Version 2026-10-21 — in force from 21 October 2026.
1 Who we are and when this notice applies
Escalio is operated by Vladimir Kozak, trading as Escalio, Goethestrasse 2/1, 79576 Weil am Rhein, Germany. You can contact us about privacy at support@escalio.org or at this postal address. This is our general privacy contact, not a representation that a statutory data protection officer has been appointed.
This notice explains personal data processing connected with our website, registration, staff accounts, billing, communications with us, support workspaces, customer portals, website chat, integrations and AI.
Our role depends on the activity:
- Escalio as controller: we decide why and how to process data needed to administer our customer relationship, manage accounts and billing, protect our own service, answer support requests addressed to us, meet legal obligations and conduct any separately authorized setup-improvement activity.
- Escalio as processor: when an organization uses Escalio to handle its customers’ requests, we normally process that organization’s tickets, contacts, messages and related content on its instructions under our DPA. The organization is normally the controller, or may itself be acting for another controller.
If you contact a company through its Escalio-powered portal, chat or messaging channel, consult that company’s privacy notice. It determines the purpose of your support request and controls its records. This notice explains Escalio’s role; it does not replace the company’s notice.
2 Information we receive and its sources
Website and connection information. Our infrastructure receives information needed to deliver and protect requests, such as an IP address, request time, requested address, browser or device information and technical errors. Application rate-limit records use keyed or other protected identifiers in the relevant flows; this does not mean that infrastructure and external providers never receive an IP address.
Registration and staff accounts. We receive email addresses, names and profile information; the organization, chosen workspace address, memberships and roles; language and other preferences; account-verification, sign-in and security records; and subscription status. Registration also records the wording version acknowledged and relevant timestamps. Optional organization details and a company website may be supplied.
Passwords are stored as hashes, not readable passwords. If you use an external sign-in method, we receive the verified identifier and profile fields that method supplies. Wallet sign-in can associate a public wallet address with your account and requires a proof of control; we do not need your private key or recovery phrase.
Billing. We receive the business and billing details supplied at checkout, plan and agent quantity, subscription periods, invoice and payment status, relevant provider identifiers and information needed for reconciliation and statutory records. Card information is collected by the payment provider; Escalio does not need your full card number or card security code.
For a crypto payment we process the public paying and receiving addresses, token, network, amount, transaction hash and confirmation information, and link the payment to the organization’s purchase. Blockchain records are public and may be permanent.
Customer workspaces. An organization and its users may provide contact details, customer-company records, ticket text, email headers and messages, public replies, internal notes, attachments, custom fields, tags, feedback, imported history, channel identifiers and related events. Data can arrive directly from the person contacting support, the organization’s staff, authorized imports or connected services.
Portals and website chat. We process the name, email address or other identifier supplied, messages and attachments, verification information, and browser/session information needed to show the conversation. Verification status affects which functions are available. A portal’s staff accounts and customer identities are separate.
AI and connected sources. We process prompts, responses, conversation history, relevant ticket context and results retrieved from authorized connectors. Details are explained in section 5.
Communications with Escalio. We receive the messages and files you send us, including support, commercial and privacy correspondence. Please avoid sending passwords, access tokens, wallet recovery phrases or unnecessary sensitive information.
We also receive data from an organization that invites you, your chosen sign-in or payment provider, connected services you authorize, and the public company website supplied during setup. We read that website to suggest portal branding and links.
