Privacy Policy

1. Data Controller

The data controller for personal data is:

• Skalo Agency LLC
• Registered office: 30 N Gould St Ste R, Sheridan, WY 82801, USA
• Wyoming Entity ID: 2026-001391187
• Email: info@skalo.agency

2. EU Representative (Art. 27 GDPR)

In accordance with Art. 27 of Regulation (EU) 2016/679, Skalo Agency LLC has designated a Representative in the European Union:

• Name: Annamatilde Baiano
• Address: Via Conte Roncone, 7 — 00020 Ciciliano (RM), Italy
• Email: info@skalo.agency
• Phone: +39 347 939 7971

The Representative serves as the point of contact for supervisory authorities and data subjects who wish to exercise their data protection rights.

3. Data Collected

We collect the following types of personal data, organized by category:

a) Data collected through the website

• Voluntarily provided data: name, email address, message, when submitted through the contact form. This data is used solely to respond to the user's specific request and is not used for marketing or commercial communications.
• Browsing data: IP address (anonymized), browser type, operating system, pages visited, access times. This data is collected automatically through hosting systems.
• Statistical usage data, collected through Google Analytics 4 ONLY after your explicit consent: pages viewed, navigation path, traffic source, device type and approximate country. Measurement uses a random browser identifier, not your name; advertising signals and sharing with other Google products are turned off. If you do not consent, Google's script is not loaded and no data leaves your browser. Details and withdrawal: Cookie Policy.

b) Data processed for B2B commercial outreach

• Name and surname of the business owner or manager
• Business email address
• Business phone number
• Job title
• Company name, office address, public digital presence data (review ratings, social media posting frequency)

c) Data processed for client service delivery

• Name, surname, email, phone number of the business contact
• Client company data and billing information
• Access credentials for social/review profiles (managed by the client)

d) Data collected through call recording

• Voice and content of the telephone conversation
• Phone number, date and time of the call

e) Data acquired through connected platforms (Google Business Profile)

• Reviews received, responses published, and profile performance metrics, acquired through the Google Business Profile API with the client's OAuth 2.0 authorization
• This data is used exclusively for the contracted reputation management service and is never sold, aggregated, or used for any other purpose
• Data is retained for the duration of the contract. Cached data is deleted within 30 days, in compliance with Google Business Profile API policies

f) Data acquired through connected platforms (eBay)

• Seller feedback received, responses published, and seller reputation metrics, acquired through the eBay Trading API with the client's OAuth 2.0 authorization
• This data is used exclusively for the contracted reputation management service and is never sold, aggregated, or used for any other purpose
• Data is retained for the duration of the contract and deleted within 30 days of service termination

g) Data processed through the WhatsApp Business API integration

• Phone numbers of tenants' end users (message recipients)
• Content of WhatsApp messages sent and received (Meta-approved templates and free-form conversations within the session window)
• Any attachments and media transmitted via WhatsApp
• Delivery metadata: send/receive timestamps, read status, WhatsApp Business Account (WABA) identifier of the tenant

4. Purpose and Legal Basis for Processing

Personal data is processed for the following purposes, each with its own legal basis:

• Responding to contact form requests — Legal basis: user consent (Art. 6, par. 1, let. a, GDPR)
• Ensuring website security and operation — Legal basis: legitimate interest of the controller (Art. 6, par. 1, let. f, GDPR)
• Aggregate visit counting through Vercel Web Analytics, with no cookies and no persistent identifiers: no profile, no recognition between one visit and the next, no data traceable to a person — Legal basis: legitimate interest of the controller in knowing the traffic volume of its own website (Art. 6, par. 1, let. f, GDPR)
• Measuring website usage in statistical form, to understand which content is useful and improve it — Legal basis: user consent (Art. 6, par. 1, let. a, GDPR), collected through the cookie banner and withdrawable at any time
• Measuring advertising campaign performance, i.e. which ads lead to an enquiry — Legal basis: user consent (Art. 6, par. 1, let. a, GDPR), collected as a separate category in the cookie banner and withdrawable at any time
• B2B commercial outreach: proactive contact with companies (corporations, partnerships — never sole proprietorships) to propose Skalo Agency services — Legal basis: legitimate interest (Art. 6, par. 1, let. f, GDPR), documented in a Legitimate Interest Assessment (LIA) available upon request
• Delivery of contracted services to clients — Legal basis: performance of a contract (Art. 6, par. 1, let. b, GDPR)
• Recording of telephone calls for service improvement and documentation — Legal basis: informed consent, obtained via IVR message prior to recording
• Compliance with legal and tax obligations — Legal basis: legal obligation (Art. 6, par. 1, let. c, GDPR)
• Delivery of WhatsApp Business messaging services to tenants and management of communications with their end users — Legal basis: performance of a contract with the tenant (Art. 6, par. 1, let. b, GDPR); legitimate interest of Skalo Agency for end-user data (Art. 6, par. 1, let. f, GDPR)

5. B2B Commercial Outreach

Skalo Agency conducts proactive commercial outreach to businesses (never to consumers or sole proprietorships) through the following channels: email, LinkedIn, SMS, phone, and WhatsApp.

