Scout Privacy Policy
Effective date: 7 October 2026. Version 1.0.
1. Who this policy covers, and who we are
This policy explains what personal information Cascade AI Partners, LLC, a Texas limited liability company ("Cascade", "we"), collects when you visit RunScout.dev, use the Scout service (the "Service"), or deal with us, and what we do with it.
Scout is a business tool. Most people who use it do so because their employer or client set up a Workspace. That means we handle personal information in two different roles, and the rules differ:
| Data | Our role | What governs it |
|---|---|---|
| Account data: who you are as a user of the Service. Website and marketing data: visits to RunScout.dev, forms you submit, emails you exchange with us. Billing data. | Cascade is the controller. We decide why and how it is processed. | This policy. |
| Customer Data: everything written inside a Workspace by its members and their AI agents, and metadata pulled from integrations the Customer connects. | Cascade is a processor acting on the Customer’s instructions. The Customer, meaning the organisation that owns the Workspace, is the controller. | The Customer's own privacy policy, our Terms of Service, and the Data Processing Agreement where one has been signed. Section 5 of this policy describes what we do as processor. |
If you have a question about personal information inside a Workspace, including a request to access or delete it, contact the organisation that runs that Workspace. We will help them respond.
2. What we collect as controller
2.1 Account data
- Identity and contact: your email address; if you sign in with GitHub, Bitbucket or Google, your username, user ID, display name and avatar as that provider gives them; the handle you choose in each Workspace; your role in your organization.
- Authentication: Sign-in uses GitHub or Bitbucket, or our authentication provider Clerk for Google and for email and password. Cascade does not store passwords: Clerk stores them, and verifies your email address with a code it sends. We store session tokens and the identifiers needed to keep you signed in, and hashed versions of any API keys or seat keys you create. We never store keys in plain text after they are shown to you once.
- Seats: a label for each tool or machine you connect, when it was created and last used, and when it was revoked.
- Integration credentials: when an Admin connects a tracker such as Linear or Jira, the credential they provide (for example an API token) and the site address. Linear and Jira credentials are encrypted at rest. We use them only to read the tickets that Entries mention, and never to write to the tracker. GitHub Issues is read through the GitHub App, so no separate credential is stored for it.
2.2 Usage and technical data
- Service logs: API and MCP requests, including timestamps, the tool name each request came from, the Workspace and Seat involved, response codes and timing, and your IP address. We use these for security, debugging, rate limiting and metering, and we store them with PostHog, our analytics and logging provider, in the United States. Request logs do not include the content of Entries.
- Product analytics, error tracking and application logs: we use PostHog to understand how the dashboard and the Service are used, to capture errors, and to store the Service's application logs. Analytics covers pages viewed, features used, browser and device type, approximate location derived from IP address, and error details. Application log lines carry the Workspace, member, request and Seat they relate to. Neither analytics events nor application logs include the content of Entries.
- Metering: counts of members, seats, Entries written and bundles read per Workspace per period, used to apply plan limits and to show usage on the dashboard.
2.3 Website, forms and communications
- Information you submit through forms on RunScout.dev, such as a demo request or a Startup Program application: name, work email, company, website, team size, funding or revenue band, and anything you write in free-text fields.
- Emails and support messages you send us, and our replies.
- If you joined a waitlist before launch: the email, name, company and notes you gave us then.
2.4 Billing data
- Billing contact name and email, company name, billing address, tax identifiers where required, and the plan and seat count. Payment card details are collected and stored by Stripe, not by us. We receive the card brand, last four digits and expiry for display, and transaction records.
2.5 What we do not collect
- We do not clone your repositories and we do not store your source code. Where a Customer enables the deprecation scan or contract detection, we read the diff for a push or pull request in memory and discard it once the match completes, as described in section 5.
- We do not collect precise location.
- We do not knowingly collect information from anyone under 18. The Service is for business use.
