Data Processing Agreement

You (the seller / account holder) are the data controller of your customers' personal data. Skube is your data processor (GDPR Art. 28): we process that data only to provide the service, on your documented instructions, and never for our own purposes.

Personal data contained in your marketplace listings and orders (e.g. buyer names, shipping and billing addresses, email, phone), retrieved from the marketplaces you connect, to show it back to you and answer your requests. We do not sell it or use it to train models.

Order data is passed through, not stored: it is fetched live from the marketplace when you ask and is not persisted in Skube's database. Credentials are encrypted at rest; all traffic is encrypted in transit (TLS).

To keep the service reliable for every seller, Skube records minimal diagnostic events when a marketplace rejects a request or a session asks for a capability Skube doesn't provide yet: marketplace, endpoint, error code, affected field, and the error message as a template with all values removed. Account IDs and SKUs/EANs appear only as salted hashes; product texts, prices, images and buyer/order data are never part of these events. Retention: 90 days. Purpose: error analysis and service improvement (contract performance / legitimate interest, GDPR Art. 6(1)(b), (f)). You can turn this off anytime in Settings → Diagnostics & privacy. Optional anonymous run summaries (counters only) are separate and strictly opt-in. Skube never reads your chat.

When you correct Skube (a rule about how a marketplace behaves, not your product data), that correction is stored for our team to review, with contact details, links and identifiers removed before it is stored. A person decides whether the rule becomes part of Skube for all customers; nothing is promoted automatically. This happens whenever a correction reaches us. Separately, the Remember my corrections setting keeps your own corrections on your account and applies them to your own later runs; it is on by default, can be switched off at any time, and stored rules can be deleted. That setting governs your own runs only; it does not decide whether a correction reaches us.

We apply appropriate technical and organizational measures: encryption in transit, encryption of stored credentials, per-tenant isolation and access controls, and least-privilege access to production systems.

On your instruction we will help you honour data-subject requests (access, correction, deletion) and, on termination, return or delete personal data. You may request information needed to demonstrate compliance with Art. 28.

Data-protection questions: info@skube.ai.