3 Why we process data as controller
The GDPR basis depends on the activity and whose data it concerns.
| Purpose | Information used | Legal basis |
|---|---|---|
| Set up and provide a requested account or subscription | Registration, account, membership and subscription details | Article 6(1)(b), where the individual is our contracting customer or requests pre-contractual steps; Article 6(1)(f) for staff and representatives of an organizational customer, to administer and provide its requested service. |
| Administer billing and payments | Billing identity, order, provider and transaction records | Article 6(1)(b) for an individual customer; Article 6(1)(f) to administer an organization’s payment; Article 6(1)(c) for applicable tax, accounting and other legal duties. |
| Secure and operate the service | Connection, authentication, diagnostic and security records | Article 6(1)(f): maintaining a reliable service, preventing abuse and unauthorized access, and investigating incidents; Article 6(1)(c) where a specific legal obligation applies. |
| Answer requests addressed to Escalio | Contact details and the correspondence | Article 6(1)(b) for steps requested by an individual customer; Article 6(1)(f) to communicate with business contacts and resolve support issues; Article 6(1)(c) for statutory requests. |
| Understand business use and improve service administration | Organization-level setup progress, feature use, subscription, AI balance and cost information, and counts of AI requests declined as out of scope (never their text); limited staff identifiers where necessary | Article 6(1)(f): understanding onboarding, maintaining the service and managing subscriptions. This does not authorize unrestricted reuse of ticket or AI conversation content. |
| Optional sharing of your setup conversation for improving setup guidance | The conversation, setup context and derived evaluation material described in section 5 | Article 6(1)(a) for your optional personal-data contribution, together with any separate authorization required from the organization. Your choice is not consent on behalf of other people. |
| Previously requested beta or launch messages, or separately opted-in marketing | Contact details, preferences and consent records | Article 6(1)(a). Ordinary account registration does not subscribe you to marketing. |
| Establish or defend legal claims | Relevant contract, correspondence and evidence records | Article 6(1)(f), limited to what is necessary for the claim; Article 6(1)(c) where preservation is required by law. |
Where we rely on legitimate interests, we consider the purpose, necessity and impact on individuals. You may object as described below.
The organization using Escalio determines the legal basis for processing its support data. Our DPA governs our work on its behalf; we do not substitute a general “consent to Escalio” for that organization’s obligations.
4 Who can receive information
Access inside Escalio is limited according to the role and purpose. Authorized operations or support personnel may need access to diagnose a problem, protect the service, fulfill an instruction or comply with law. We do not claim that the service is end-to-end encrypted or inaccessible to every administrator.
Recipients may include:
- Hosting, storage, email and operational providers. AWS hosts the primary application, database and files in Stockholm and supports configured email and operational functions.
- AI providers. Relevant inputs and outputs are sent to the provider used for the requested feature. Escalio-managed AI uses OpenAI and, once Escalio enables it, Anthropic. For a German business customer, their standard contracting entities are OpenAI Ireland Ltd. and Anthropic Ireland, Limited. Their commercial DPAs apply under their standard service terms. The current routes do not establish EU-only processing or zero retention. Customer-configured compatible providers are additional recipients chosen for those features.
- Payment providers. Stripe processes card-payment and subscription data under the applicable payment arrangement. Wallet-connection services such as Reown/WalletConnect may receive connection metadata when used. Blockchain access providers process public transaction information needed to verify crypto payments.
- Services connected by the organization or individual. Examples include a mail provider, messaging platform, sign-in provider or an authorized MCP connection. The data transferred depends on the action and permissions. Those services have their own agreements and privacy information; their roles depend on the specific processing.
- The organization administering your workspace. Its authorized users can access information within their roles. Owners and administrators control membership and relevant organization settings. The processor relationship does not make a staff member’s personal account available to every customer.
- Professional advisers and public authorities. We disclose relevant information when needed for professional advice, legal obligations or the establishment or defense of claims, with appropriate restrictions.
We do not sell personal data or use customer support content for advertising. The subprocessor register accompanying our DPA identifies providers engaged to process Customer Personal Data on an organization’s behalf. It is distinct from providers acting for their own payment, network or legal purposes.
5 AI and setup assistance
When an authorized user uses organization AI, the request can include the typed message, previous conversation, relevant ticket messages and internal notes, and information retrieved through permitted tools and connectors. Only users with the relevant access should be able to request that context. Sending internal notes to an authorized staff AI feature does not make them public portal replies. On Escalio-managed models, Escalio AI answers about the organization’s support and Escalio only; it declines unrelated requests, and we count such refusals per organization without keeping the request’s text.
