Privacy Policy

Account and usage data: name, email, organization, role, and in-product activity needed to operate and secure the Service.

Customer Data: legacy-system exports, connection metadata, and derived analysis (graphs, classifications, plans, Reports) a Customer uploads or connects. Customer Data may include personal data about the Customer's own end users or employees if present in the systems analyzed. Customer is the controller / business for that data; Maxis processes it as a processor / service provider under Customer's instructions and our DPA.

Billing data: handled by our payment processor (Stripe); we retain subscription and invoice metadata needed for account management, not full card numbers.

Cookies: see Section 6 below.

• To provide, secure, and support the Service for that Customer.
• To process billing and enforce entitlements (including soft-launch Assess / Monitor / Seat AI plans).
• To send account, security, and billing notifications.
• To create Aggregated Data (de-identified) for operations, security, and capacity planning — not to train generative AI models on Customer Data.
• To comply with law and enforce our Terms.

We do not use Customer Data to train, fine-tune, or improve generalized or foundational AI models, and we contractually require AI subprocessors not to do so.

Environments can be configured with residency / retention controls. An administrator can trigger deletion of findings, annotations, and collections for an environment subject to those controls and applicable law. Retention and disposition policies are configurable per organization where offered in-product.

Depending on location, individuals may have rights to access, correct, export, delete, or restrict certain processing. Organization administrators can submit data-subject / erasure requests through Scout's compliance workflows where available (default target SLA: 30 days) or via our contact form. End users of Customer's systems should contact Customer first.

We do not sell personal data. We share data with subprocessors who help operate the Service (authentication, cloud hosting, databases, storage, payment processing, email delivery, and AI inference providers), each bound by contractual confidentiality and data-protection obligations, including no training on Customer Data for AI providers. Current subprocessors: scout.alchemize.io/subprocessors.

We may also share data as required by law, or — only if Customer opts in — with the Alchemize migration platform for downstream work Customer requests.

Customer Data is not shared between Customer organizations / tenants.

Scout uses strictly necessary cookies to keep you signed in and to remember your cookie preference. Where analytics or other non-essential cookies are used, they are set only after you accept the cookie banner; you can change your choice via "Cookie preferences" in the site footer. Rejecting non-essential cookies does not block core use of the Service.

We use encryption in transit and at rest for sensitive data (including strong encryption for stored credentials where applicable), role-based access control, and audit logging of security-relevant actions. No method of transmission or storage is 100% secure.

Data may be processed in countries other than where it originated. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers. Details appear in the DPA.

We may update this Policy; the version ID and effective date appear at the top. Material changes will be notified via the Service or email at least 30 days before taking effect. We may require re-acceptance with the Terms after material changes.

Maxis Technology Inc., 27567 Bob Scott Dr., Eagle Rock, MO 65641. Questions or data-subject requests: our contact form, or your organization's Scout administrator. See also our Terms of Service.