3. How we use it, and on what basis
| Purpose | Data used | Legal basis (GDPR and UK GDPR) |
|---|---|---|
| Providing the Service: signing you in, running your Workspace, delivering bundles to your agents, sending notifications and digests you configure | Account, usage, metering | Performance of a contract |
| Security: detecting abuse, enforcing seat and rate limits, investigating incidents, keeping the audit log | Account, usage, logs | Legitimate interests in keeping the Service and customers secure; legal obligation where applicable |
| Billing and account management | Account, billing, metering | Performance of a contract; legal obligation for tax and accounting records |
| Support and communications about the Service, including service notices and trial reminders | Account, communications | Performance of a contract; legitimate interests |
| Improving the Service: understanding which features are used, finding and fixing errors | Usage, analytics | Legitimate interests in improving the product; consent where cookie law requires it |
| Marketing: telling you about Scout if you asked us to, or gave us your details on a form or waitlist | Website and form data | Consent, or legitimate interests for existing business contacts, with an unsubscribe in every message |
| Legal: complying with law, responding to lawful requests, establishing or defending claims | Any of the above as necessary | Legal obligation; legitimate interests |
Three things we do not do. We do not sell personal information. We do not use personal information or Customer Data to train machine learning models, ours or anyone else’s. We do not use your information for advertising, and we do not share it with advertising networks.
4. Cookies and similar technologies
- Strictly necessary: a session cookie that keeps you signed in to the dashboard. It is httpOnly, scoped to the Scout domain for your environment, and is not used for tracking.
- Analytics: PostHog sets identifiers to measure use of RunScout.dev and the dashboard. Where the law requires consent for analytics cookies, we ask for it before setting them, and you can withdraw it from the cookie settings link in the footer. You can also block them in your browser; the Service will still work.
- We do not use advertising cookies or third-party tracking pixels. We honour browser signals such as Global Privacy Control where the law gives them effect.
5. Customer Data: what we do as a processor
Inside a Workspace, members and their AI agents write Entries: work in progress, decisions, contract changes, lessons, handoffs, blockers, rules and current state. Those Entries can contain personal information, most often the names and handles of the people doing the work, and sometimes information about third parties that a team chooses to record. The Customer decides what is written, who can read it, and how long it is kept.
As processor we:
- process Customer Data only to provide the Service as instructed by the Customer through the Service’s features and settings, and as required by law;
- return Customer Data to the Customer's own agents when they request it through a valid Seat. Those agents may pass it to the AI model provider they use. We do not send Customer Data to any AI model provider ourselves. The Customer should account for the agents and model providers it connects in its own record of processing activities and sub-processor disclosures;
- read metadata from integrations the Customer connects. For GitHub and Bitbucket Cloud, that is pull request and push metadata such as titles, authors, branch names, file paths and status. Where the Customer enables the deprecation scan or contract detection, we also fetch the diff for the push or pull request, through the GitHub App for GitHub and through the Workspace's Bitbucket connection for Bitbucket Cloud, and match the Customer's configured patterns against it in memory. The diff is discarded once the match completes, and only the match itself is recorded as an Entry: for the deprecation scan, the name of the deprecation and a short note of what matched; for contract detection, the identifier of the interface that changed. We do not clone repositories and we do not store source code. For Linear or another tracker, ticket metadata. For Slack, we send notifications and digests the Customer configures and receive delivery status;
- keep an audit log of who wrote what, when, and from which tool, visible to the organization's Admins;
- apply the retention windows the Customer sets, never automatically removing Entries the Customer has marked as regulated;
- provide export of the whole Workspace at any time, and delete it on the Customer’s instruction or at the end of the contract as described in the Terms of Service;
- use only the subprocessors listed in section 6, and give notice of changes;
- help the Customer respond to requests from individuals, and notify the Customer without undue delay, and in any case within the period set out in our Terms of Service or a signed Data Processing Agreement, if we become aware of a security incident affecting their Customer Data.
A Data Processing Agreement setting these obligations out in full, including the standard contractual clauses and the UK International Data Transfer Addendum, is available on request from privacy@cascadeaipartners.com.
6. Who we share information with
Subprocessors. We use these providers to run the Service. Each is bound by a contract that restricts what it may do with your information.
| Provider | Purpose | Location |
|---|---|---|
| Fly.io | Application hosting and networking | United States (Virginia) |
| Fly.io Managed Postgres | Database storage and backups | Same region as the application |
| Clerk | Authentication: sign-in with Google and with email and password, email verification codes, and the account records that go with them | United States |
| Resend | Transactional email: invitations, account and billing notices, and digests | United States |
| PostHog | Product analytics, error tracking, and storage of the Service's application logs | United States (us.i.posthog.com) |
| Stripe | Payment processing and invoicing | United States and global |
| Slack | Notifications and digests, only when the Customer connects it | United States |
| GitHub, Bitbucket, Linear and Jira | Integrations, only when the Customer connects them; we read metadata from them and they receive our requests | Per provider |
The current list is kept at RunScout.dev/subprocessors. We give at least 30 days' notice before adding a subprocessor that will process Customer Data, by updating that page and emailing the organization's Admins. If you reasonably object on data protection grounds within that period, we will work with you in good faith to find an alternative; if we cannot, you may terminate the affected part of the Service and we will refund prepaid fees for the unused period.
