Privacy Policy

Privacy Policy

This Privacy Policy explains how Etalyon Sàrl-S, operating Squillify ("Squillify", "we", "us", or "our"), collects, uses, shares, protects, and retains personal data in connection with the Squillify website, dashboard, APIs, microskill execution platform, documentation, billing, support, and related services.

This Privacy Policy is a draft and is not effective until published as active by Squillify. It is designed for legal review before launch.

1. Who we are

Squillify is operated by Etalyon Sàrl-S, a Luxembourg simplified private limited liability company (société à responsabilité limitée simplifiée).

• Registered office: 8, rue des Mérovingiens, L-8070 Bertrange, Luxembourg
• Luxembourg Trade and Companies Register (RCS): B290312
• VAT identification number: LU36086963
• Establishment authorisation shown in the current corporate evidence: 10173035/0

For privacy questions or requests, contact:

• Privacy: [email protected]
• Legal: [email protected]
• Security: [email protected]

If Squillify appoints a Data Protection Officer or EU representative in the future, this policy will be updated with the relevant contact details.

2. Scope of this policy

This policy applies to personal data processed by Squillify when:

• you visit the Squillify website;
• you create or manage an account;
• you use the Squillify dashboard;
• you create, manage, or use a tenant;
• you create, manage, or use API keys;
• your applications, agents, scripts, or integrations use the Squillify API;
• you use microskills;
• you subscribe to a plan or pay for the service;
• you contact support, legal, security, privacy, or abuse channels;
• you interact with Squillify documentation, communications, or service notices.

This policy covers Squillify's own privacy practices. Where Squillify processes personal data on behalf of a customer as a processor, the Data Processing Agreement also applies.

3. Roles under data protection law

3.1 Squillify as controller

Squillify acts as controller for personal data that it determines how and why to process, including:

• account administration;
• tenant administration;
• authentication and access management;
• billing and invoicing administration;
• support communications;
• security monitoring;
• abuse prevention;
• platform analytics;
• legal compliance;
• business records.

3.2 Customer as controller and Squillify as processor

For personal data submitted by a customer, its users, applications, agents, API keys, or integrations into microskill payloads or files, the customer generally acts as controller and Squillify acts as processor.

The customer determines what data is submitted to Squillify and is responsible for ensuring that such submission is lawful, authorised, and compliant with its own policies and applicable law.

The Data Processing Agreement describes this processor relationship.

4. Personal data we collect

Depending on how you use Squillify, we may process the following categories of personal data.

4.1 Account data

• name;
• email address;
• login identifier;
• account status;
• account preferences;
• account creation and update dates.

4.2 Authentication and access data

• authentication identifiers;
• session data;
• organisation or tenant membership;
• role and permission information;
• login events;
• security challenge or verification events;
• identity provider metadata.

4.3 Tenant and administration data

• tenant name;
• tenant identifiers;
• organisation metadata;
• administrator and member records;
• invited users;
• role assignments;
• access control settings;
• API key metadata;
• skill access settings;
• quota and rate-limit settings.

4.4 API, usage, and telemetry metadata

• request timestamps;
• tenant identifiers;
• API key identifiers or derived identifiers;
• microskill identifiers;
• execution status;
• error codes;
• latency and performance metrics;
• quota and rate-limit events;
• usage counters;
• billing counters;
• file metadata where files are used;
• operational metadata required for security, reliability, billing, and abuse prevention.

Squillify's telemetry model is designed to be metadata-only and not to permanently store raw submitted microskill payloads as part of normal execution.

4.5 Microskill payloads and files

Microskill inputs, outputs, and files may contain personal data if the customer submits personal data.

Squillify processes such data transiently to perform the requested microskill execution. Raw submitted microskill payloads are not intended to be retained after that execution as part of normal operation. Limited retention may still occur where a file feature is requested, a customer deliberately supplies an example to support, or retention is necessary for security, billing, dispute handling, or compliance with law. Those exceptions must follow the specific retention and access rules described in the related policies.

Where file handling is used, temporary files may be stored for a short period to perform the requested operation and make results available. Temporary file handling is described in the File Handling Policy and Data Retention Policy.

Squillify does not determine whether customer-submitted payloads contain personal data, sensitive data, confidential data, regulated data, or third-party data. Customers are responsible for deciding what their users, agents, applications, and API keys may submit.

