Privacy Policy

Company: Skippr Ltd. ("Skippr", "we", "us", "our")

Registered office: 99 Milton Keynes Business Centre, Foxhunter Drive, Linford Wood, Milton Keynes, Buckinghamshire MK14 6GD, England

Email: privacy@skippr.ai

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use:

• Our websites (skippr.ai) and any page that links to this Policy;
• Our AI agent platform (deployed via live video call, session link, SDK, website embed, or in-product module);
• Our waitlist and support channels; and
• Other services that reference this Policy (together, the "Services").

If you do not agree with this Policy, please do not use the Services.

In this Policy, "you" means the person or organization using the Services or visiting our websites. Where something applies only to a specific role — Client or End User — it says so expressly.

Privacy at a Glance

• What the product does. Skippr provides AI agents (each, an "Agent") that run live, interactive sessions.
• Client and End Users. A Client holds a Skippr workspace and may use the Services for its own purposes and/or deploy the Agent to its own customers and prospects ("End Users").
• If you are an End User (you used an AI agent inside another company's product): that company controls your personal data and its privacy policy applies. Skippr processes your session data on that company's behalf. For personal data from your agent sessions, you can exercise your privacy rights through that company or directly with us at privacy@skippr.ai — both paths work. For any other data that company holds about you, contact them directly.
• Website vs. product roles. For the website/app, Skippr is the Controller. For sessions deployed to End Users, you (or your organization) are the Controller; Skippr acts as your Processor under our Data Processing Addendum.
• Recording is off by default. A workspace may enable session recording (audio and screen); when enabled, the Agent announces at the start of the session that it is being recorded.
• Transcripts and analytics are part of the Services. Transcripts, session analytics, and Derived Output are generated for every session and are stored in your workspace.
• Your data is not used to train third-party AI models. Our AI providers are contractually restricted from using your content for training. We may use aggregated or de-identified session data to improve our own agents and Services.
• Client obligations. If you deploy the Agent to End Users, the required disclosures — that the session is conducted by an AI, whether it is recorded, and how to request data deletion — are provided by default through Skippr's session interfaces and the Agent itself. Do not interfere with these notices. If we agree that you present your own notice instead, providing the disclosures is your responsibility. As the data controller, you remain responsible for ensuring your End Users receive them.
• Cookies (websites and platform only). Non-essential cookies and analytics run only with your consent.
• Your rights & deletion. You (and End Users) can request permanent deletion by email; in-product "delete" is archive only.

Table of Contents

1. Definitions
2. Information We Collect
3. How We Use Information
4. Legal Bases (EU/UK)
5. When We Share Information
6. Cookies and Similar Technologies (Web)
7. Retention
8. Security
9. International Transfers
10. Children
11. Your Privacy Rights
12. End User Privacy Rights
13. Do-Not-Track & Global Privacy Control
14. California Notice (CPRA/CCPA)
15. Agent Privacy Disclosures
16. Client Obligations When Deploying the Agent to End Users
17. Updates
18. Governing Law
19. Contact
20. Access/Deletion Requests
21. Roles & Your Responsibilities (Controller/Processor)

1) Definitions

• Agent: any AI agent provided as part of the Services.
• Client: The individual or organization that holds a Skippr account and workspace. A Client may use the Services for its own purposes and/or deploy the Agent to interact with its own End Users.
• End User: A third party (e.g., a Client's customer, prospect, or user) who participates in a session initiated or deployed by a Client.
• Customer Content: Content you provide to the Services (for example, prompts and uploads), including Workspace Data.
• Session Data: All content captured during an interactive session, including but not limited to: audio and screen recordings; periodic screenshots; transcripts; participant inputs and responses; and session metadata. Analytics, scores, and other outputs generated from sessions are Derived Output.
• Workspace Data: Any content uploaded or configured by a Client in their workspace to build, configure, and operate agents — such as product documentation, scripts, branding assets, and agent configurations.
• Derived Output: Reports, summaries, analytics, scores, recommendations, and any other outputs produced by the Services from your inputs or Session Data.
• AI Processing Services: Third-party services used to help power the Services' AI capabilities and produce Derived Output.