Workspace setup has a separate AI flow. When it is available, typed setup messages and relevant setup context are sent to Escalio’s configured setup model even if general organization AI is switched off. Fixed setup buttons can operate without a model response. Setup context can include organization details, answers about support channels, selected website information (including its public description), the names of connected Slack channels and setup progress. If Escalio turns it on, a weekly review sends the organization’s aggregate numbers (counts and times, never ticket text, names or addresses) to the setup model to suggest improvements.
Optional setup improvement is off by default. An owner or administrator may choose to share their own setup conversation. Escalio administrators can then review it, save selected examples and use the setup model to evaluate or propose improvements to setup instructions. Changes to those instructions are reviewed before activation. This is different from training the underlying general-purpose model.
You can turn sharing off. The service removes evaluation cases derived from that conversation and their corresponding case results; the ordinary setup conversation remains until separately deleted. Generalized instructions already adopted may remain, but must not retain identifiable personal content without a separate lawful basis. Contact us if such content appears in an instruction or review record so we can investigate and remove it where required. Withdrawal does not invalidate earlier lawful processing.
Do not opt in with other people’s personal or confidential data merely because you administer a workspace. Their data requires an appropriate lawful basis and any necessary authorization.
We do not make a blanket promise of zero provider retention or EU-only AI processing. Provider terms, configuration and the particular feature matter. The provider register and transfer information must describe the actual arrangements. We do not use Customer Personal Data to train a general-purpose model on our own initiative.
Escalio does not use AI to make decisions about individuals that are intended to have legal or similarly significant effects without human involvement. AI can generate suggestions or drafts and can be wrong. The organization is responsible for evaluating any decision process it builds using the service.
Provider retention is separate from Escalio backups. OpenAI API abuse-monitoring records normally have a maximum 30-day period with documented exceptions. Anthropic normally deletes API inputs/outputs within 30 days, but some models require safety retention/review and its policy allows longer retention for safety, law and specifically retained features; flagged inputs/outputs can be kept for up to two years and safety classifications for up to seven years. We do not claim zero retention or opt customer content into provider model training. See the provider links in the DPA register for details.
6 Cookies and browser storage
We use cookies, browser storage and similar technologies to provide requested functions, including sign-in, session protection, sign-in handoffs, registration confirmation, chat continuity and appearance preferences.
The registration flow can remember a recent submission using a signed cookie containing a protected identifier and timestamp rather than a plain email address, for up to 30 days. The staff account sign-in cookie can last up to 12 hours; signing out revokes the session. A separate legacy administration session can last up to eight hours where that interface is used.
Other sign-in, verification, portal and chat tokens have purpose-specific lifetimes. Appearance preferences may remain in local browser storage until changed or cleared. Chat storage can preserve the connection to a conversation across visits; clearing it may remove that browser’s access to the conversation.
The following first-party storage supports these features. A server-side session or proof may expire or be revoked before the browser removes its stored value.
| Storage or cookie | Purpose | Browser lifetime |
|---|---|---|
__Host-escalio_session | Staff authentication | Up to 12 hours. |
__Host-escalio_portal | Customer-portal authentication | Up to 12 hours. |
__Host-escalio_google_browser, __Host-escalio_google_signup | Bind Google sign-in or signup to the initiating browser | Up to 10 minutes. |
__Host-escalio_wallet_browser | Bind a wallet proof to its browser | Up to 15 minutes; individual proofs can expire earlier. |
__Host-escalio_customer_entry, __Host-escalio_staff_entry | Protect transfer between portal and workspace sign-in | Up to two minutes. |
__Host-escalio_portal_sso | Protect the portal single-sign-on flow | Up to 10 minutes. |
__Host-waitlist-receipt | Recognize a recent registration submission without storing a plain email address in this cookie | Up to 30 days. |
__Host-waitlist-admin | Legacy registration-administration sign-in, where used | Up to eight hours. |
escalio-workspace-theme, escalio-portal-mode, portal-menu-collapsed, escalio-portal-banner-closed | Appearance, navigation and dismissed-banner preferences | Local storage until changed, replaced or cleared. |
escalio-ai-model | Remember the selected AI model | Local storage until replaced or cleared. |
escalio-chat-key, escalio-chat-seen | Restore the browser's website-chat conversation and reading position | Local storage until replaced or cleared; server-side access can end earlier. |
| Temporary connection, ownership and page-state entries | Complete requested connections or ownership flows, remember a page or recover a failed load | Session storage, normally until the tab's browser session ends or the flow clears the entry; server authorization has separate expiry. |
All entries above are provided by Escalio on the relevant service or portal origin. Third-party sign-in, payment and wallet interfaces have separate storage practices.
