Privacy Policy

When you visit the CostX website, request a demonstration, submit a BOM, contact us, create an account, accept an invitation to a CostX organization, subscribe to CostX, or communicate with us, we may collect information you voluntarily provide.

Name; business email address; phone number; company/organization name; job title or professional role; account and login information; contact details; billing and subscription information where applicable; support and inquiry information; and other information you choose to provide.

We may automatically collect IP address, browser/device information, operating system, login and authentication activity, application activity, pages or screens accessed, session/event information, error and diagnostic information, usage statistics, security/access logs and approximate location derived from an IP address where applicable.

We may collect this information through cookies, log files, analytics tools and similar technologies.

Depending on how CostX is used, we may process BOMs and BOM structures; CAD files, CAD-derived information and drawings; product and variant information; dimensions, geometry and technical attributes; material grades; supplier and bought-out-part information; supplier prices and quotations; labour rates and cycle times; manufacturing process information; machine rates; overheads, scrap, tooling, amortization and volumes; costing assumptions; RFQ and quotation information; revision and approval information; comments, notes, files and other information entered or uploaded by users.

Because CostX uses role-based access and approval workflows, we may process user roles, permissions, project participation, approvals, revisions, timestamps, activity history and other audit information required to operate and secure the Service.

Where integrations are enabled, CostX may process information made available through connected services or systems according to permissions granted by the customer or user.

We use information to provide and operate CostX; create and administer accounts and organizations; authenticate users; manage roles and permissions; process BOMs/CAD-related information; perform costing calculations; generate reports and quote-related outputs; maintain revisions, timestamps and audit trails; facilitate approval workflows; provide demonstrations, trials, POCs and support; monitor and improve reliability and security; detect fraud, abuse and unauthorized access; communicate about accounts/subscriptions; process billing; comply with legal, regulatory and contractual requirements; and protect the rights, property and security of Scalex, customers, users and others.

CostX may use artificial intelligence, machine learning, rules-based calculations and other automated methods to support costing, data interpretation, recommendations, workflow and related functionality.

Automated processing may involve information necessary for the requested functionality and depends on the feature, configuration and inputs used.

Customer Content is not used by Scalex to train or fine-tune general-purpose AI models unless expressly agreed with the customer in writing.

Where third-party AI or machine-learning providers are used, they may process limited information on Scalex’s behalf subject to applicable contractual, confidentiality, security and data-processing requirements.

Automated costing results, recommendations and calculations may contain errors or omissions. Customers remain responsible for reviewing and validating outputs before relying on them for engineering, manufacturing, procurement, costing, pricing or quotation decisions.

“Customer Content” means BOMs, CAD files and CAD-derived information, drawings, product and variant information, material and supplier information, prices, labour rates, cycle times, manufacturing information, overheads, scrap, tooling, amortization, volumes, costing assumptions, RFQ/quotation information, files, documents, configurations and other content made available by a customer or Authorized User.

Customers retain ownership of Customer Content. Scalex does not acquire ownership merely because it processes Customer Content to provide CostX.

We process Customer Content only as necessary to provide CostX, perform requested calculations and analyses, maintain workflows and audit trails, provide support, maintain security and reliability, prevent misuse, comply with applicable law, and otherwise as authorized by the customer or applicable agreement.

CostX is designed to provide role-based access. Depending on configuration, roles may include Design, Manufacturing, Costing, Purchase, Manager and Sales.

Customer administrators determine user access and permissions within their organization, subject to the CostX plan.

CostX may maintain revisions, timestamps, approvals, user activity, workflow events and related audit information for traceability, governance, security and operation.

CostX is a decision-support platform. Customers remain responsible for reviewing Customer Content, calculations, assumptions, revisions, approvals and quote-related outputs before relying on them.

Scalex does not independently determine a customer's final quotation, pricing, procurement decision, production decision, margin target or other commercial outcome.

We may use personal information to respond to inquiries; provide support; communicate about accounts/subscriptions; send service-related notifications; provide information about CostX and requested demonstrations; communicate about security, maintenance or changes; and process billing-related communications.

Where permitted by law, we may send promotional communications. You may opt out using the instructions in those communications. Non-promotional communications necessary to provide the Service, administer an account, maintain security or comply with law may continue.

We may use aggregated, anonymized or de-identified information to understand CostX usage, monitor performance, identify trends, improve products and services, develop features, and improve security and reliability.

We do not use aggregated or de-identified information to publicly identify customers or disclose confidential Customer Content.

We do not sell Customer Content or personal information for monetary consideration.

We may share information with trusted providers supporting cloud hosting, infrastructure, authentication, storage, monitoring, analytics, customer support, communications, payment processing, security and AI/machine-learning services. Such providers are engaged to process information for relevant business purposes and subject to appropriate confidentiality/security requirements.

Information may be transferred as part of a merger, acquisition, restructuring, financing, sale of assets or similar transaction. Where required by law, appropriate notice will be provided.

