Privacy Policy
Last updated 9 September 2026
This policy explains what personal data skep.co collects when you use Promotor, why, and your rights under the EU General Data Protection Regulation (GDPR) and Spanish data-protection law (LOPDGDD). The data controller is skep.co; contact [email protected].
The Service is operated by an independent maker. Paid plans are sold by Creem, our merchant of record, which issues your invoice and remits VAT. For anything about the Service or your data: [email protected].
Data we collect
- Account data: your email address and a hashed (argon2id) password. We never store your password in plain text.
- Project data: the assumptions, figures, addresses and images you enter to build your models.
- Billing data: subscription status and a customer identifier from our payment processor. Card details are handled by the processor, not by us.
- Technical data: a session cookie, your language choice, and standard server logs (IP, timestamp, error diagnostics) needed to run and secure the Service.
- Investor engagement data: if you are invited to view shared projects, we record how many times you open each shared project and when you last opened it. This is shown to the promotor who invited you so they can see engagement.
Why we process it (legal bases)
- To provide the Service and your account: performance of a contract (Art. 6(1)(b) GDPR).
- To take payment and prevent abuse of paid third-party features: legitimate interests and contract (Art. 6(1)(b),(f)).
- To meet accounting and legal obligations: legal obligation (Art. 6(1)(c)).
Processors we use
We share the minimum data necessary with providers who process it on our behalf under GDPR-compliant terms:
- Cloudflare (United States): content delivery, TLS termination and network security at the edge. As our edge provider it processes all traffic to and from the Service, including your IP address, to keep it fast and protected.
- Creem (merchant of record): sells and bills the subscription. Creem handles your payment details, invoice and VAT as its own data controller, under its own privacy policy; we receive only whether your subscription is active and a customer identifier.
- Cloudinary: hosting of images you upload to a project.
- xAI (Grok) (United States): used by three optional AI features, the What-if analysis, the investor Memo generator and the document import. For the first two we send the project name, city and region together with its financial figures and results to xAI to generate the output; we do not send the street address, the developer, architect or commercialisation names you entered, the map location, or any images you uploaded. For the document import, the file you choose to upload is different: we send the text of that document to xAI so it can read the figures, and if the document is a scan with no text layer we send images of its pages instead. Whatever that document contains is therefore sent, so do not upload a document holding personal data you do not want processed. The document itself is deleted from our server once the project is created, or within an hour if you abandon the import. If you do not use these features, no project data is sent to xAI.
- OpenStreetMap (Nominatim): only when you use the optional "Detect from address" feature, the address you type is sent to this public geocoding service to look up map coordinates. This is a public service, not a contracted processor.
- Email relay: to send transactional email such as password resets and investor invitations.
What we do not do
We do not sell your personal data, we do not share it with advertisers, and we do not use it for advertising or tracking. We do not train any model on your data. The AI processor above receives only what a feature you triggered needs in order to produce the output you asked for.
Automated decisions
Promotor takes no automated decisions producing legal or similarly significant effects concerning you, and does not profile you, within the meaning of Art. 22 GDPR. The model calculates from the figures you enter; it does not score you or anyone else.
Hosting and international transfers
Your account and project data (your models and their figures) are stored on EU infrastructure in Frankfurt, Germany. Images you upload are handled by our image processor, Cloudinary, which may store them outside the EEA; any such transfer is covered by an adequacy decision or Standard Contractual Clauses. Where any other processor transfers data outside the EEA, that transfer is likewise covered by an adequacy decision or Standard Contractual Clauses.
Retention
We keep your data for as long as your account is active. Deleted projects are held for 30 days (so they can be restored) and then permanently removed, including any images attached to them. When you close your account we delete or anonymise your personal data, except where we must retain limited records to meet legal obligations. Server access logs, which include IP addresses, are kept for about 14 days and then deleted automatically.
Your rights
You have the right to access, rectify, erase, restrict or object to processing of your personal data, and the right to data portability. Where we ever rely on your consent, you may withdraw it at any time without affecting processing already carried out. You can exercise these rights by contacting [email protected]; we answer within one month. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es) or your local supervisory authority.
Security
We use HTTPS in transit, hashed passwords, per-user access control, and httpOnly session cookies. No system is perfectly secure, but we take reasonable measures to protect your data and will notify you and the authorities of a breach where required.