Skyeos BV / Privacy
Privacy statement
What data we use, why we use it and the choices you have.
Last updated:
Who is responsible and what this covers
Skyeos BV, Amsterdam, the Netherlands, is responsible for the processing described here. You can contact us about your personal data at studio@skyeos.io. Earlier correspondence or documents may also refer to Skye Technologies BV.
This statement covers our public website, inquiries, the AI assessment and directly related correspondence. It also applies when a business contact gives us information about a colleague for that contact. Processing inside a customer’s own application or environment is covered by separate agreements and the privacy information for that environment.
The data we receive
- Contact inquiries: your name, work email, company, message, chosen language and your optional answer about how you heard about Skyeos. We keep that answer with your inquiry, including in our CRM and team email, to understand how you found us.
- AI assessments: your name, work email, phone number, process description, optional company name and language. We also record the processing acknowledgement, its version and time, and the generated report.
- Follow-up: correspondence and relevant contact, company, conversation and opportunity notes in our email and customer relationship management (CRM) systems.
- Website operation: technical request and security information, such as IP address, browser information, request time and requested page, where needed by the website and its service providers.
- Our website statistics: a random identifier for a browser-tab session, page path, language, mobile or desktop category, referring website origin, time, page views and selected clicks. We also record generic events such as a submitted inquiry or assessment, without the form contents.
We mainly receive information directly from you. A colleague may provide your business contact details for an inquiry. Technical information is generated when your browser communicates with the website. Please include only information needed for your request and avoid sensitive personal data, passwords or confidential details about other people.
Why we use data and on what basis
- Answering inquiries and maintaining business contact
- Our legitimate interest is effective business communication and assessing possible cooperation. We use the information needed to understand your request, respond and keep relevant follow-up context. Where you personally ask us to take steps towards a contract with you, those steps may instead be necessary before entering into that contract.
- Providing your requested AI assessment
- Our legitimate interest is to provide the analysis you ask for, deliver the result and arrange relevant personal follow-up. The required processing acknowledgement explains this use; it is not blanket GDPR consent or consent to promotional marketing.
- Keeping the website reliable and secure
- We have a legitimate interest in delivering the website, preventing misuse and investigating technical or security incidents. We limit this processing to what is needed and consider the effect on your privacy.
- Understanding and improving website use
- Our legitimate interest is to understand which pages and functions are useful, identify problems and assess improvements to the website. We use our own limited website statistics for this, without advertising profiles or cross-site tracking. Browser measurement respects Do Not Track and Global Privacy Control; you can also object as explained below.
- Meeting legal requirements
- Where a legal requirement actually applies to records or a request, we process the necessary information to comply with that legal obligation.
When relying on legitimate interests, we weigh our purpose and necessity against your rights and expectations. You can object as explained below. We do not sell personal data. An inquiry or assessment does not subscribe you to a newsletter or advertising. If we introduce optional marketing, we will provide a separate appropriate choice and explanation.
Which information is required
The contact form requires your name, work email, company and message so we can understand and answer a business inquiry. The assessment requires your name, work email, phone number, process description and processing acknowledgement. The phone number is requested for personal follow-up; the company name is optional in the assessment.
You are not legally obliged to fill in these forms. If you omit required fields, the form cannot be submitted and we cannot deliver the assessment through it. You can contact studio@skyeos.io instead. Omitting the optional company name does not prevent an assessment.
How the AI assessment works
We send a minimised version of your process description to Anthropic to generate an assessment. We do not add the separately collected contact fields to the AI prompt. Recognisable email addresses and phone numbers in the description and generated output are filtered, but this pattern-based filtering cannot reliably remove every personal or confidential detail. Please describe the process without names or unnecessary identifying information.
The result is sent to you by email. Your submission and generated report support delivery and internal follow-up. Relevant contact details and notes are stored in our CRM so a person can follow up on your request.
There is also a time-limited online report view for internal follow-up. If an online report link is provided to you, anyone who possesses that link can read the report until it expires. Share it carefully. Expiry of a link does not recall emails or copies already saved or shared.