We may disclose information where required by law, regulation, court order, legal process or valid governmental request, or where reasonably necessary to protect rights, property, security, customers, users or others, or investigate fraud, security issues or misuse.

CostX may integrate with CAD, ERP, procurement, supplier, authentication, cloud, communication, analytics and other supported services. When connected, CostX may access information according to permissions granted. Third parties operate under their own terms and privacy policies.

We implement reasonable technical and organizational measures designed to safeguard personal information and Customer Content against unauthorized access, disclosure, alteration, loss or destruction.

Depending on the environment, measures may include access controls; authentication and authorization; role-based/least-privilege access; encryption in transit; encryption at rest where applicable; credential protection; logging and monitoring; backup and recovery controls; security incident procedures; and secure software development practices.

No method of transmission or electronic storage can guarantee absolute security. Customers remain responsible for credentials, permissions, devices, networks and connected third-party systems.

Depending on applicable law, individuals may have rights to access personal information; request correction or deletion where applicable; request restriction; object to certain processing; request portability; withdraw consent where applicable; obtain processing information; and raise a privacy complaint.

You may exercise applicable rights using the contact details in Section 23.

Where Scalex processes personal information on behalf of a CostX customer, that customer may determine the purposes and means of processing and may be responsible for responding to individual requests. Scalex will assist as required by applicable law and contractual arrangements.

If you are a California resident and the California Consumer Privacy Act ( “CCPA”), applies to our processing of your personal information, this Section provides additional information about the categories of personal information we may collect, the purposes for which we may use or disclose that information, and applicable California privacy rights.

This Section applies to personal information collected through the CostX website, account registration, demonstrations, communications, subscriptions and use of the CostX Web Application, to the extent the CCPA applies to the relevant processing.

Where Scalex processes personal information solely on behalf of a CostX business customer and acts as a service provider or contractor under applicable California law, the relevant customer may be responsible for responding to certain California privacy requests. Scalex will process such information in accordance with the applicable customer instructions and contractual requirements.

Depending on how you interact with CostX, we may collect or process the following categories of personal information:

We may collect personal information from the following sources:

We may collect, use and disclose personal information for business and commercial purposes including:

Depending on the circumstances, personal information may be disclosed to categories of recipients that support the purposes described above, including:

We do not sell personal information for monetary consideration. We also do not knowingly share personal information for cross-context behavioral advertising in connection with ordinary CostX operation.

If our practices change in a manner that constitutes a “sale” or “sharing” under applicable California law, we will update this Privacy Policy and provide any disclosures and opt-out mechanisms required by law.

Subject to applicable law, California residents may have the following rights:

California privacy rights are subject to exceptions and limitations under applicable law. For example, a deletion request may be denied where retention is necessary to complete a transaction, detect security incidents, comply with legal obligations, exercise or defend legal claims, maintain certain internal records, or for another purpose permitted by law.

California residents may submit applicable requests using the contact information in Section 23. We may need to verify your identity before completing a request. The information requested for verification will be used for verification and request processing and not for unrelated purposes.

Where CostX processes personal information on behalf of a business customer, we may direct the request to that customer or require the customer to submit or manage the request, depending on the applicable relationship and legal requirements.

Where permitted by applicable California law, you may designate an authorized agent to submit a privacy request on your behalf. We may require appropriate documentation establishing the agent’s authority and may independently verify the identity of the individual making the request.

We will respond to verified California privacy requests within the time periods required by applicable law. Where an extension is permitted and necessary, we will provide any notice required by law.

California privacy requests may be submitted using the contact information in Section 23. If you have concerns about our response, you may have the right to contact the California Privacy Protection Agency or California Attorney General, subject to applicable law.

If you are located in the European Economic Area (“EEA”) or another jurisdiction where the General Data Protection Regulation (“GDPR”) applies, this Section describes additional information concerning the processing of Personal Data through the CostX website and Web Application.

Depending on the context, Scalex may act as a data controller when determining the purposes and means of processing personal data, for example for its own website operations, account administration, direct communications, security, billing and certain business operations.

Where a business customer determines the purposes and means of processing Personal Data through CostX and Scalex processes that Personal Data on the customer’s behalf, Scalex may act as a data processor. In such circumstances, the customer may be the controller and the processing relationship may be governed by a separate Data Processing Agreement (“DPA”) or equivalent contractual terms.

Depending on how CostX is used, Personal Data may include identity and contact information; business and professional information; account and authentication information; device, browser, IP and security information; application activity; billing and subscription information; communications; and Personal Data contained within Customer Content or connected systems.

Depending on the applicable role and legal basis, Scalex may process Personal Data to provide and administer CostX; authenticate users; manage accounts and permissions; provide customer support; process subscriptions and payments; maintain security; detect fraud and misuse; communicate about the Service; improve reliability and functionality; conduct analytics using appropriate safeguards; comply with legal obligations; and establish, exercise or defend legal claims.

Where Scalex acts as a controller, the applicable legal basis may include performance of a contract, compliance with a legal obligation, Scalex’s legitimate interests, or consent where consent is required and relied upon.

