Privacy policy

Draft 0.1 · October 28, 2026

1. In short

• For the people who use the dashboard, we keep only what we need to give them access and protect their account: name, email, role, sessions and what they do in the Activity log.
• What your company puts to work in skyseat (tasks, emails, documents, calls, contacts) belongs to your company: we process it on its behalf and according to its instructions, under the data processing agreement.
• Servers in the European Union (Hetzner, Germany and Finland). Some providers, such as the AI model or voice, are in the United States: you can find all of them in the list of subprocessors.
• The website uses no cookies or analytics. It only asks for your data if you send an access request through Start free. The dashboard uses only the session cookie.
• You can download your data and delete your account yourself from the dashboard, under Account › Data & privacy.

2. Who the controller is

Controller	[COMPANY NAME], with tax ID [TAX ID] and registered address at [REGISTERED ADDRESS]. Until the company is incorporated, the controller is the founder of the skyseat project.
Privacy contact	[PRIVACY EMAIL]
Data protection officer	[State whether a DPO is appointed (GDPR Art. 37 and LOPDGDD Art. 34) or remove this row]

This policy covers two different roles:

• Controller: the data of the people who use the dashboard (accounts, sessions, Activity log, notifications, billing), of anyone who requests access from the website and of anyone who visits it.
• Processor: the data your company processes with its AI employees. There, your company is the controller and skyseat only processes that data on its behalf (see section 8 and the data processing agreement).

3. What data we process as controller

Account	Name, email, password (stored only as an scrypt hash, never in plain text), the companies you belong to and your role in each one.
Sessions	Sign-in date, IP address and browser, so you can see and close your sessions and so we can detect unauthorized access.
Activity log	What you do in the dashboard that changes something (approving, assigning, changing rules or permissions, inviting…), with date, time and origin. It is the audit log your company uses to know who did what.
Mobile notifications	If you turn on notifications, the address your browser provides to deliver them (endpoint) and its encryption keys.
Billing	Once we start charging: the company’s tax details, plan and invoices. [Complete with the payment gateway once chosen]
Support	Whatever you write to us when you ask for help.
Access request	If you send one through Start free: your name, your company, your work email, your phone number if you give it, the plan you are interested in and how many AI employees you want. We do not store your IP address with it. It is stored on the platform server (Hetzner, Helsinki) and only the skyseat team can see it.
Website visits	None of your data. The hosting provider (Vercel) receives your IP address and technical browser data to serve the pages and protect them from abuse, and keeps them in its logs for a short time.

4. Purposes and legal basis

Giving you access and providing the service your company has contracted	Performance of the contract with your company (GDPR Art. 6(1)(b)) and our legitimate interest in letting the people it authorizes use the service (Art. 6(1)(f)).
Security, abuse prevention and audit log	Legitimate interest in protecting the platform and in letting each company know who did what (Art. 6(1)(f)). It is also required by the duty of security (Art. 32).
Reviewing your access request, creating your account and writing to you about it	Pre-contractual steps taken at your request (Art. 6(1)(b)). We do not use it for advertising or share it with anyone.
Mobile notifications	Your consent, which you give by turning them on in your browser and withdraw by turning them off (Art. 6(1)(a)).
Billing and tax obligations	Legal obligation (Art. 6(1)(c)).
Answering your questions	Legitimate interest or performance of the contract, depending on the case.

We do not sell data, we do not use it for advertising and we do not use it to train AI models.

5. How long

• Sessions: expire after 30 days without use and are deleted.
• IP addresses from sessions and the Activity log: deleted after 6 months.
• Account: for as long as you have it. If you delete it, your account, sessions and notifications are deleted, and in the Activity log your name becomes “Deleted person”.
• Activity log: for as long as the company exists. If the company cancels, it is deleted along with everything else after 30 days. [Set retention per plan if decided]
• Access requests: once resolved, deleted after 90 days; if nobody resolves it, after 180. If we sign you up, it becomes your account.
• Backups: daily, kept for 14 days.
• Billing: the periods required by law (6 years, Art. 30 of the Spanish Commercial Code).

6. Who else processes it

Providers that help us deliver the service (hosting, AI model, voice, phone, technical logs), under a data processing agreement and only for that purpose. The full list, with country and safeguards, is in subprocessors. We do not share data with third parties unless required by law.

7. Transfers outside the EU

Some of those providers are in the United States. We only send them data with the safeguards of Chapter V of the GDPR: the EU‑U.S. Data Privacy Framework when the provider has signed up to it and, otherwise, the European Commission’s standard contractual clauses (Decision 2021/914). The details for each one are in the list of subprocessors.

8. The data your company processes with its AI employees

AI employees work for your company with the accounts, permissions and rules it gives them: they read and write emails, fill in software, handle calls or create accounts on services. For all of that your company is the controller and skyseat is its processor: we only process that data to provide the service to it, according to its instructions and under the data processing agreement.

If you are a person who has dealt with an AI employee (by email, on a website or by phone), contact the company it works for. On calls, the AI employee says at the start that it is an AI and that the call is recorded; the rest is on the page about calls with an AI assistant.

9. Automated decisions

skyseat does not make decisions with legal effects on you based solely on automated processing (GDPR Art. 22). The platform’s automatic rules (spending caps, turning computers on and off, call routing) affect the service, not people. What an AI employee does is decided and supervised by the company it works for.

10. Your rights

You can request access to, rectification, erasure, restriction and portability of your data, object to its processing, and withdraw your consent where that is the legal basis.

• From the dashboard, under Account › Data & privacy: download your data (JSON), download your company’s data if you manage it (ZIP), cancel the company or delete your account.
• If you sent an access request, by replying to the email we send you.
• In writing to [PRIVACY EMAIL], stating what you are requesting. We reply within one month at most.
• If you think we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (AEPD) (aepd.es, C/ Jorge Juan 6, 28001 Madrid).

11. Security

Encrypted connections (HTTPS), passwords stored as scrypt hashes, keys for connected accounts encrypted (AES‑256‑GCM) with the key kept outside the database, each company separated from the others, roles, a log that cannot be modified and daily backups. The details are in Annex II of the data processing agreement.

12. Minors

skyseat is a service for businesses and professionals. It is not intended for anyone under 18.

13. Changes

If we change this policy, we will publish the new version here with its date and, if the change is significant, we will give notice in the dashboard before it takes effect.

Other documents: Terms of service · Data processing agreement · Subprocessors · Legal notice · Cookie policy · All