4.6 Billing and payment data

Depending on the payment setup, we may process:

• billing name;
• billing address;
• company name;
• VAT or tax identifier;
• billing email;
• plan information;
• invoices;
• subscription status;
• payment status;
• payment method metadata;
• transaction identifiers;
• dispute, refund, or chargeback information.

Payment details may be processed by a payment provider such as Stripe. Squillify does not need to store full payment card numbers if payments are processed through a third-party payment provider.

4.7 Support and communications data

• messages sent to Squillify;
• support tickets;
• bug reports;
• security reports;
• abuse reports;
• attachments or examples voluntarily provided by the customer;
• communication metadata;
• contact preferences.

Because Squillify does not permanently store raw submitted payloads by default, support may ask customers to provide sanitized examples when investigating execution issues.

4.8 Website, device, and cookie data

• IP address;
• browser and device information;
• pages visited;
• referral information;
• cookie or similar technology identifiers;
• session information;
• consent preferences;
• security and anti-abuse signals.

Cookies and similar technologies are described in the Cookie Policy.

5. Sources of personal data

We collect personal data from:

• you directly;
• tenant administrators;
• invited members;
• your applications, scripts, agents, API clients, or integrations;
• identity and authentication providers;
• payment and billing providers;
• hosting, logging, monitoring, security, and infrastructure providers;
• communications with support, legal, privacy, security, or abuse channels;
• public or commercial sources where necessary for fraud prevention, security, or legal compliance.

6. How we use personal data and legal bases

We process personal data for the purposes and legal bases below, where applicable.

Where we rely on legitimate interests, those interests include operating, securing, improving, and protecting the Squillify platform, preventing abuse, enforcing fair use, maintaining accurate billing, and providing a reliable service.

6.1 Whether information must be provided

Where consent is required, you may withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal.

7. Microskill data handling

Squillify's default data handling model is based on data minimisation.

Default platform principles:

• raw submitted microskill payloads are processed for the requested execution;
• raw submitted microskill payloads are not permanently stored as part of normal execution;
• usage telemetry is designed to be metadata-only;
• temporary file storage is used only where required by a feature or file-based workflow;
• temporary files are retained for a short period and then deleted;
• payloads are not used to train artificial intelligence models;
• payloads are not sent to hidden external services unless the relevant skill is explicitly labelled as using an external service.

Detailed rules are described in the Microskill Data Handling Policy, File Handling Policy, Telemetry and Analytics Policy, External Service Use Policy, and AI / Training Use Policy.

8. AI and training use

Squillify does not use customer-submitted raw microskill payloads to train artificial intelligence models.

Squillify may use operational metadata for security, billing, abuse prevention, reliability, debugging, capacity planning, product analytics, and service improvement.

If Squillify later offers AI-backed capabilities that process data differently, those capabilities must be explicitly labelled and governed by appropriate terms.

9. Cookies and similar technologies

Squillify may use cookies, local storage, session storage, pixels, SDKs, and similar technologies.

Strictly necessary technologies may be used for authentication, security, session management, dashboard operation, load balancing, fraud prevention, and consent management.

At launch, cookies and similar storage are limited to authentication, security, session integrity, service delivery, and preferences expressly requested by the user. Optional advertising, behavioural, or cookie-based analytics technologies are not enabled.

If enabled, Plausible Analytics is configured without cookies, local storage, or persistent visitor identifiers. Its processing and the essential browser technologies used by Squillify are described in the Cookie Policy. Any later non-essential technology must remain blocked until the policy is updated and valid prior consent is obtained where required.

Details are provided in the Cookie Policy.

10. How we share personal data

We may share personal data with:

• hosting and infrastructure providers;
• database and object storage providers;
• authentication providers;
• payment and invoicing providers;
• email and communication providers;
• monitoring, logging, and security providers;
• analytics providers where used;
• support tools where used;
• professional advisers;
• public authorities, courts, regulators, or law enforcement where legally required;
• acquirers, investors, or successors in connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate protections.

We do not sell personal data.

We do not disclose customer-submitted raw microskill payloads to third parties except where required to provide the requested service, where the skill is explicitly labelled as using an external service, where instructed by the customer, or where required by law.

Current and planned sub-processors are listed in the Sub-processors page.

11. Sub-processors

Squillify uses sub-processors to operate the platform.

The Sub-processors page identifies providers, purposes, data categories, processing regions, transfer mechanisms, and status where confirmed.