2) Information We Collect

a) Information you provide

• Account details (such as name, work email, and company), workspace names, content you upload, and support requests.
• Workspace data — anything you upload or configure to set up your organization and agents (such as product documentation, branding assets, and agent settings).

b) Information collected automatically (website/app)

• Log data (IP address, device/browser info, pages viewed, timestamps) and cookie-based analytics/functional data as described in Section 6.

c) Session data

When a session takes place (whether you are a Client running your own session or a Client's End User), the Services may collect and process:

• Audio and screen recordings of the session (participant voice, and the visual content of the product interface or shared screen);
• Real-time screen captures of the product interface being demonstrated or navigated;
• Transcripts of the conversation (generated via speech-to-text);
• Participant inputs (text chat messages, selections, form responses during the session);
• Session metadata (timestamps, duration, language, connection quality, participant identifiers such as name and email if provided);
• Behavioral analytics generated during the session (qualification scores, engagement metrics, drop-off points, intent signals, interaction patterns);
• Follow-up actions triggered (emails sent, meetings booked, CRM records created/updated).

Voice. Audio input is processed in real-time for speech-to-text and text-to-speech. Voice recordings are retained as part of Session Data (session recordings) per your workspace settings.

Workspace data. The Agent references your Workspace Data during sessions. Documents you upload are processed to extract their content; we retain the extracted content and related information, not the original files. Workspace content (including extracted content, branding assets, agent configurations, and other reference data) is stored in your workspace, used to operate your agents, and is not shared with other customers. You can delete content through the controls available in the product; for permanent deletion including backup erasure, email privacy@skippr.ai.

d) End User data (when the Agent is deployed by a Client)

When a Client deploys the Agent, we process End User personal data on the Client's behalf as their Processor. This may include:

• End User name and email (if provided or collected during the session);
• Voice and video of the End User during the session;
• End User inputs, questions, and responses;
• Behavioral data and qualification scores generated about the End User;
• Follow-up data (emails sent to End User, meetings booked).

We process End User data solely on the Client's instructions and for the purposes of providing the Services to the Client.

e) Diagnostics/monitoring

We collect limited telemetry (feature usage events, error rates, performance metrics) to monitor reliability and address bugs. This is not background browsing or session history.

3) How We Use Information

• Provide and improve the Services. Create and secure accounts, deliver reports, operate projects/collaboration, conduct agent sessions, provide support, and improve features.
• Sessions, analytics, client improvement, and follow-up. Session Data (including screen and voice recordings, transcripts, and analytics) is used to: power real-time conversational AI and visual understanding; generate session analytics and Derived Output; enable Clients to review session recordings, improve session quality, and follow up with participants; and, in aggregated or de-identified form that does not identify you or any End User, improve our agents and Services. Workspace Data is retrieved during sessions to inform responses. Follow-up actions (emails, meeting bookings, CRM updates) are triggered as configured by you.
• Communications. Service and security notices; with your consent where required, product updates and marketing. We do not use End User contact details for Skippr's own marketing.
• Security and compliance. Detect and prevent fraud/abuse, meet legal obligations, and enforce terms.

4) Legal Bases (EU/UK)

We rely on:

• Contract (to provide core services you request);
• Legitimate interests (to secure and improve services, deliver sessions you request as controller);
• Consent (marketing emails; non-essential website cookies/analytics where required);
• Legal obligations (tax/accounting, responding to lawful requests).

Where we store Session Data in your workspace, our legal basis is performance of a contract and/or our legitimate interests, balanced with your controls and rights.

For End User data processed on behalf of Clients, the Client determines the legal basis as Controller. Skippr processes such data as Processor on the Client's instructions.

