Why you received our email
You did not sign up for anything. We found your work address in a public federal award record and wrote to you once. This page tells you exactly where it came from, what we hold, and how to make it stop.
Version 1.0 · 26 August 20261. Why you received an email from us
Scalebiz is a funding and procurement radar. It matches a company profile against open grants, tenders, loan guarantees and investor programmes in the EU, US and UK, and shows the eligibility rule and the source document behind every match.
We wrote to you because your company appears in the public SBIR/STTR award database as the recipient of a federal award, and the programmes we track are the kind your company already competes for. That is the whole reason. Nobody sold us your address, and you are not on a list we bought.
This is a one-to-one business email, not a newsletter. If it is not useful, section 8 ends it permanently in one click.
2. Who is responsible
Scalebiz is a one-person business. The person who decided to write to you, the person who holds the database, and the person who answers this address are the same person. We have not appointed a data protection officer, because at this size the law does not require one.
We are established in Serbia. Our processing of personal data is governed by the Serbian Personal Data Protection Act (Zakon o zaštiti podataka o ličnosti, ZZPL), which mirrors the GDPR. This page is the notice required by Article 24 of that Act, which applies when personal data are obtained from somewhere other than the person they describe.
3. Where your details came from
One source, and only one:
| Source | What it is | Read on |
|---|---|---|
| SBIR.gov award data | The bulk award export published by the U.S. Small Business Administration at sbir.gov/awards. It lists every SBIR and STTR award, together with the business and technical contact the awardee gave the agency. | 20 August 2026 |
This is a publicly accessible source. The contact details in it were submitted to the funding agency by your company, and published by that agency, so that third parties can reach the people responsible for the funded work. We did not scrape your website, buy a list, guess your address from a pattern, or take anything from LinkedIn or any social network.
Every contact record in our database stores the exact award page it came from. If you ask us where we got your address, we will send you that link.
4. What we hold about you
| Field | Example | Why |
|---|---|---|
| Work email address | the address this page was linked from | To write to you |
| Name | as published in the award record | So the email is addressed to a person, not to a company |
| Business role | Business POC, Principal Investigator, and similar | To judge whether the subject is relevant to your job |
| Employer and its public details | company name, website, city, state, size | To judge whether the programmes we track fit your company |
| Public award record | agency, year, phase of the award | The reason we consider the email relevant at all |
| Sending log | which message was sent, when, from which address | To prove we honoured your choices, and to never send the same thing twice |
We hold no special category data as defined by Article 17 ZZPL and Article 9 GDPR. We do not build a profile of you, we do not enrich your record from other sources, and we do not sell, rent, share or publish any of it.
We do not track whether you opened the email. Our messages carry no tracking pixel and no rewritten click-tracking links. We deliberately gave that up: the only thing we measure is whether you replied.
5. Why we may do this without asking first
The legal basis is legitimate interests, Article 12, paragraph 1, point 6 of the ZZPL, which corresponds to Article 6(1)(f) GDPR. The interest is our own: reaching businesses that are likely to need what we built, at a scale a one-person company can afford.
That basis is not automatic. It only holds if our interest does not override yours, so before sending anything we wrote down the assessment and bound ourselves to these limits:
- We write to a business role at a business address. Addresses at free consumer mail providers are excluded from our sending list by an automatic rule, not by judgement.
- The subject is directly related to what your company already does — it competes for public funding. We do not use this list for anything else, ever.
- At most four messages. After the fourth, the sequence stops on its own, whether or not you replied.
- Any negative signal ends it immediately — an unsubscribe click, a reply asking us to stop, or a bounce.
- No open tracking, as described above.
- This page is linked from every message we send, so the notice reaches you at the same moment the email does.
If we ever want to use this data for a different purpose, the assessment does not carry over. We would have to make it again, and tell you.
6. Who else handles it
| Who | What they do | Where |
|---|---|---|
| Supabase | Hosts the database the contact record sits in | European Union |
| Google (Workspace) | The mailbox the message is actually sent from | United States |
| Smartlead | Schedules the sequence and records unsubscribes | United States |
| MillionVerifier | Checks that an address still exists before anything is sent to it, so we do not mail dead accounts | European Union |
Each of these acts on our instructions under a data processing agreement, and none of them may use your details for their own purposes. Because some of them are in the United States, the data leaves Serbia and the EU; the transfer rests on the Standard Contractual Clauses in those agreements.
Nobody else sees this data. There is no advertising network, no data broker and no affiliate in the chain.
7. How long we keep it
| What | Kept | Then |
|---|---|---|
| Your contact record, if we never write to you at all | 12 months from the day we collected it | Deleted |
| Your contact record, if you never reply | 12 months from the last message we sent you | Deleted |
| Your contact record, if you ask us to stop | Deleted at once | — |
| A one-way fingerprint of your address, after you ask us to stop | Indefinitely | Kept on purpose — see below |
| Sending log | 3 years | Deleted |
Most of the addresses in our database will never be written to at all. Those records are not kept as a reserve: the same twelve-month clock runs on them from the day they were collected, and it runs whether or not we ever get round to them.
Why one thing survives deletion
When you unsubscribe we delete your record, but we keep a salted one-way fingerprint of your address. It cannot be turned back into your address, and it cannot be used to contact you. It exists for exactly one reason: if your address ever appears again in a future public export, the fingerprint matches and you are silently dropped before anything is sent.
Deleting that fingerprint too would mean forgetting that you asked us to stop, and you would hear from us again. Keeping it is how we honour your choice, and it is also required of us by the US CAN-SPAM Act, which obliges a sender to maintain a suppression list.
8. How to stop it
Three ways, all of which work, all of which are permanent:
- The unsubscribe link at the bottom of the email. One click, no form, no confirmation page, nothing to log into. Our messages also carry the one-click header that lets Gmail and Outlook show their own unsubscribe button.
- Reply and say stop. Any wording. A human reads it.
- Write to hello@scalebiz.app.
Whichever you use, the sequence stops before the next message is due. We aim to have you suppressed within one business day; US law allows ten business days and we do not intend to use them.
You never have to give a reason, and we will not send a “before you go” message asking for one.
9. Your rights
Under the ZZPL, and under the GDPR where it applies to you, you may ask us to:
- Show you what we hold — we will send the whole record, including the award page the details came from.
- Correct it if anything is wrong.
- Delete it. Subject only to the fingerprint described in section 7.
- Restrict what we do with it while a question about it is open.
- Object to the processing. Where the objection is to direct marketing, there is nothing to weigh up — we stop, full stop. That is Article 37, paragraph 2 ZZPL, and it is an absolute right.
- Receive it in a portable form.
Write to hello@scalebiz.app. We answer within one business day, and on a formal request within 30 days. We do not charge for any of this and we will not ask you to prove your identity beyond writing from the address in question.
10. Complaints
If you think we have handled your data badly, tell us first — it is one person and it will be read. If that does not settle it, you may complain to the Serbian supervisory authority:
If you are in the European Union, you may instead complain to the supervisory authority of your own country. If you are in the United States, unsolicited commercial email is regulated by the Federal Trade Commission under the CAN-SPAM Act, and complaints go to reportfraud.ftc.gov.
Our product privacy policy, which covers people who actually use Scalebiz, is a separate document: scalebiz.app/privacy/.