Where we rely on legitimate interests, those interests may include providing and securing CostX, preventing misuse, improving Service reliability, communicating with business customers, and protecting our legal and commercial interests, subject to applicable rights and balancing requirements.

Where Scalex acts as a processor on behalf of a customer, the customer is generally responsible for determining the appropriate legal basis for the underlying processing, and Scalex processes Personal Data in accordance with documented customer instructions and applicable contractual terms.

Depending on applicable law and the circumstances of processing, individuals may have rights including:

Individuals may contact Scalex using the details in Section 23 to exercise applicable rights. We may need to verify identity before responding.

Where Scalex acts as a processor on behalf of a CostX customer, requests may need to be directed to the customer as controller. Scalex will provide reasonable assistance to the customer as required by applicable law and the DPA or other applicable agreement.

CostX may use cloud infrastructure, technology providers and service providers located outside the EEA. Where Personal Data is transferred from the EEA to a country that is not recognized as providing an adequate level of protection, Scalex will use an appropriate transfer mechanism required by applicable law, which may include an adequacy decision, Standard Contractual Clauses, or another legally recognized safeguard.

Where Scalex relies on Standard Contractual Clauses or another transfer mechanism, supplementary technical, contractual or organizational measures may be implemented where required by applicable law and appropriate to the transfer.

Where Scalex acts as a processor, the applicable DPA may address processing instructions, confidentiality, security, sub-processors, assistance with data-subject rights, personal-data breaches, audits and deletion or return of Personal Data at the end of the processing relationship.

Scalex may use third-party service providers as sub-processors where necessary to provide CostX. Such providers may support hosting, infrastructure, authentication, storage, monitoring, communications, security, analytics, payments or AI-related functionality.

Where required by applicable law or the DPA, Scalex will provide information concerning relevant sub-processors and apply appropriate contractual obligations to them.

Scalex maintains procedures designed to identify, investigate and respond to security incidents. Where Scalex acts as a processor and becomes aware of a Personal Data breach affecting Personal Data processed on behalf of a customer, Scalex will notify the customer without undue delay as required by applicable law and the applicable DPA, subject to legal restrictions.

Individuals in the EEA may have the right to lodge a complaint with the supervisory authority in the EU/EEA country of their habitual residence, place of work, or the place of an alleged infringement, subject to applicable law.

CostX may store/process information using cloud infrastructure and service providers located in India or other jurisdictions depending on configuration. Where information crosses jurisdictions, Scalex will take reasonable steps to comply with applicable data-protection requirements. Specific data-residency commitments may be provided in a commercial agreement or DPA.

We retain information for as long as reasonably necessary to provide CostX and fulfill the purposes in this Policy. Retention may depend on information type, configuration, subscription, contractual/security requirements and law.

Customer Content may include BOM/CAD-derived information, costing data, revisions, approvals, quote information, logs and other information required to provide CostX.

After disconnection or termination, information is handled under applicable deletion/retention procedures and contractual requirements. Limited information may be retained for legal obligations, disputes, enforcement, fraud/abuse prevention, security and legitimate business records.

We maintain procedures for removing Customer Content and personal information when retention expires or deletion is required. Where appropriate, information may be removed from active systems and subsequently from backups under backup/data-removal procedures. Certain information may be retained where required by law or reasonably necessary for security, legal or business purposes.

Customer Content and personal information may be stored in databases, application infrastructure, file/object storage, logs, backups and other systems necessary to operate CostX.

Where applicable, information is encrypted in transit and at rest using appropriate security practices. Access is restricted to authorized personnel and systems based on business, security and operational requirements.

Requests for deletion of personal information or other account information may be submitted using Section 23 contact details. We will review and verify requests and process them under applicable law, contractual obligations and retention/deletion procedures.

Where CostX processes Customer Content for an organization, the organization may be responsible for submitting/managing the deletion request. Deletion may be subject to legal, contractual, security or backup retention requirements.

Unless expressly agreed in writing, Scalex does not use Customer Content to train or fine-tune general-purpose AI models.

Customer Content is processed to provide CostX functionality, including BOM/costing analysis, automated calculations, workflow support, auditability, reporting and decision support.

This does not prevent use of aggregated or de-identified information in accordance with Section 8.

The CostX website or application may contain links to or integrations with third-party websites, applications or services not controlled by Scalex. This Policy does not apply to those third parties. Review their privacy policies before providing information or connecting services.

CostX is intended for business and professional use and is not directed toward children. We do not knowingly collect, maintain or process personal information from individuals below the applicable legal age in their jurisdiction.

If you become aware that such an individual has provided information without appropriate consent, contact us so we can take reasonable steps to verify, restrict and delete the information where required by law.

We may update this Policy to reflect changes in our practices, CostX functionality, technology, business operations or applicable law. The updated Policy will be posted on the CostX website and the Effective Date will be updated. Where required, we will provide additional notice of material changes.

Privacy-related inquiries concerning both the CostX website and Web Application may be directed to the above contact details.