The assessment is an automatically generated starting point and can contain mistakes. We do not use it to make decisions based solely on automated processing that have legal or similarly significant effects on you. Personal follow-up involves human review. AI-provider processing follows the applicable service terms; we make no general guarantee of zero retention or exclusion from every form of model improvement.
Who may receive your information
Our team receives information needed to handle your request. We use the following service providers for the website and these forms. The links lead to their published data processing terms.
- Vercel: website hosting, delivery and technical security.
- Supabase: database storage, submissions, CRM records and our website statistics.
- Resend: sending service emails to you and our team.
- Anthropic: AI analysis for the assessment you request.
Our email and workspace services also process correspondence, and these suppliers may use subprocessors. We share only information appropriate to the service. Integration logos elsewhere on our website do not mean those companies receive your form data. We may provide information to professional advisers or competent authorities where necessary for a legal obligation or to establish, exercise or defend legal claims.
Processing outside Europe
Our suppliers and their subprocessors may process information outside the European Economic Area, including in the United States. We therefore do not promise that all processing stays within the EU.
For transfers outside the EEA, the applicable supplier terms provide for a lawful transfer mechanism: an adequacy decision where applicable to the recipient and processing, or the European Commission’s standard contractual clauses with any necessary additional safeguards. The applicable mechanism depends on the service and recipient. Contact studio@skyeos.io for further information or a copy of the relevant safeguards.
How long we keep data
We keep personal data for as long as it is needed for the purpose for which it was collected. Where there is no single fixed period, we use these criteria:
- Inquiries, email and CRM: whether your inquiry has been completed, discussions or relevant follow-up are still ongoing, or there is an active customer relationship. We remove information when that context no longer requires it, except where a legal obligation or dispute justifies longer retention.
- Assessment submissions and reports: the time needed to generate and deliver the result, resolve delivery issues and support relevant follow-up. Online report access is limited to its stated expiry, normally 30 days and never more than 90 days from creation. This access period is separate from the retention of email, CRM and other saved copies.
- Technical and security records: the time needed to operate the service, identify faults, prevent abuse or investigate an incident. The nature and duration of an incident, relevant provider settings and any legal requirement determine this period.
- Website statistics: the period needed to compare recent website use, identify trends and assess improvements. We remove detailed events when they are no longer needed for those purposes. The end of a browser-tab session does not itself delete events already received by our systems.
- Records required by law or for a dispute: the applicable legal requirement or the time needed to resolve the dispute and protect the relevant rights.
Suppliers may have separate retention arrangements for service records and backups. Expiry of an online report does not automatically delete those records or recall copies in email or CRM. You can ask us about the retention of your specific information or request deletion via studio@skyeos.io.
How we protect information
We use technical and organisational measures appropriate to the processing, including encrypted connections, access controls, validation of form input and limits on misuse. Access to contact and assessment information is restricted to people and services that need it for their work. Online report access expires and report pages are excluded from search indexing.
No website or communication channel can guarantee absolute security. If you suspect a security problem involving your data, contact studio@skyeos.io and share only the details needed to investigate it.
Your rights and how to use them
You can request access, correction, deletion or restriction of your personal data. Where the legal conditions apply, you can also request a portable copy. You may object to processing based on legitimate interests because of your particular situation. We will assess that objection and stop the processing unless we have compelling legitimate grounds or it is necessary for legal claims. You can always object to direct marketing.
Where processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal. The assessment’s factual processing acknowledgement is not a general consent basis.
Send your request to studio@skyeos.io and tell us which information or contact it concerns. We may ask for proportionate information to confirm your identity; we do not ask for a complete passport copy by default. Exercising your rights is normally free of charge.
We normally respond within one month of receiving your request. If complexity or the number of requests makes an extension necessary, we may extend this by up to two further months and explain the reason within the first month. We will explain any restriction or refusal and your options to challenge it.
You can submit a complaint to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to a competent supervisory authority in the country where you live, work or believe an infringement occurred.
Changes to this statement
This version is dated 7 September 2026. We update this statement when our processing or the applicable requirements change. The latest version is available on this page with its date. Where a change materially affects your information, we will provide an appropriate additional notice. Questions about this statement can be sent to studio@skyeos.io.