Privacy Policy

Full provider details: Imprint. Data-protection questions go to info@skube.ai.

Account data. Your company / account name, email address and password. The password is never stored in readable form, only as an argon2id hash. Purpose: creating and running your account, signing you in, billing and support. Legal basis: performance of a contract, Art. 6(1)(b).

Marketplace credentials. The API keys or OAuth tokens you connect. They are encrypted at rest, used only to talk to that marketplace on your instruction, and are never shown to the AI model. Legal basis: Art. 6(1)(b).

Marketplace and order data. Listing, order and buyer data (names, shipping and billing addresses, email, phone), retrieved from the marketplaces you connect. It is passed through, not stored: fetched live from the marketplace when you ask and not persisted in skube's database. We do not sell it and do not use it to train models. Here we act as your processor (Art. 28).

Diagnostic events. When a marketplace rejects a request, or a session asks for a capability skube doesn't have yet, we record a minimal event: marketplace, endpoint, error code, affected field, and the error message as a template with all values removed. Account IDs and SKUs/EANs appear only as salted hashes; product texts, prices, images and buyer or order data are never part of these events. Purpose: keeping the service reliable and analysing errors. Legal basis: Art. 6(1)(b) and (f). Retention: 90 days. You can switch this off at any time in Settings → Diagnostics & privacy.

Corrections you send us. When you correct skube (a rule about how a marketplace behaves, not your product data), that correction is stored for our team to review, with contact details, links and identifiers removed before it is stored. A person decides whether the rule becomes part of skube for everyone; nothing is promoted automatically. This happens whenever a correction reaches us, and the setting described next does not change it. Separately, Remember my corrections in Settings → Diagnostics & privacy keeps your own corrections on your account and applies them to your own later runs; it is on by default, you can switch it off at any time, and stored rules can be deleted. That setting governs your own runs only. Legal basis for both: performance of a contract and our legitimate interest in a service that keeps working, Art. 6(1)(b) and (f).

Optional, opt-in only. Anonymous run summaries: counters only, such as which checks fired and how long each step took, never listing content. They are off unless you turn them on and can be switched off again. Legal basis: your consent, Art. 6(1)(a), withdrawable at any time. skube never reads your chat.

Visiting this website. Your browser transmits technical data (IP address, browser and operating system, time of the request, the page requested) to our hosting provider so the page can be delivered and kept secure. Legal basis: our legitimate interest in operating a working, secure website, Art. 6(1)(f).

Waitlist. When you join the waitlist, we keep the email address you enter, and nothing else, on our waitlist in skube's database, and send it as one mail to our team inbox, info@skube.ai, so we can write to you when there's a place. Legal basis: steps you asked for before a contract, Art. 6(1)(b).

Cookies. One strictly necessary cookie, skube_session, keeps you signed in after you log in. We use no tracking, analytics or advertising cookies, and there is no third-party analytics on this site.

Everything skube stores for you is stored and processed in the EU. This website, the skube API, the database, the cache and the object storage that holds the files you upload all run there. Displaying a page loads nothing from a third-party host at all: the typefaces named in section 4 are served from our own servers.

The marketplaces you connect are reached on your instruction, with the credentials you gave us, over those marketplaces' own endpoints; Amazon, for example, over its European Selling Partner endpoint.

One flow leaves that circle, and it is the one you chose: skube works inside your AI assistant, so whatever you ask it to show you is also processed by your assistant's own provider, under their terms and wherever they operate. skube sends your data nowhere else. Every sub-processor, with its purpose, its location and the data-processing terms it is bound by, is listed in the Data Processing Agreement. That list is the authoritative one.

Order and buyer data is not persisted at all; it lives only for the length of the request that fetched it. Account data is kept for as long as your account exists and is deleted once the account is closed. Marketplace credentials are kept until you disconnect that marketplace or delete your account, and are then deleted. Waitlist addresses are kept in our database until we invite you, or until you ask us to delete them. The notification mail with your address stays in our team inbox until we delete it there, which we do when we invite you or when you ask us to.

Diagnostic events are deleted after 90 days. Server access logs are deleted automatically after 30 days. Upload plans that skube prepares on its servers for bulk changes are deleted automatically 30 days after they were last updated; a plan can be rebuilt at any time.

Statutory retention duties (for invoices and other commercial records under German tax and commercial law) apply regardless and override deletion for as long as they run.

You have the right to access your data (Art. 15), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing rests on your consent you can withdraw it at any time with effect for the future (Art. 7(3)).

To exercise any of them, write to info@skube.ai.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, your place of work, or the place of the alleged infringement (Art. 77).