The data used for outreach is exclusively professional and publicly available, collected from sources such as Google Maps, LinkedIn, business websites, and data enrichment services (Clay.com, Apollo, Lusha, Hunter.io).

Processing is based on legitimate interest (Art. 6, par. 1, let. f, GDPR) and is documented in a Legitimate Interest Assessment (LIA) compliant with EDPB and ICO guidelines. A copy of the LIA is available upon request by writing to info@skalo.agency.

Safeguards adopted:

• Every communication contains a functioning and immediate opt-out link
• Maximum 3 contact attempts per recipient (1 initial email + max 2 follow-ups)
• The sender (Skalo Agency) is always clearly identified
• Data of unconverted leads is deleted within 12 months of collection
• Sole proprietorships and freelancers are explicitly excluded, in compliance with Art. 130 of the Italian Privacy Code
• Phone numbers and consent data (opt-in/opt-out) are never shared, sold, or transferred to third parties for promotional or marketing purposes

6. Call Recording

Phone calls with clients and prospective clients may be recorded for the purposes of service improvement, training, and documentation of commercial interactions.

Recording occurs only with the informed consent of the caller, obtained via an IVR (Interactive Voice Response) message prior to the start of recording. The telephone system used is Messagenet (Italian provider).

Recordings are retained for a maximum of 6 months, after which they are automatically deleted.

7. Data Sharing

Personal data is never sold to third parties. It may be shared with the following service providers, each within the scope of their respective functions:

• Vercel Inc. — website hosting and Vercel Web Analytics, aggregate visit counting with no cookies and no persistent identifiers
• Koalendar Inc. — appointment booking through the calendar embedded in the website pages: it collects the name, email, phone number and business details you provide to schedule the call
• Resend — transactional email delivery from the website
• Google Workspace — email and document management
• Google Ireland Limited — Google Analytics 4, website usage statistics. Enabled only after consent; no data is sent to Google until consent is given
• Google Ireland Limited — Google Ads, advertising campaign measurement. Enabled only after consent to the campaign category, and only on campaign landing pages
• OpenAI - measurement of advertising campaigns shown inside ChatGPT, active only on the campaign landing page. In the browser the pixel loads only after consent to the campaigns category. In addition, when you book a call, our server sends the booking event together with your email in hashed form (SHA-256, not readable), so that the platform can recognise that the booking originated from an ad: your email is never transmitted in clear text
• Google Business Profile API — review and reputation management (client-authorized access via OAuth 2.0)
• eBay Trading API — seller feedback and reputation management (client-authorized access via OAuth 2.0)
• Stripe — payment processing
• Clay.com — data enrichment for B2B outreach
• Instantly.ai — commercial outreach email delivery
• Expandi.io — LinkedIn outreach
• ZeroBounce / NeverBounce — email address validation
• Messagenet — VoIP telephony and call recording system
• Twilio Inc. — WhatsApp Business and SMS messaging for B2B commercial communications and post-call follow-ups
• Meta Platforms, Inc. (WhatsApp) — WhatsApp Cloud API infrastructure for tenant messaging. Acts as data processor for messages sent through the WhatsApp Business integration. US data transfer via Standard Contractual Clauses. Meta Privacy Policy applies (facebook.com/privacy/policy)
• Supabase Inc. — CRM database, authentication and file storage
• Hetzner Online GmbH — application servers (Germany)
• OpenAI, L.L.C. — automatic transcription of call recordings
• OpenRouter / Anthropic PBC — AI-assisted generation of commercial copy
• Slack Technologies (Salesforce, Inc.) — internal coordination of client work

All third-party providers comply with GDPR or adhere to equivalent data protection safeguards (Standard Contractual Clauses or EU-US Data Privacy Framework).

