URL), with the heading font and the body font they actually use.

b1. When you open Scayla screens inside your WordPress admin. When a site administrator opens a Scayla screen, the browser loads it from Scayla with the admin's host name, the admin language and the screen name, and the admin page hands the screen a signed entry ticket, valid for five minutes. The ticket holds only the site's host name, the time it was issued, a random value and a signature: it identifies the site and contains no user name, email address, password, token or any other detail about the person who opened it.

c. When Scayla checks the connection (an authenticated health call): plugin version, WordPress and WooCommerce versions, the detected SEO plugin, permalink structure, site URL and home URL, locale, time zone, and the first 8 characters of the stored token hash as a connection fingerprint. The token itself is never returned.

d. For completeness. When you click Connect to Scayla, your browser goes to Scayla with your site address and admin language in the link. When a Scayla screen loads, your browser sends your admin's origin (the scheme and host, never the page's path) as the referrer. And the Elementor context above also includes the site's name, its locale and its text direction (right to left or left to right).

What never leaves your site: No visitor data, no IP addresses, no analytics data, no tracking beacons, no order or customer data, and no login names or email addresses of your site's users. No data is sent to any host other than Scayla.

One more fact we want to state plainly:

The plugin makes no outbound requests at all. It contains no HTTP client. All traffic is inbound: Scayla's servers call the site's REST API and authenticate with the paired token, and data leaves the site only inside the response to one of those authenticated requests. The plugin never contacts Scayla, on any schedule or any event, including on deactivation.

Scope of access. The service operates through a dedicated user with a narrow, fixed capability list. It cannot install plugins, manage users, change site settings, or log in to the site at all.

We do not collect device location data, and we do not access the camera, microphone or contacts.

4. Why we use the data

1. Providing the service: measuring visibility in Google and in AI engines, keyword research, generating content and metadata suggestions, and applying improvements to the store. By default, no change reaches the store without a person's approval. A workspace administrator may choose, per website, to let the kinds of work they select go live on their own once they pass Scayla's review. Each such change is recorded, emailed to the workspace's administrators, and can be rolled back. Elementor blog posts are never published automatically: each one needs two approvals by a workspace administrator, first to build the draft and then to publish it, and undoing a publish or discarding a draft always works. 2. Weekly share-of-voice measurement against competitors. 3. Necessary operational communication (for example service updates and replies to enquiries). 4. Maintaining service integrity, preventing abuse, and complying with legal requirements.

We will not use the data for purposes incompatible with the above, except with your consent or as required by law.

5. Use of Google API data: Limited Use

Scayla's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is used only to provide or improve user-facing features visible in the Scayla interface; is not transferred to others except as needed to provide or improve those features, to comply with law, or as part of a merger; is not used for advertising and is not sold; and humans do not read the data, except with your consent for support, for security purposes, or as required by law.

6. AI content generation

To generate SEO/GEO content and suggestions, relevant store content (for example product titles and descriptions, and topics) is sent to Google Vertex AI (Gemini), which runs in Google Cloud in the United States, for processing and output for your store only. This data is not used to train our models or Google's. For measurement only of public ChatGPT answers, we run queries against OpenAI; we do not send your store's private data for that purpose.

When you connect Google Search Console or Google Analytics 4 to a website, Scayla also sends Vertex AI aggregated figures from them, for that website only: the searches the website appears for (with clicks, impressions and position), and the pages visitors land on and the AI assistants that sent them (with visit and key-event counts). These figures are used only to ground the research and content Scayla prepares for that same website, and are not used to train our models or Google's.

7. Third-party services (our data processors)

We use infrastructure providers acting as data processors, and govern our engagement with them through data processing agreements (DPAs). We are responsible for choosing them and for the contractual arrangements with them, but we do not control their internal operations; references to their policies are for information only:

• Shopify: for Shopify stores only, the platform the app runs inside, and the origin of store data. WordPress sites do not pass through Shopify at any stage.
• Google Cloud: Vertex AI/Gemini (generation, in the United States), Cloud Run hosting and database (region me-west1, Tel Aviv), and calls to Google APIs. To show how many people search a phrase each month, Scayla sends the search phrases you follow, and the ones it suggests you follow, to Google's Keyword Planner through the Google Ads API. Only the phrases are sent, with the country and language you chose.
• Serper: To show where your website appears on Google, Scayla sends the search phrases you follow to Serper (serper.dev), a service that runs the search on Google and returns the results. Only the phrases are sent, with the country and language you chose.
• OpenAI: in the United States, for measuring ChatGPT answers only (not for content generation, and no private store data is sent).
• Cloudflare: network/edge infrastructure, and cookieless, aggregate analytics for this website.
• Google Analytics 4: visit measurement for this website, loaded only after you accept the cookie request and never before.
• Calendly: the scheduling service that opens when you book a demo. It receives the details you enter there (such as your name and email address) and handles them under its own privacy policy.
• Resend: sends the service's emails: password resets and notifications.
• Payment processor: for billing outside Shopify, a licensed payment processor operating in Israel. Card details are provided directly to the processor over an encrypted connection and are never stored by us. The seller and the charging party is Lior Zabari Ltd., and the invoice is issued in its name (terms of service, section 8.2).

