Skailon Privacy Policy · version 1.2

English version; there is a Spanish version with the same content: skailon.com/privacy/es.

1. Who we are

The controller of the data described in this policy is ЕЙ АЙ СИСТЕМИ ЕООД (AI Systems EOOD), a Bulgarian company with company ID (EIK) 208733960 and registered address at ul. Grigor Cheshmedzhiev 29, ap. 25A, 1404 Sofia (Bulgaria), owner of the Skailon brand. For any privacy matter: hola@skailon.com.

2. Our two roles

We are the controller of the data of those who visit skailon.com, of those who leave us their details or write to us, and of the users of our customers' accounts as regards their account, their access, their security and billing.

We are the processor of the data of our customers' contacts and leads, and of each user's activity within their company's workspace: the tasks, the messages they send and the periods during which they are connected. In those cases the controller is the business: it processes that data under its own terms and privacy policy, and we only follow its instructions, in accordance with our data processing agreement (skailon.com/legal/dpa). If you are a customer of one of those businesses, or work for it, contact that business to exercise your rights; we help it to handle them.

3. What data we process as controller, for what purpose and on what legal basis

Do not send us your customers' data by email or through the support WhatsApp: support that needs it is provided from the dashboard. If it reaches us through those channels, we move it to the dashboard and delete it from them.

Account and billing data are necessary to provide you with the service: without them we cannot create your account. The rest is voluntary.

4. Artificial intelligence

Skailon uses language models to draft replies, classify and summarise conversations, read images and documents, analyse calls and answer the questions asked in the dashboard. For each task, the necessary content is sent to the model provider, not the full history.

The provider is Anthropic, based in the USA, which may run the processing in the USA or in other regions of its infrastructure. Anthropic is contractually bound not to use that content to train its models, and deletes it within a maximum of 30 days, unless it must retain it by law or to investigate misuse.

Voice notes and calls are transcribed in the European Union (Microsoft Azure, Ireland), and the resulting text is processed like the rest of the conversation.

When we manage our own contacts, the AI does not make decisions that produce legal effects concerning you or similarly affect you.

5. Messaging and Meta

When a business connects WhatsApp, Instagram or Facebook, it does so with its own Meta accounts, and the messages pass through Meta under the terms that the business accepts with Meta.

In the dashboard, the Facebook SDK is loaded only when you press "Connect" on a Meta channel, after warning you that Meta may use its cookies.

Ad conversions are sent to Meta only if the business enables it, only with identifiers that Meta has already issued (without phone, email or name) and never if the business has declared that it processes health data. With each conversion travel the name of the event, the date and, if it is a sale, its amount.

6. Google user data and Limited Use

When a user of the Service connects their Google account (for example, to sign in with Google or to connect their Google Calendar), we access Google user data solely to provide the features that the user explicitly requests: authenticating the user, reading the availability of the connected calendar, and creating, updating or deleting the calendar events that correspond to appointments managed in Skailon. We only store the minimum data needed for those features and never use it for advertising.

Skailon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. In particular:

• we do not transfer Google user data to third parties except as necessary to provide the features described above, with the user's consent, for security purposes, or to comply with applicable law;
• we do not use Google user data for serving advertisements;
• we do not allow humans to read this data unless we have the user's affirmative agreement, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymised.

Google user data is never used to train generalised artificial-intelligence or machine-learning models.

7. Zoom data

When an administrator of a business customer connects the business's Zoom account to the Service (the "Skailon" app on the Zoom App Marketplace), we receive notifications from Zoom about the meetings and webinars of that account: when a session starts and ends, when a participant joins or leaves, and when someone registers for or cancels a registration. For sessions that have already ended (those of the last 14 days when the account is connected, and any session whose notifications did not arrive), we also read from Zoom, read-only, the list of participants of each session with their join and leave times and email, and the email of the host so that the host is not counted. We use this data solely to show the business how its live sessions went (attendance curve, peak, who stayed until the end, registrations) and to recognise which participants are already contacts of that business.

• What we store — the Zoom account ID that routes the notifications, the email of the Zoom user who connected the app, and the OAuth access and refresh tokens (encrypted at rest). For each session we store only derived facts: a one-way hash of each participant or registrant (never their name) and, if the participant's email matches an existing contact of the business, that contact's internal ID.
• What we do not store — participant names, participant emails, meeting content, recordings, chat messages or transcripts. The host of a meeting is not counted as a participant.
• Sharing — Zoom data is visible only to the business that connected the account. We do not sell it, use it for advertising or use it to train artificial-intelligence models.
• Removal — the app can be disconnected at any time from Skailon (Channels › Integrations › Zoom › Disconnect) or removed from the Zoom App Marketplace. When Zoom notifies us that the app was removed, we immediately delete the stored tokens and the email of the connected Zoom account. Instructions: skailon.com/zoom.

