Privacy Policy

Intro

The processing of personal data, such as names, addresses, email addresses, or phone numbers, is carried out in line with the General Data Protection Regulation and the country-specific data protection rules applicable to skib. This privacy policy explains the type, scope, and purpose of the personal data we collect, use, and process, as well as the rights of data subjects.

Controller

The controller for data processing on this website is skib GmbH, Valentinskamp 34, 20355 Hamburg, Germany, represented by Felix Freudenhammer and Tanita Kühn. Email: hello@skib.io. Further company details are provided in the legal notice.

Hosting (Vercel)

This website is hosted by Vercel Inc. When you visit the site, Vercel processes technically necessary connection data (including IP address, timestamp, requested resource) in server logs to provide and secure the service. Legal basis: Art. 6(1)(f) GDPR.

Contact form

When you use the contact form, we process your name, email address, message, the time of consent and a truncated, salted hash of your IP address (spam protection). Data is stored in a Neon Postgres database provisioned via Vercel. Legal basis: Art. 6(1)(b) and (a) GDPR.

If you consented to the "Marketing" category, we additionally report the submission of the form to Meta (see "Meta Pixel & Conversions API").

Retention: 12 months after the enquiry is closed; the IP hash is deleted after 30 days.

Waitlist / access requests

When you join a product waitlist we process your email address, optionally team size and professional focus, the product interest, the referring page and the time of consent. One person is kept as one internal record, even with interest in several products. Legal basis: Art. 6(1)(a) GDPR.

Retention: until the respective product launches plus 6 months; the IP hash is deleted after 30 days.

Email delivery (Resend)

Confirmation and notification emails are sent via Resend Inc.; your email address is transmitted to Resend for this purpose. Legal basis: Art. 6(1)(b) GDPR.

Internal notifications (Slack)

New enquiries and waitlist sign-ups are surfaced to our team internally via Slack (email address and submitted form data). Legal basis: Art. 6(1)(f) GDPR.

Appointment booking (Cal.com)

Qualified leads are optionally offered an appointment booking via an embedded Cal.com widget, which only loads on the respective final screen. Cal.com's own privacy policy applies additionally when booking.

If you consented to the "Marketing" category, we additionally report a successful booking from our website to Meta (see "Meta Pixel & Conversions API"). The content of the appointment is not transmitted.

Meeting transcription

Meetings we hold with you (usually via Google Meet) are recorded, transcribed automatically and analysed with AI support — solely to improve how we run conversations, not to assess you. We point this out in every calendar invitation. You can object at any time and without any disadvantage; the meeting then takes place without a recording. Legal basis: Art. 6(1)(a) GDPR (consent).

Retention: transcript 90 days from the meeting, internal analysis 24 months. Recipients are Google (Google Workspace) and Anthropic (Anthropic API), each under a data processing agreement.

Analytics (Vercel Analytics & Speed Insights)

We use the cookieless variants of Vercel Analytics and Speed Insights. No cookies are set and no cross-device profiles are created; metrics are processed in aggregate. This also covers anonymized interaction events (e.g. adding a building block or submitting a non-binding inquiry), which are counted without cookies and without any personal reference and are therefore recorded independently of your cookie selection. Legal basis: Art. 6(1)(f) GDPR (reach measurement without accessing end devices).

Google Tag Manager & Google Analytics 4

If you enable the "Statistics" (or "Marketing") category in the cookie settings, we load Google Tag Manager and Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. No connection to Google is established before your consent; your selection is additionally signalled to the loaded services via Google Consent Mode v2 (statistics → analytics_storage, marketing → ad_storage/ad_user_data/ad_personalization).

Google Analytics 4 processes pseudonymized usage data (including pages visited, interactions, approximate location based on a truncated IP — GA4 does not store IP addresses). Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with future effect via "Cookie settings" in the footer.