8. International Data Transfers

Some of our service providers (Vercel, Google Workspace, Google Analytics, Stripe, Clay.com, Instantly.ai, Expandi.io, Twilio, Meta Platforms Inc., Supabase, OpenAI, Anthropic/OpenRouter, Slack) are based in the United States. Data transfers comply with GDPR safeguards through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• EU-US Data Privacy Framework (DPF), where applicable

Messagenet is an Italian provider and call recording data is not transferred outside the EU.

9. Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected:

• Contact form data: maximum 12 months from the request
• B2B outreach data (unconverted leads): maximum 12 months from collection, then automatically deleted
• Active client data: duration of the contract + 24 months post-termination for legal and accounting obligations
• Call recordings: maximum 6 months from the recording
• Google Analytics 4 statistical data: 14 months from collection, then automatically deleted by Google
• Google Ads campaign measurement data: 90 days (lifetime of the _gcl_au cookie)
• Collaborator and contractor data: duration of the relationship + 10 years for tax obligations
• Google Business Profile data (API cache): maximum 30 days, in compliance with Google policies
• eBay data (API cache): maximum 30 days from service termination
• WhatsApp Business data (message logs, conversation metadata, tenant WABA configurations): duration of the contract with the tenant + 12 months, then automatic deletion

10. User Rights

In accordance with GDPR (Articles 15-22), you have the right to:

• Access your personal data (Art. 15)
• Request rectification of inaccurate data (Art. 16)
• Request erasure of data (Art. 17 — "right to be forgotten")
• Restrict data processing (Art. 18)
• Request data portability (Art. 20)
• Object to processing, including commercial outreach based on legitimate interest (Art. 21)
• Withdraw consent at any time, without affecting the lawfulness of processing based on consent given prior to withdrawal

To exercise your rights, you can contact us at info@skalo.agency or write to the EU Representative. We will respond within 30 days of receiving the request.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it) or any other competent supervisory authority.

11. How to Opt Out of Commercial Outreach

If you have received a commercial communication from Skalo Agency and wish to no longer be contacted:

• Click the unsubscribe link included in every email — removal is automatic within 24 hours
• Or write to info@skalo.agency with your request — your data will be removed from all our records within 72 hours

12. Security

We adopt appropriate technical and organizational measures to protect personal data from unauthorized access, loss, or destruction, including: HTTPS encryption for all communications, multi-factor authentication (MFA) for system access, access limited to authorized personnel only, regular backups, and secure storage.

13. Cookies

This website uses technical cookies and, only with your consent, the statistical cookies of Google Analytics 4. On your first visit a panel appears with two equally weighted choices: if you do not answer it counts as a refusal and nothing is installed. You can change your mind at any time from the icon at the bottom right. The full list of cookies, with durations and purposes, is in our Cookie Policy. Cookie Policy

14. Policy Changes

We reserve the right to update this Privacy Policy at any time. Changes will be published on this page with the date of last update.

15. Contact

For any questions regarding this Privacy Policy or the processing of your personal data:

• Data Controller: Skalo Agency LLC — info@skalo.agency
• EU Representative (Art. 27): Annamatilde Baiano — Via Conte Roncone, 7, 00020 Ciciliano (RM), Italy — info@skalo.agency — +39 347 939 7971

WhatsApp Business API and Meta Integration

By using our platform (Skalo AI Hub) to connect your WhatsApp Business account, you authorize the transfer and processing of data through the infrastructure of Meta Platforms, Inc., which acts as data processor for messages sent via WhatsApp Cloud API. The legal basis for processing end-user data of individuals interacting with tenants via WhatsApp is performance of a contract with the tenant (Art. 6, par. 1, let. b, GDPR) and legitimate interest of Skalo Agency (Art. 6, par. 1, let. f, GDPR). The Meta Privacy Policy (facebook.com/privacy/policy) also applies to data transiting Meta's infrastructure. You can revoke this authorization at any time by disconnecting your WhatsApp account from our dashboard. To request complete deletion of your data and WhatsApp configurations, contact us at info@skalo.agency.

• Data transferred to Meta: recipient phone numbers, message content (templates and free text), any attachments, delivery metadata (timestamps, read status).
• Data is encrypted during transit to the Meta API.
• Skalo Agency does not use WhatsApp conversation data for advertising, profiling, or sale to third parties.
• Conversation data is retained for the duration of the contract with the tenant + 12 months from termination, then automatically deleted.
• End users of tenants who wish to exercise their GDPR rights (access, rectification, erasure) regarding WhatsApp messages may write to info@skalo.agency; we will respond within 30 days.