5) When We Share Information

We do not sell personal information. We share information only with:

• Service providers / sub-processors: see our current sub-processors list at https://skippr.ai/subprocessors.
• Legal: Compliance with law, safety and rights protection; fraud/abuse prevention; responding to lawful requests.
• At your direction: When you integrate or export to services you choose.

6) Cookies and Similar Technologies (Web)

• Essential cookies operate the site (auth, session).
• Non-essential (analytics, A/B testing, advertising) run only with your consent where required.

Cookies do not apply to agent sessions; those are covered in their respective sections.

7) Retention

We keep personal information only as long as needed for the purposes described or as required by law.

• Account/workspace data: Until you delete your account or we no longer need it to provide the Services.
• Session Data: Session recordings, transcripts, analytics, and Derived Output: 12 months by default or until we process your permanent deletion request.
• Workspace data: Retained until deleted or your account is terminated. You can delete content through the controls available in the product; for permanent deletion (including erasure from backups), email privacy@skippr.ai.
• End User Session Data: Retained per the Client's settings (default 12 months) or until permanent deletion is requested by the Client or the End User (via either privacy@skippr.ai or the Client directly).
• Follow-up records (emails, CRM entries): Retained per workspace settings. Note that copies transmitted to third-party systems (CRM, email platforms) are subject to those systems' retention policies.
• Support tickets: Approximately 3 years after resolution.
• Billing/transaction records: 7 years (legal requirement).
• Website cookies/analytics: Per tool settings and your consent choices.

8) Security

We use reasonable and appropriate safeguards, including encryption in transit/at rest (where applicable), role-based access controls with MFA for staff, secure development practices, logging/monitoring, vulnerability management, and an incident response process.

Session recordings and transcripts are encrypted at rest. Access to Session Data is restricted to authorized workspace members based on their role. Certain recognised sensitive fields (such as password and payment inputs) are masked client-side on a best-effort basis before capture.

9) International Transfers

We operate from the United Kingdom with cloud infrastructure in the United Kingdom, the EEA, and the United States. Where required, we use recognized transfer mechanisms (e.g., adequacy decisions, standard contractual clauses with UK addendum, or other appropriate safeguards).

10) Children

The Services are not directed to children under 13 and are intended for professional/business use. We do not knowingly collect personal information from children. If we learn we have, we will delete it.

Clients must not knowingly direct sessions at children under 13 (or the applicable age of consent in relevant jurisdictions).

11) Your Privacy Rights (Clients)

Depending on your location, you may have rights to access, correct, delete (including permanent deletion of Session Data by request), restrict or object, withdraw consent, or data portability. You may also opt out of marketing at any time.

• EU/UK: You may lodge a complaint with your local supervisory authority.
• US states with privacy laws: You may have additional rights under applicable state privacy laws — see Section 14 (California Notice).
• Canada: You may access/correct your data and ask about cross-border processing and safeguards.

If we have collected and processed your personal data with your consent, you can withdraw your consent at any time. Withdrawing consent will not affect the lawfulness of any processing conducted before your withdrawal, nor processing based on lawful grounds other than consent.

To exercise your rights, contact privacy@skippr.ai — see Section 20 for what to include in your request and the timelines that apply.

12) End User Privacy Rights

If you are an End User who has participated in a session deployed or conducted by a Client or another organization, you have the following rights. You may exercise these rights through either of two paths:

• Contact Skippr directly at privacy@skippr.ai; or
• Contact the Client (the organization that deployed or conducted the session) through their own privacy or data subject request process.

