Privacy Policy

The German version of this policy is binding; this English version is provided for information.

1. Controller and contact

The controller for the processing described in this policy is:

Webvines
Hofgartenstraße 28a, 86551 Aichach, Deutschland
Email: support@skaldion.de

Data protection contact: support@skaldion.de

2. What this policy covers and what it does not

This policy covers Skaldion Chat Agent as the controller's own offering: the product page, the legal pages, the information page about our crawler, the customer centre with accounts and members, ordering and payment, our emails and the setup assistant.

It does not cover the chats on our customers' websites: if you use a company's chat assistant on its website, that company is the controller. We only process your details and messages on its behalf and on its instructions (Art. 28 GDPR). Which data, for what purpose and for how long is set out in that company's privacy policy; please also address requests regarding your rights there. If you contact us, we forward your request to the company. Only where we offer a chat assistant on our own product page are we responsible for it ourselves (section 10).

3. Visiting the website and server logs

When you visit our pages, our server processes your IP address, time, requested address, browser identifier and referring page. In the access log we only store the IP address in shortened form (IPv4 to the first three blocks, IPv6 to the first 48 bits); access keys and tokens in addresses are redacted. Application logs contain no conversation content.

• Purpose and legal basis: delivering the pages, secure and stable operation, troubleshooting, protection against abuse (Art. 6(1)(f) GDPR).
• How long: 14 days.

4. Cookies, browser storage, fonts

We only set technically necessary cookies: a session cookie, a cookie protecting against forged requests and, if you choose "Stay logged in" when logging in, a cookie that recognises you until you log out. In the session we remember your language and, in the customer centre, the selected account. The session ends 120 minutes after your last activity. The legal basis is Section 25(2) no. 2 TDDDG; subsequent processing is based on Art. 6(1)(b) or (f) GDPR.

We use no analytics, tracking or advertising services and do not load content from other servers. We serve fonts ourselves; no data is transferred to font providers.

5. Registration and customer account

For an account in the customer centre we process first and last name, company, email address, the password (only as a hash), your language and your confirmation that you have read this policy. On registration you accept the terms and conditions and the data processing agreement on behalf of your company; we store the time, account, your IP address in shortened form, the language, version and checksum of the documents accepted. You confirm your email address via a link valid for 60 minutes. If an address is already registered, we send a notice to that address instead of creating a new account. To prevent automated registrations, we check a hidden field and the time until submission.

In your account you can change your name, language, email address (with confirmation to the new address) and password and voluntarily set up a second factor (one-time codes from an app with recovery codes; we store both encrypted). We limit failed login and code attempts; for this we briefly process counters per account and IP address. A new password or a new email address ends your other sessions. You can delete your account yourself in the customer centre.

• Purpose and legal basis: providing the account and performing the contract (Art. 6(1)(b) GDPR); account security and evidence of acceptance of the contract documents (Art. 6(1)(f) GDPR).
• How long: unconfirmed registrations 7 days; accounts until you delete them or your company's access is deleted; evidence of acceptance like contract data (section 7).

6. Members and invitations

Owners of an account can invite further persons with a role (owner, administrator, editor, agent). For this we process the invited person's email address, the role and who sent the invitation. The invitation link is valid for 7 days; we only store it as a hash. Invitees create an account under section 5 or log in with their existing account.

• Purpose and legal basis: collaboration within the customer's account (Art. 6(1)(b) GDPR towards the customer; towards invited employees Art. 6(1)(f) GDPR, our and the customer's interest in collaboration within the account).
• How long: invitations 30 days after expiry or acceptance; memberships until removed.

7. Order, contract and licence management

For an order we process your company's contract data (company name, address, country, VAT identification number, email address for invoices), plan, order and status, the acceptance of the contract documents (as in section 5) and the status and term of the subscription. For licence, plan and monitoring we transmit the tenant ID, company name, address, country, VAT identification number, plan and status to our licence system. It is a separate system of the same controller and is operated at Hetzner Online GmbH in Germany; it receives no email addresses and no visitor data.

• Purpose and legal basis: conclusion and performance of the contract (Art. 6(1)(b) GDPR); retention under commercial and tax law (Art. 6(1)(c) GDPR).
• How long: for the term of the contract, then according to statutory retention periods (Section 257 HGB, Section 147 AO: six or ten years).

8. Payment via Stripe

We process payments via Stripe (Stripe Payments Europe, Limited, Dublin, Ireland). You enter your payment details directly on Stripe's pages; we do not receive them. We transmit to Stripe the company name, email address, address, VAT identification number, plan and price as well as IDs of the account and the order. From Stripe we receive the status of payments and subscription, invoices and the type and last digits of the payment method. You manage invoices and payment methods in Stripe's customer portal.

