LEGAL INFORMATION
Privacy policy
What data we process, why, for how long, and how to exercise your rights. Written to be read, not to be signed unread.
Last updated: 25 July 2026
Draft — the publisher’s legal identity has not been filled in yet. This page is not indexed and is not yet legally binding.
01Data controller
« Nom Prénom à compléter » (company number « SIRET à compléter »), publisher of Skali, is the controller for the processing described below. For any question or to exercise your rights: contact@skali.app
02Data we process
Staff account: email address, password (stored hashed, never in clear text), two-factor authentication secret, display name. Discord link (optional and revocable): Discord ID, username, avatar. We never read your private messages. Your hall's data: applications and their answers, votes, internal comments, checklists, reports, announcements, polls, and the server logs you send us. Technical data: connection and error logs required for security and diagnosis.
03Purposes and legal bases
Providing the service (applications, checklists, reports, announcements, logs): performance of the contract. Account security, including mandatory two-factor authentication for every staff role: legitimate interest and security obligation. Billing and subscription management: performance of the contract and accounting obligations. Service improvement and incident diagnosis: legitimate interest. We do no advertising profiling, no data resale, and no third-party marketing.
04Cookies and trackers
Skali uses no advertising trackers and no embedded social widgets. The only audience measurement is Vercel Web Analytics, which sets no cookie: it counts page views and where they came from. A visitor is recognised through a temporary identifier derived from the request and renewed every day — never across other sites, and no profile is ever built. Only cookies that are strictly necessary or set at your own request: the session cookie that keeps you signed in; a preference cookie that remembers your light or dark theme; a thirty-minute cookie holding the plan you just picked, long enough to carry you to payment; and, if you link Discord, a temporary cookie that stops that link being hijacked. The last two exist only because you clicked, and are gone right after. These are exempt from consent under the ePrivacy directive — which is why no banner is forced on you. The demo video on the home page is hosted on YouTube. It loads only when you press play, in YouTube's privacy-enhanced mode (youtube-nocookie.com); from that click, Google may set its own cookies under its own privacy policy. Without a click, nothing is loaded from Google.
05Processors and recipients
Supabase — database, authentication and storage, European Union region. Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA — application hosting and cookieless audience measurement. Discord — only if you enable the link: sending the roles, messages and announcements you request. Stripe — subscription payments. We never see or store your card details. Google (YouTube): only if you play the demo video on the home page, under Google's own privacy policy. Each acts on instruction and is bound by a data processing agreement.
06Transfers outside the European Union
Primary data storage remains in the European Union. Some providers (application hosting, Discord, Stripe) may process data from the United States; those transfers are covered by the European Commission's standard contractual clauses or by the EU–US Data Privacy Framework.
07Retention periods
Staff account: kept while the account exists, then deleted within 30 days of removal. Hall data: kept while the hall exists. Downgrading a plan never deletes your data. Server logs: automatically purged by plan — 7 days on Free, 90 days on Pro, unlimited on Network. This is the only data actually erased by normal operation of the service. Accounting records: kept for 10 years, as required by law.
08Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, as well as to set post-mortem instructions. Exercise them at contact@skali.app. We answer within one month. Proof of identity may be requested in case of reasonable doubt. You may also lodge a complaint with your supervisory authority — in France, the CNIL (cnil.fr).
09Security
Two-factor authentication is mandatory for every staff role, enforced server-side and not merely in the interface. Data access is partitioned per server at the database level itself. Passwords are stored hashed. Traffic is encrypted in transit. Your Skali account does not depend on Discord: the Discord link is a synchronisation you can revoke at any time, never your sign-in identity.
10Changes
This policy may change as the service evolves. Any substantial change will be notified by email or on your next sign-in, before it takes effect.
A question about this document? Write to us at contact@skali.app