Skippr will honor requests received through either path.

a) Right to Know

You may request information about what personal data was collected during your session, how it was used, and with whom it was shared. Contact privacy@skippr.ai or the Client (the organization that deployed the session) directly.

b) Right to Access

You may request a copy of the personal data collected about you during a session, including session recordings, transcripts, and analytics.

c) Right to Deletion

You may request permanent deletion of your Session Data (recordings, transcripts, analytics, and any Derived Output relating to you) by emailing privacy@skippr.ai or by contacting the Client. We will identify the relevant Client workspace, verify your identity, notify the Client, and process the deletion. See Section 20 for what to include in your request and the timelines that apply.

d) Right to Correction

You may request correction of inaccurate personal data. Contact privacy@skippr.ai or the Client directly.

e) Right to Object

Where processing is based on legitimate interests, you may object. Contact privacy@skippr.ai or the Client directly.

f) Complaint

EU/UK End Users may lodge a complaint with their local supervisory authority. US End Users have rights under applicable state privacy laws.

Important: Where a session was deployed by a Client, the Client is the data Controller for your data. Skippr processes your data as the Client's Processor. You may contact either the Client or Skippr directly — both paths are valid. Skippr will independently honor deletion requests received at privacy@skippr.ai regardless of which path you use.

13) Do-Not-Track & Global Privacy Control

We currently do not respond to browser privacy signals such as DNT or GPC. To exercise your privacy choices, contact privacy@skippr.ai.

14) California Notice (CPRA/CCPA)

• We do not sell personal information. Where our websites use advertising/remarketing tools, that may be "sharing"; to opt out, contact privacy@skippr.ai.
• You have rights to know, delete, correct, and to non-discrimination.
• We do not sell/share minors' personal information (under 16).
• Categories collected depend on your use: Identifiers (e.g., email), Internet/Network Activity (site analytics), Commercial Info (purchases), Inferences (product interest), and Audio/Visual Information (session recordings, including screen captures and voice recordings). See Section 7 for retention.

15) Agent Privacy Disclosures

a) What the Agent Collects During a Session

• Microphone audio while you speak with the Agent (processed in real time for speech-to-text; retained only when recording is enabled);
• Screen content — frames captured through screen sharing or from the product interface in use (processed in real time so the Agent can see the session; when recording is enabled, these frames are retained and form the session recording);
• The transcript of the conversation.

Analytics and other outputs generated from sessions are Derived Output (see Section 3).

b) How Sessions Are Recorded

Sessions are not recorded by default. Recording can be enabled per workspace. When recording is enabled, the Agent announces at the start of the session that it is being recorded, and the recording (audio and screen) is stored in the Client's workspace, subject to workspace retention settings. Transcripts, session summaries, and analytics are generated whether or not recording is enabled.

c) Multi-Language Processing

The Agent operates in multiple languages. Session content may be processed, transcribed, and stored in any language used during the session.

d) How Recordings Are Used

Session recordings (audio and screen) and transcripts are used for the following purposes:

• Generating Derived Output: Session summaries, analytics, qualification scores, and follow-up recommendations;
• Client review and improvement: Clients can review recordings to improve session quality, refine their Workspace Data, train their teams, and follow up with session participants;
• Service improvement: Skippr may use aggregated or de-identified information derived from sessions (that does not identify you or any End User) to improve our agents and Services;
• Follow-up actions: Triggering configured actions such as emails, calendar bookings, and CRM updates.

e) Client Access to Session Recordings

Clients who deploy the Agent have access to session recordings, transcripts, and analytics within their workspace. Clients may use this data to review session quality, identify areas for improvement, adjust the Agent's configuration and Workspace Data, and conduct follow-ups with End Users — all subject to their obligations as data Controller (see Section 16).

16) Client Obligations When Deploying the Agent to End Users

If you are a Client deploying the Agent to interact with your End Users, you are the data Controller for all End User personal data processed during those sessions. You must:

a) Provide Adequate Disclosure

Before or at the start of each session, ensure End Users are clearly informed that:

1. They are interacting with an AI agent, not a human;
2. Conversations are transcribed and analyzed as part of the Services, and the session may additionally be recorded (audio and screen) when recording is enabled;
3. Session data will be processed by Skippr (as your processor), stored, and used for analytics, follow-up communications, and improving the AI agent's performance;
4. They may request access to or deletion of their data by contacting privacy@skippr.ai or through your own data subject request process;
5. A link to the applicable privacy policy is available.