Usage analytics and session replay (PostHog)

With your consent to the Statistics category, we use PostHog, Inc.'s EU cloud to improve our website. We collect page views, selected interactions and masked session recordings of mouse movements, clicks and scrolling, together with technical browser and device data and a random identifier for the current page visit. We do not link these data to names, email addresses or customer profiles.

Text is masked before transmission; form fields and embedded booking forms are excluded. URL query parameters and fragments are removed. Network contents, console logs and screen video are not recorded. PostHog loads only after consent. The visit identifier stays in memory rather than a persistent cookie. Necessary connection data are transmitted when the service is accessed.

Processing is based on your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). You can withdraw it at any time with future effect through Cookie settings in the footer. Recording then stops and the page reloads. On PostHog's free plan, recordings are retained for one month and analytics data for one year. Provider information: https://posthog.com/privacy.

Meta Pixel & Conversions API

If you enable the "Marketing" category in the cookie settings, we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). Before you consent, no connection to Meta is made, no Meta script is loaded and no Meta cookie is set.

With your consent your browser loads a script from Meta (connect.facebook.net). Meta sets cookies on our domain (_fbp; also _fbc if you came to us from a Meta ad; each stored for up to 90 days). If you are logged in to Facebook or Instagram, Meta can additionally read its own cookies on Meta domains and associate the event with your account. The Pixel sends these events to Meta: page views, opening the booking page, submitting the contact form and booking a call. Meta processes in particular your IP address, browser and device details, the page address including campaign parameters (e.g. UTM), the previously visited page (referrer), the cookie identifiers mentioned and an event identifier. Automatic click tracking and in-browser matching of form input ("advanced matching") are switched off.

When you submit the contact form or book a call, we also send the event to Meta from our server (Conversions API). It contains your email address and name only as a hash (SHA-256). Meta matches these hashes against its own data to associate the event with a Meta account. We send the page address without parameters. The transmission also contains IP address, user agent, the Meta cookie identifiers and the same event identifier as in the browser, so that Meta counts the event only once. This too happens only if you consented to "Marketing".

The purpose is to measure the effect of our ads on Instagram and Facebook, to improve ad delivery, to build audiences from visitors of our website (retargeting) and to let Meta find similar audiences based on them. We keep website audiences in our ad account for no longer than 180 days.

For collecting the data through the Pixel and sending it to Meta we are joint controllers with Meta (Art. 26 GDPR); the arrangement is available at https://www.facebook.com/legal/controller_addendum. Meta alone is responsible for the subsequent processing. Data may be transferred to Meta Platforms, Inc. in the USA; Meta is certified under the EU-U.S. Data Privacy Framework. More information: https://www.facebook.com/privacy/policy.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent). You can withdraw your consent at any time with future effect via "Cookie settings" in the footer. After withdrawal we send nothing further to Meta and delete the Meta cookies on our domain.

Storing your cookie choice

Via the cookie notice ("Cookie settings") you decide which categories you allow (Necessary, Statistics, Marketing). We store your decision in a strictly necessary cookie (name: cookieConsent) for about 12 months so the notice does not reappear on every visit. This cookie contains no personal data and only stores your choice — without it your consent could not be applied technically. Legal basis: Section 25(2) TDDDG (strictly necessary storage) together with Art. 6(1)(f) GDPR. You can change your choice anytime via "Cookie settings" in the footer.

Spam protection (Vercel BotID)

We protect our forms with Vercel BotID, which detects automated access without a visible CAPTCHA by processing technical browser signals. Legal basis: Art. 6(1)(f) GDPR.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20). You may withdraw consent at any time with future effect pursuant to Art. 7(3) GDPR via hello@skib.io. You also have the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR.

Right to object

Where your personal data is processed based on legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing pursuant to Art. 21 GDPR if there are grounds relating to your particular situation.

Data security

During website visits, we use the common TLS/SSL procedure together with the highest encryption level supported by your browser.

Current version and changes

This privacy policy is currently valid as of October 2026. Due to further development of our website and services or changed legal or regulatory requirements, it may become necessary to update this privacy policy. The current version is available at www.skib.io.