8. Who we share data with

Providers that process data on our behalf or on behalf of our customers, each with its data processing agreement. The full, current list, with the location and safeguard of each one, is at skailon.com/legal/subprocesadores. Today they are:

• Supabase: database and files. Data in Germany; company based in the USA.
• Render: servers, queue and cache. Data in Germany; company based in the USA.
• Anthropic: AI models. USA or other regions of its infrastructure.
• Microsoft Azure: voice transcription. Data in Ireland; company based in the USA.
• Telnyx: calls and SMS. USA.
• Resend: service emails. USA.
• Sentry: error logging. Data in Germany; company based in the USA.
• Vercel: hosting of the website and the dashboard. USA.
• Hostinger International Ltd. (Cyprus): the hola@skailon.com mailbox and our automation tool, which receives the website form (server in Paris, with backups in the Netherlands). Hostinger stores the mailboxes and their backups in the European Economic Area, without specifying the country, and sub-processors of its own based in the USA are also involved in processing the email.

For our own data, in addition:

• Stripe: payments.
• Cloudflare: anti-bot check at sign-up.
• Google: sign-in with Google and the support email, because we read and answer hola@skailon.com from a Gmail account.

Meta. When a business connects WhatsApp, Instagram or Facebook, Meta processes the messages under the terms that the business accepts with Meta (section 5). We also use WhatsApp, with our own Skailon account, for the support WhatsApp and for the conversations with you.

Integrations that the business connects with its own account (for example ElevenLabs, Fathom, Zoom, Google Calendar, GoHighLevel or ManyChat), its webhooks or its data sources: the data is sent to those services because the business configures it, and is governed by the relationship between the business and each service.

We do not sell data or use it for third-party advertising.

9. Transfers outside the European Union

Some of our providers are based in the USA or process data there:

• They process data in the USA: Anthropic (which may also use other regions), Telnyx, Resend, Vercel, Stripe, Cloudflare, Meta and Google.
• They host the data in the EU, but are companies based in the USA and may access it from there to provide support: Supabase, Render, Sentry and Microsoft.
• Hostinger: it stores the mailboxes in the European Economic Area, but the sub-processors involved in the email include US companies. The standard contractual clauses of its data processing agreement apply to those transfers.

These transfers are covered by the European Commission's standard contractual clauses and, where the provider is certified, by the EU–US Data Privacy Framework. At skailon.com/legal/subprocesadores we state the safeguard of each provider. You can ask us for a copy of the clauses by writing to hola@skailon.com.

10. How long we keep the data

• Account and access to the dashboard: for as long as the account exists. When the service ends, 30 days and then it is erased. An account without a subscription is considered terminated after 60 days without use.
• Record of acceptance of the terms: for as long as the relationship lasts and 5 years after.
• Billing: 10 years, under Bulgarian accounting law.
• Backups: what we delete according to these periods also disappears from our backups when they are renewed, within a maximum of 30 further days.
• Website form and conversations with us: the copy of the form received by our automation tool is deleted automatically within a maximum of 14 days. When we contact you, your data and the conversation are kept as a contact for 24 months from the last contact, unless you become a customer.
• Support: the messages, for as long as your account exists and 12 months after; the log of each entry into your account, for as long as the relationship lasts and 5 years after.
• Technical logs of the website and of errors: error logs, 30 days; server logs, 7 days; dashboard and website logs, 30 days.
• Data of our customers' leads: each business decides. When the service ends, the business has at least 30 days to request its return; after that it is erased, in accordance with the data processing agreement.

11. Your rights

You can ask us for access to your data, its rectification, its erasure, the restriction of its processing and its portability, and withdraw your consent whenever you wish, by writing to hola@skailon.com. We reply within one month at most.

Right to object. You can object at any time to our processing your data on the basis of legitimate interest. We will stop doing so, unless there are compelling legitimate grounds or we need the data to defend ourselves against claims. If you object to receiving commercial communications, we will always stop sending them to you.

To delete the data that reaches us through Meta you also have the instructions at skailon.com/data-deletion.

You can lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg) or with the authority of your country (in Spain, the AEPD, aepd.es).

12. Security

• Each customer is isolated from the rest in the database.
• Connections to the website, the dashboard and the services are encrypted (HTTPS).
• Channel credentials are stored encrypted.
• Access by Skailon staff uses two-step verification and is logged.

13. Cookies and browser storage

Website. It does not use analytics or advertising cookies, and the measurement of visits is aggregated and cookieless. While you fill in the form, we store in your browser what you are typing (name, email, country and phone), so as not to lose it if the page reloads; it is deleted when you send it or when you close the tab. The campaign you come from (utm, gclid, fbclid) is read from the page address and sent with the form, without storing it in your browser.

Dashboard. It uses a session cookie, essential to sign in, and another first-party cookie, lasting 30 days, which only remembers that there was a session in order to take you to the right sign-in screen. It stores in your browser the preferences you choose (theme, language, time zone, columns, pinned screens, sounds, microphone and dismissed notices), the unsent draft of the configuration chat and, if you enable them, the subscription to browser notifications. When you top up your balance in Billing, the Stripe script is loaded for the payment, which sets two cookies of its own to prevent fraud: __stripe_mid (one year) and __stripe_sid (30 minutes). There is no analytics or advertising. The Facebook SDK, which may use Meta cookies, is loaded only when you press "Connect" on a Meta channel, and we warn you beforehand.

14. Minors

Skailon is a service for businesses and is not directed at persons under 16.

15. Changes

We will give notice of important changes by email or in the dashboard. The date above indicates the current version.

For any question about privacy or to exercise your rights: hola@skailon.com.