Other disclosures. We may disclose personal information: to professional advisers under confidentiality; where required by law, subpoena or court order, in which case we will notify the affected Customer unless legally prevented and will disclose only what is required; to a successor in a merger, acquisition or sale of assets, who will be bound by this policy; or with your consent.
7. International transfers
The Service is hosted in the United States. If you use it from outside the United States, your information is transferred there. Where the GDPR or UK GDPR applies, we rely on the European Commission's standard contractual clauses and the UK International Data Transfer Addendum, which are included in our Data Processing Agreement, available on request, together with supplementary measures described on the security page. For customers in Australia, we disclose personal information to the subprocessors above, located as stated, and we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles. Regional hosting in Australia and the European Union is not available today. If you need Customer Data to remain in a particular region, contact us before you begin and we will tell you where that work stands.
8. How long we keep information
We may retain information beyond the periods below where we are required to by law, or where it is necessary to establish, exercise or defend a legal claim. Where we do, we keep it confidential, isolate it from active processing, and delete it when the requirement ends.
| Data | Retention |
|---|---|
| Account data | While your account exists, then deleted within 30 days of account deletion, except where retained under another row |
| Customer Data in an active Workspace | As long as the Workspace exists, subject to retention windows the Customer sets |
| Customer Data after a trial ends or a subscription is cancelled | Read-only and exportable for 90 days, then deleted from live systems within 30 days and from backups within a further 35 days |
| Audit log | The life of the Workspace, then deleted with it |
| Service, request and application logs | 30 days |
| Product analytics | 12 months, then aggregated or deleted |
| Billing and tax records | 7 years, as required by law |
| Support and form communications | 24 months after the last exchange |
| Backups | Rolling, purged within 35 days |
9. Security
We protect information with measures appropriate to a service that holds a team's working record: each Workspace is isolated at the database row level and that isolation is tested on every change; data is encrypted in transit and at rest; every seat has its own credential that can be revoked instantly; destructive actions require a second confirmation; and every write is attributed in an audit log. The security page at RunScout.dev/security describes these measures in more detail and is kept current. No system is perfectly secure. Where we are the controller and a breach affects your personal information, we will notify you and any regulator as the law requires. Where the breach affects Customer Data, we act as processor: we notify the Customer, which is the controller, and it decides what notification the law requires.
10. Your rights
Depending on where you are, you may have the right to ask us to: access the personal information we hold about you; correct it; delete it; restrict or object to how we use it; receive a copy in a portable format; or withdraw consent where we rely on it. You can exercise these rights by emailing privacy@cascadeaipartners.com. We will respond within the time the law requires, normally within 30 days, and may need to verify your identity first. We will not treat you differently for exercising a right.
If your information is inside a Workspace, the organisation that runs the Workspace is the controller. Send your request to them; we will assist them, and if you contact us directly we will pass your request on.
European Economic Area and United Kingdom. You may also complain to your local data protection authority.
Australia. You may request access to and correction of your personal information as set out above, and you may complain to us first and then to the Office of the Australian Information Commissioner if you are not satisfied with our response.
California. We do not sell personal information and do not share it for cross-context behavioural advertising. California residents have the rights to know, delete, correct and to non-discrimination described above. We have not sold or shared personal information in the preceding 12 months.
11. Marketing and service messages
We send service messages that are part of running your account: email verification codes, invitations, trial reminders, billing notices, security notices, and digests you configure. You cannot opt out of these while you have an account. We send marketing only to people who asked for it or who are existing business contacts, and every marketing email has an unsubscribe link.
12. Changes to this policy
We will post changes here with a new effective date. For material changes we will email the organization's Admins at least 30 days before they take effect, and give notice in the product to signed-in users.
13. Contact
Cascade AI Partners, LLC
5900 Balcones Drive, STE 100
Austin, TX 78731
Privacy questions and requests: privacy@cascadeaipartners.com
Security reports: security@cascadeaipartners.com