Privacy Policy

This Privacy Policy explains how ЕЙ АЙ СИСТЕМИ ЕООД ("we", "us", the "Company") collects, uses, shares and protects personal data in connection with our website skailon.com and the software platforms we operate under the Skailon brand (each a "Service"), including our commercial automation platform that connects to messaging channels such as WhatsApp, Instagram, Facebook, SMS and email on behalf of our business customers.

We act as data controller for personal data relating to our website visitors and the account holders of our business customers. When our business customers use the Service to communicate with their own contacts and leads, we act as a data processor on their behalf, and the business customer is the controller of that contact data.

1. Personal data we collect

• Account & identity data — name, business name, email, phone, role, login credentials.
• Channel & connection data — identifiers required to connect messaging accounts (e.g. WhatsApp Business Account IDs, phone number IDs, Meta business IDs) and access tokens.
• Communications content — the messages, attachments and metadata exchanged through the connected channels and processed by the Service.
• Billing data — plan, transaction records and limited payment metadata. Card details are handled directly by our payment processor and are not stored by us.
• Usage & technical data — IP address, device and browser data, log files, and product usage events.
• Support data — information you provide when contacting us.

2. Purposes and legal bases (GDPR Art. 6)

3. Messaging channels and Meta / WhatsApp

When our business customers connect a WhatsApp Business Account through the official WhatsApp Business Platform (Cloud API), message data is transmitted through and hosted on Meta's infrastructure and is subject to Meta's own terms and privacy practices. We process this data solely to deliver, receive and manage messages on behalf of the business customer. We do not use the content of end-user conversations to train general-purpose models, and we do not sell personal data.

4. Google user data and Limited Use

When a user of the Service connects their Google account (for example, to sign in with Google or to connect their Google Calendar), we access Google user data solely to provide the features that the user explicitly requests: authenticating the user, reading the availability of the connected calendar, and creating, updating or deleting the calendar events that correspond to appointments managed in Skailon. We only store the minimum data needed for those features and never use it for advertising.

Skailon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. In particular: we do not transfer Google user data to third parties except as necessary to provide the features described above, with the user's consent, for security purposes, or to comply with applicable law; we do not use Google user data for serving advertisements; and we do not allow humans to read this data unless we have the user's affirmative agreement, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymised. Google user data is never used to train generalised artificial-intelligence or machine-learning models.

5. Artificial intelligence processing

The Service uses large language models to draft and automate responses. Message content necessary to generate a reply may be transmitted to our AI sub-processors for that single purpose. We apply contractual safeguards prohibiting our AI sub-processors from using that content to train their models.

6. Sub-processors

We rely on the following categories of sub-processors, each bound by a data processing agreement:

A current list of sub-processors is available on request at hola@skailon.com.

7. International transfers

Some of our sub-processors are located in, or transfer data to, the United States. Where personal data leaves the European Economic Area, we rely on appropriate safeguards, namely the European Commission's Standard Contractual Clauses and, where applicable, the providers' certification under the EU–US Data Privacy Framework. Copies of the relevant safeguards are available on request.

8. Data retention

We retain personal data for as long as the related account is active and as needed to provide the Service, then for the periods required by law (e.g. accounting and tax records). Conversation data is retained according to the business customer's configuration and is deleted on account closure, subject to legal retention obligations.

9. Your rights

Subject to the GDPR, you have the right to access, rectify, erase, restrict and port your personal data, to object to certain processing, and to withdraw consent at any time. To exercise these rights, contact us at hola@skailon.com. You may also request deletion of your data following our data deletion instructions.

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, cpdp.bg) or with the supervisory authority of your habitual residence.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, tenant isolation and audit logging.

11. Cookies

Our website uses strictly necessary cookies and, with your consent, analytics cookies. You can manage your preferences through the cookie banner.

12. Changes

We may update this Policy from time to time. Material changes will be notified through the Service or by email. The "last updated" date above reflects the current version.

13. Contact

For any privacy question or to exercise your rights: hola@skailon.com.