End User notice. By default, Skippr's session interfaces display a notice to End Users linking Skippr's Terms of Service and Privacy Policy. If we have agreed that you present your own notice instead (see our Terms of Service, Section 7), your agreements with End Users must include the disclosures above and use restrictions protecting the Services, and you must keep records of acceptance. As Controller, you remain responsible for ensuring End Users receive the required disclosures.

b) Establish a Lawful Basis

You are responsible for determining and maintaining a lawful basis for processing End User data through the Services, including for recording, analytics, and automated follow-ups.

c) Handle Data Subject Requests

If End Users contact you directly with data subject requests (access, correction, deletion, objection), you are responsible for fulfilling them. Skippr will provide reasonable technical assistance.

If End Users contact Skippr directly at privacy@skippr.ai, we will notify you and assist in fulfilling the request.

d) Do Not Target Minors

You must not knowingly deploy sessions directed at individuals under 13 (or the applicable age of consent).

17) Updates

We may update this Policy. The "Effective Date" will change and, for material updates, we will provide reasonable notice.

18) Governing Law

This Policy is governed by the laws of England and Wales. If you are a consumer in the EU/UK, you may also bring claims in the courts of your place of residence.

19) Contact

Privacy contact: privacy@skippr.ai

Postal: Skippr Ltd., address above.

20) Access/Deletion Requests

For Clients

Submit privacy requests by emailing privacy@skippr.ai from the email on your account. Include:

• Request type: access, correction, permanent deletion (erasure), portability, restriction, or objection;
• Scope: account, workspace, session ID(s) (if known), relevant dates/URLs;
• Authority: if acting for an organization, your role (e.g., workspace admin) and authorization if required.

For End Users

Submit privacy requests by emailing privacy@skippr.ai. Include:

• Your name and email (as used during the session);
• Request type: access, correction, permanent deletion, objection;
• Session context: approximate date, the company/product whose session you participated in (if known);
• Any additional identifying information that may help us locate your data.

Verification

We may verify identity and (for workspace requests) administrative authority. For End User requests, we may need to confirm identity with the relevant Client.

What We Delete

For approved permanent deletion requests, we permanently erase the data covered by your request from our active systems, with backups overwritten on the next scheduled rotation. We retain only data we must keep by law (e.g., billing records, security logs) for the required period.

Timelines

We respond within one month of receiving your request. Once verified, erasure from active systems is typically completed within 30 days; backups are overwritten on the next scheduled rotation (typically within 35 additional days).

Limitations

We may decline or limit a request where identity/authority cannot be verified, where it would adversely affect others' rights, or where retention is legally required. If denied, we explain why and how to appeal if applicable.

Abuse-prevention and legal records. Where an account, workspace, or End User has been suspended or blocked for violating our Terms of Service, we retain the information necessary to enforce that suspension and to establish, exercise, or defend legal claims — such as account identifiers, email addresses, related technical identifiers, and records of the relevant activity — notwithstanding a deletion request, on the basis of our legitimate interests in securing the Services and complying with legal obligations.

21) Roles & Your Responsibilities (Controller/Processor)

Security and service improvement. For limited purposes — securing the Services, preventing fraud and abuse, complying with legal obligations, and improving the Services using aggregated or de-identified information — Skippr processes personal data as an independent controller.

Your responsibilities as Controller (Client): You determine the lawful basis for processing End User data, ensure adequate disclosures are made, handle (or cooperate with Skippr to handle) End User data subject requests, and configure session recording and data routing in compliance with applicable law.

DPA: Our standard Data Processing Addendum (https://skippr.ai/dpa) forms part of our agreement with Clients; a separately signed data processing agreement prevails.