• Purpose and legal basis: payment, invoices, tax calculation, dunning (Art. 6(1)(b) GDPR); retention of invoices (Art. 6(1)(c) GDPR).
• Role of Stripe: Stripe processes the data partly on our behalf and partly as an independent controller, in particular for fraud prevention and to comply with financial supervisory obligations. Stripe's privacy policy applies: https://stripe.com/privacy.
• Third country: Stripe belongs to a group headquartered in the USA; data may be transferred there. Stripe, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); Stripe also uses standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).
• How long: at Stripe according to its own periods; invoices ten years.

Stripe never receives data of chat visitors.

9. Emails

We send you emails relating to your account and contract: confirmation of your email address, welcome, invitations, password reset link (valid for 60 minutes), reminder of the end of the trial, quota warnings, order, payment and notices under the terms and conditions. We do not send advertising emails or newsletters.

• Purpose and legal basis: performance of the contract and account security (Art. 6(1)(b) and (f) GDPR).
• Service provider: we use an email service as processor for delivery: SiteGround Spain S.L.. It receives the recipient address, subject, content and technical delivery data.
• How long: until they are sent, emails are only stored encrypted by us. We keep no log of which email went to whom.

10. Our own chat assistant

If we offer a chat assistant on our own product page, the information we provide to our customers for their privacy policies applies: your questions and the answers, details you provide yourself, a summary to our team; processing by the AI providers under section 12. The legal basis is Art. 6(1)(b) GDPR (enquiries about our offering) or Art. 6(1)(f) GDPR (answering questions quickly). We delete conversations 90 days after the last message. The chat window points out that you are talking to an AI system and that answers may contain errors.

11. Setup assistant and feedback

In the customer centre, an AI assistant helps set up a chat assistant and makes suggestions from uploaded documents. Your messages to the assistant, the current settings and, where applicable, document text are sent to an AI provider for this purpose (section 12). Requests that the assistant could not fulfil or that you rejected are stored encrypted with category, time, account and tenant in order to improve the assistant and the platform; only your last message, shortened to 500 characters. We only adopt individual examples permanently into the assistant's rules after removing information about persons and about the customer.

• Purpose and legal basis: providing the assistant (Art. 6(1)(b) GDPR); improvement (Art. 6(1)(f) GDPR).
• How long: feedback 90 days.

In addition, for each call to an AI provider we record tenant, chat assistant, purpose, provider, model, number of tokens, costs and response times, without content, for quotas, billing and operation (Art. 6(1)(b) and (f) GDPR).

12. AI providers

Answers, summaries and suggestions are generated by language models of AI providers in the European Union acting as our processors: Scaleway SAS (Paris, France) and, as second provider, mittwald CM Service GmbH & Co. KG (Espelkamp, Germany). For each request they only receive the data required, over an encrypted connection, and do not use it to train models. We do not use your data for training either.

13. Reading websites: our crawler SkaldionBot

On a customer's instruction, our crawler reads publicly accessible pages of that customer's website so that the chat assistant can answer from them. It identifies itself as SkaldionBot with a link to our information page, respects robots.txt and only reads pages of the released domain. The customer confirms that it is authorised to do so. If the pages contain personal data (e.g. contact persons), we process it on the customer's behalf (section 2). Website operators receive our server's IP address, not data about individuals.

14. Hosting and backups

The platform runs on a server of Contabo GmbH in a data centre in Germany. Backups are encrypted daily, stored in a Storage Box of Hetzner Online GmbH in Germany and deleted after 7 days. Both are our processors (Art. 28 GDPR). The legal basis is Art. 6(1)(f) GDPR (secure operation, recoverability) and Art. 32 GDPR.

15. Recipients and transfers to third countries

Recipients are the processors named (hosting, backups, AI providers, email service), Stripe and, where we are legally obliged, authorities. A transfer to a third country is only possible via Stripe (section 8); all other recipients process the data in the EU.

16. Retention periods at a glance

17. Obligation to provide data

For an account and a contract we need the details marked as mandatory; without them we cannot create an account or conclude a contract. You are not legally obliged to provide them.

18. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). Please contact support@skaldion.de. You can change or delete many details yourself in the customer centre.

19. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The authority competent for us is the supervisory authority of the German federal state in which we have our registered place of business.

20. No automated decision-making, no advertising, no AI training

We do not make automated decisions within the meaning of Art. 22 GDPR, do not create profiles and do not use your data for advertising or to train AI models.

21. Changes

We adapt this policy when our offering or the legal situation changes. The version published here applies; we notify customers of significant changes by email.

This policy is available in German and English; the German version is binding.