Before this Privacy Policy becomes active, Squillify must confirm the relevant sub-processors, processing locations, and transfer mechanisms.

12. International transfers

Personal data may be processed in countries outside your country of residence.

Where personal data is transferred outside the European Economic Area, Squillify will use safeguards required by applicable data protection law, such as:

• an adequacy decision;
• Standard Contractual Clauses approved by the European Commission;
• provider-level data protection agreements;
• supplementary measures where required;
• EU-only processing configurations where available.

Specific provider regions and transfer mechanisms are listed in the Sub-processors page and must be confirmed before this policy becomes active.

13. Retention

Squillify retains personal data only for as long as reasonably necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law.

Retention depends on the type of data.

Detailed retention rules are described in the Data Retention Policy.

14. Security

Squillify uses technical and organisational measures designed to protect personal data, including, where applicable:

• encryption in transit;
• encryption at rest where supported by relevant providers;
• authentication and authorisation controls;
• tenant isolation;
• API key scoping and revocation;
• rate limiting and quota controls;
• logging practices designed to avoid permanent raw payload capture;
• access restrictions for production systems;
• monitoring and incident response;
• dependency and vulnerability management;
• temporary file deletion controls.

No internet service can guarantee absolute security. Customers are responsible for securing their own accounts, API keys, applications, agents, integrations, devices, and credentials.

More information is provided in the Security Policy.

15. Your data protection rights

Depending on applicable law, you may have the right to:

• access your personal data;
• obtain a copy of your personal data;
• correct inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• request portability of personal data;
• lodge a complaint with a supervisory authority.

No self-service rights interface is currently offered. To exercise rights, contact [email protected]. Squillify will handle requests through this channel, verify identity or authority where necessary, and respond without undue delay and ordinarily within one month. Where the GDPR permits an extension because of complexity or request volume, Squillify will communicate the extension and its reason within the initial one-month period.

We may need to verify your identity before responding. We may also need to direct you to the relevant customer where Squillify processes the personal data as processor on behalf of that customer.

You may lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD) or another competent supervisory authority, in particular in the Member State of your habitual residence, place of work, or the alleged infringement. Information and the CNPD complaint form are available at cnpd.public.lu.

16. Data subject requests involving customer data

If your personal data was submitted to Squillify by a Squillify customer, application, agent, or integration, that customer may be the controller of the data.

In that case, Squillify may refer your request to the relevant customer or ask you to contact that customer directly.

Because Squillify is designed not to permanently store raw microskill payloads by default, Squillify may not be able to access, retrieve, correct, export, or delete raw payload content after execution or after expiry of temporary file retention periods.

17. Children's data

Squillify is not intended for use by children.

Customers must not knowingly submit children's personal data to Squillify unless they have a lawful basis, appropriate authority, and suitable contractual and technical arrangements.

18. Sensitive and regulated data

Customers must not submit special categories of personal data, criminal offence data, health data, children's data, payment card data, government identifiers, authentication secrets, regulated financial data, or other high-risk data to Squillify unless:

• the processing is lawful;
• the customer has authority to submit the data;
• the selected Squillify capability is appropriate for that data;
• required security, contractual, and compliance safeguards are in place.

Squillify does not provide a general-purpose sensitive data detection or classification service and does not guarantee that sensitive data submitted by a customer will be detected or blocked.

19. Automated decision-making

Squillify does not use personal data for automated decision-making that produces legal effects or similarly significant effects on individuals, unless expressly stated in a specific product notice or agreement.

Customers are responsible for any automated decision-making they perform using Squillify outputs in their own systems.

20. Business transfers

If Squillify is involved in a merger, acquisition, financing, reorganisation, sale of assets, or similar transaction, personal data may be transferred as part of that transaction, subject to appropriate confidentiality and data protection protections.

21. Changes to this policy

We may update this Privacy Policy from time to time.

If changes are material, we will provide reasonable notice, such as through the dashboard, website, email, or another appropriate channel.

The version, last updated date, and effective date are shown at the top of this policy.

22. Supervisory authority

If you are located in Luxembourg or if Luxembourg law applies, you may have the right to lodge a complaint with the Commission nationale pour la protection des données (CNPD).

Contact details and complaint procedures are available on the CNPD website.

23. Contact

For privacy questions, data protection requests, or concerns, contact:

• Privacy: [email protected]
• Legal: [email protected]
• Security: [email protected]

For abuse reports, contact [email protected].

For support questions, contact [email protected].