Privacy Policy

1. Introduction

ScaleX, Inc. (“ScaleX,” “we,” “us,” or “our”) provides the Maxx Command Center platform (“Maxx,” “Service”), a secure, multi-tenant enterprise portal for spend intelligence delivery. This Privacy Policy explains how we collect, use, store, and protect information when you visit our website or use Maxx.

By using our website or the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

We collect the following types of information:

• Account information — name, business email address, company name, job title, and authentication credentials provided through our identity provider, Clerk.
• Customer data — procurement, spend, vendor, engagement, budget, and initiative data uploaded by you or your organization to the Service for processing and analysis.
• Usage information — log data, IP address, browser type, device information, pages viewed, feature interactions, and access times.
• Communications — messages, support requests, and feedback you send to us.
• Cookies and similar technologies — small data files used to operate and improve the website and Service.

3. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Maxx Command Center Service;
• Authenticate users and enforce role-based and tenant-level access controls;
• Process and display your uploaded data within your authorized workspaces;
• Improve product features, performance, and user experience;
• Respond to support requests and communicate product updates;
• Monitor security, detect fraud, and enforce our Terms of Service; and
• Comply with legal obligations.

4. How We Share Information

We do not sell your personal information or Customer data. We may share information only in limited circumstances:

• Service providers — trusted vendors who perform services on our behalf, such as cloud hosting, authentication, analytics, and customer support, under confidentiality and security obligations.
• Your organization — data and activity may be visible to other authorized users within your tenant according to the permissions set by your administrators.
• Legal compliance — when required by law, court order, or to protect our rights, users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to confidentiality arrangements.

5. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• Industry-standard encryption in transit and at rest;
• PostgreSQL Row-Level Security (RLS) to enforce tenant isolation at the database layer;
• SSO-ready authentication through Clerk and role-based access control;
• Audit logging and immutable snapshots for accountability; and
• Regular security reviews and access monitoring.

No system is completely secure. You are responsible for maintaining the confidentiality of your account credentials and notifying us of any unauthorized access.

6. Data Retention

We retain your information for as long as necessary to provide the Service, fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Customer data may be deleted earlier upon written request from your organization’s authorized administrator, subject to applicable legal retention requirements.

7. Your Rights

Depending on your location, you may have rights regarding your personal information, such as the right to access, correct, delete, restrict processing, or receive a portable copy. To exercise these rights, contact us at the address below. We may verify your identity before fulfilling a request.

8. International Transfers

Maxx is hosted in the United States. If you access the Service from outside the United States, you consent to the transfer, storage, and processing of your information in the United States and other jurisdictions where our service providers operate.

9. Children’s Privacy

Maxx is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised effective date. Continued use of the Service after changes constitutes acceptance of the revised policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

privacy@maxxcommandcenter.com