8. Where data is stored

Data is stored in Google Cloud: hosting and the production database are in region me-west1 (Tel Aviv). AI content generation (Vertex AI / Gemini) runs in the United States, so the relevant content is sent there for processing. Calls to Google APIs run on Google's global infrastructure.

9. Transfers outside Israel

Infrastructure providers (Google and others) may store and process data on servers outside Israel, including in the United States. In particular, AI content generation in Vertex AI (Gemini) runs in the United States, and so does the measurement against OpenAI. Transfers rely on the exceptions in the Israeli Privacy Protection Regulations (Transfer of Data to Databases Abroad), 2001: (1) your informed consent, given when you accept this policy at sign-up or install time; and (2) the receiving provider's written contractual undertaking (in the DPA) to protect the data at a level consistent with Israeli law principles. The United States is not in itself recognised as automatically ensuring an "adequate level of protection", so transfers rely on the grounds above.

10. Data security

We apply reasonable and accepted measures appropriate to the nature and scope of the data, and no lower than the intermediate security level: tokens are stored separately per store and used only for the reads you approved; reliance on Google's secured cloud infrastructure with per-store permissions; authentication through OAuth. On the WordPress side, the site stores only a SHA-256 hash of the service token, never the token itself. No system is completely immune. In the event of a serious security incident we will act according to law, including the Privacy Protection Regulations (Data Security), 2017, and will notify the authority and data subjects as required.

11. Data Protection Officer

We have assessed the scope of our activity and the nature of the data. As of this date we do not consider that a statutory obligation to appoint a DPO applies; should such an obligation arise we will appoint one and update this policy. The contact for privacy enquiries is as set out in sections 1 and 16.

12. Retention

• Store data, Google data and tokens: retained while Scayla is connected and needed to provide the service.
• On Shopify · following app removal, Shopify's mandatory webhooks (shop/redact, customers/redact), or a deletion request: all related records (including Google tokens and generated content) are deleted (cascade), within a reasonable time and in any event no later than 30 days.
• On WordPress / WooCommerce · how to disconnect and delete: disconnection is immediate and is done from the site side, without depending on us: deleting the service user or deactivating the plugin revokes the token, and from that moment Scayla's servers cannot access the site. To delete data held by us, send a request to hello@getscayla.com; deletion will be completed within a reasonable time and in any event no later than 30 days. The same window applies to subscription cancellation.
• Operational and technical logs: up to 12 months, unless required otherwise to investigate an incident or by law.
• Data required to be retained by law: for the applicable statutory period, then deleted or anonymised.

13. Your rights

Under applicable law you have rights of access, correction, deletion and withdrawal of consent regarding your data. Some actions can be performed directly in the service (disconnecting a source, removing the app, disconnecting a WordPress site). For consolidated access or full deletion, contact us at hello@getscayla.com. We will respond within a reasonable time, and in any event no later than 30 days, unless a reasoned extension is required. If you believe your rights have been infringed, you may file a complaint with the Israeli Privacy Protection Authority at the Ministry of Justice.

13A. If you are in the EEA, the United Kingdom or California

Where the GDPR, the UK GDPR or the California Consumer Privacy Act applies to you, you have the rights those laws give you, including access, correction, deletion, objection and portability. To use any of them, write to hello@getscayla.com. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

14. Cookies

The Shopify app runs inside Shopify Admin and uses strictly necessary technical cookies only (session state and preferences). Scayla contains no advertising cookies and we do not run remarketing. The WordPress plugin sets no cookies at all and loads no script or stylesheet on your site.

On this website (getscayla.com):

1. Measurement, only after consent. A consent request is shown on your first visit. Until you accept, the measurement tool (Google Analytics 4) is not loaded at all: no request is sent to Google's servers and no cookie is written. Accepting enables it; "Essential only" leaves it off and deletes any measurement cookies already in your browser. Measurement runs with IP anonymisation, and Google's advertising features are blocked either way. 2. Change your choice at any time. Every page footer has a "Cookie settings" link that brings the consent request back. 3. Booking a meeting. Clicking "Book a demo" opens the Calendly interface. Calendly may set its own cookies as part of the booking flow, subject to its own policy. 4. Cloudflare performance measurement. Our hosting provider measures load times at the network level. This measurement uses no cookies and does not identify an individual visitor.

Your choice is stored locally in your browser (localStorage) and is not sent to us.

15. Accessibility

We work to make this website and the service accessible. The full accessibility statement, including what still falls short, is at getscayla.com/accessibility. Enquiries: hello@getscayla.com.

16. Changes and contact

We may update this policy; a material change concerning collection, use or transfer of data will be brought to your attention, and where necessary we will ask for renewed consent. Governing law is the law of the State of Israel, and jurisdiction lies with the competent courts in Israel. This policy is also published in Hebrew at scayla.co.il. If the two versions ever conflict, the Hebrew version prevails.

• Service operator / data controller: Lior Zabari Ltd., company number 516967395 (getscayla.com)
• Privacy and accessibility contact: Lior Zabari · hello@getscayla.com