LEGAL INFORMATION
Privacy policy
What data we process, why, for how long, and how to exercise your rights. Written to be read, not to be signed unread.
Last updated: 25 July 2026
Draft — the publisher’s legal identity has not been filled in yet. This page is not indexed and is not yet legally binding.
01Data controller
« Nom Prénom à compléter » (company number « SIRET à compléter »), publisher of Skali, is the controller for the processing described below. For any question or to exercise your rights: contact@skali.app
02Data we process
Staff account: email address, password (stored hashed, never in clear text), two-factor authentication secret, display name. Discord link (optional and revocable): Discord ID, username, avatar. We never read your private messages. Your hall's data: applications and their answers, votes, internal comments, checklists, reports, announcements, polls, and the server logs you send us. Technical data: connection and error logs required for security and diagnosis.
03Purposes and legal bases
Providing the service (applications, checklists, reports, announcements, logs): performance of the contract. Account security, including mandatory two-factor authentication for every staff role: legitimate interest and security obligation. Billing and subscription management: performance of the contract and accounting obligations. Service improvement and incident diagnosis: legitimate interest. We do no advertising profiling, no data resale, and no third-party marketing.
04Cookies and trackers
Skali uses no advertising trackers, no third-party analytics and no embedded social widgets. Only strictly necessary cookies are set: the session cookie that keeps you signed in, and a preference cookie that remembers your light or dark theme. These are exempt from consent under the ePrivacy directive — which is why no banner is forced on you.
05Processors and recipients
Supabase — database, authentication and storage, European Union region. Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA — application hosting. Discord — only if you enable the link: sending the roles, messages and announcements you request. Stripe — subscription payments. We never see or store your card details. Each acts on instruction and is bound by a data processing agreement.
06Transfers outside the European Union
Primary data storage remains in the European Union. Some providers (application hosting, Discord, Stripe) may process data from the United States; those transfers are covered by the European Commission's standard contractual clauses or by the EU–US Data Privacy Framework.
07Retention periods
Staff account: kept while the account exists, then deleted within 30 days of removal. Hall data: kept while the hall exists. Downgrading a plan never deletes your data. Server logs: automatically purged by plan — 7 days on Free, 90 days on Pro, unlimited on Network. This is the only data actually erased by normal operation of the service. Accounting records: kept for 10 years, as required by law.
08Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, as well as to set post-mortem instructions. Exercise them at contact@skali.app. We answer within one month. Proof of identity may be requested in case of reasonable doubt. You may also lodge a complaint with your supervisory authority — in France, the CNIL (cnil.fr).
09Security
Two-factor authentication is mandatory for every staff role, enforced server-side and not merely in the interface. Data access is partitioned per server at the database level itself. Passwords are stored hashed. Traffic is encrypted in transit. Your Skali account does not depend on Discord: the Discord link is a synchronisation you can revoke at any time, never your sign-in identity.
10Changes
This policy may change as the service evolves. Any substantial change will be notified by email or on your next sign-in, before it takes effect.
A question about this document? Write to us at contact@skali.app