We do not treat account registration as permission for advertising tracking. If a non-essential technology requiring consent is introduced, we will explain it and obtain the required choice before using it. External wallet, sign-in and payment services may use their own technologies under their notices.
7 Where data is processed
Primary Escalio hosting, database and file storage are in Stockholm, Sweden. Email delivery, integrations, payments, wallet connections, provider support and AI may involve recipients or processing outside the European Economic Area (“EEA”). A European hosting region is not a guarantee that every data flow stays in Europe.
Where we are responsible for a transfer outside the EEA, it must use an applicable legal mechanism, such as an adequacy decision covering the actual recipient and activity, or appropriate safeguards such as properly completed European Commission Standard Contractual Clauses, with the required assessment and supplementary measures.
You can request information about the applicable safeguards and a copy or description from support@escalio.org, subject to proportionate redaction of confidential information. We will not rely on routine forced consent to bypass the safeguards needed for ordinary service provision.
8 How long we keep information
We keep personal data for the purpose for which it was collected, applicable instructions and legal obligations. An account’s existence does not justify keeping every category forever.
| Category | Period or deletion criterion |
|---|---|
| Unconfirmed registration requests | Normally 30 days from the latest accepted confirmation request. Earlier requests collected without email confirmation used a 365-day period from the original consent date. |
| Confirmed registration records | 365 days from email confirmation. These records are separate from an active account and organization. |
| Historical unsubscribed records | 90 days from unsubscribe for the recorded preference. |
| Registration email jobs and rate-limit records | Completed, failed or cancelled registration email jobs: 30 days from job creation. Registration rate-limit buckets: 48 hours from the bucket start. Other sign-in controls have their own short expiry and cleanup rules. |
| Staff account and organization administration | While needed to provide the account, administer relevant memberships or handle a verified closure request, then only for an applicable legal or documented claims purpose. Removing one membership or one organization does not automatically delete a shared account. |
| Customer support data in organizations | According to the organization’s instructions. Automatic deletion of closed tickets and the Deleted folder is configurable and off by default. Trial expiry does not delete the content. |
| Organization deletion | The normal flow provides owners a 30-day cancellation and export period before erasure starts; earlier verified deletion can be requested. Cleanup can complete in stages. |
| AI threads and ordinary setup conversations | Until the relevant conversation or organization is deleted, or a scoped deletion request is carried out. A contact-erasure operation does not automatically find every mention in independent AI threads. |
| Optional setup evaluation cases | While the sharing choice remains active and the cases remain needed; derived cases and corresponding case results are removed when sharing is withdrawn or the source conversation or organization is deleted. Retained review or playbook material must not preserve identifiable content without a lawful basis. |
| Operational and infrastructure records | Configured retention varies: application and release log groups generally use 30 days; some infrastructure diagnostic groups use 14 days; load-balancer access logs use 90 days; cloud audit objects use 365 days with a further lifecycle period for noncurrent versions where applicable. In-application security/audit records are kept for the relevant organization lifecycle and, where necessary, for an unresolved incident or a specific legal or claims purpose. The relevant event, investigation, closure and applicable legal period determine when those records can be removed; this is separate from log-group expiry. Routine recovery-copy cleanup does not delete these active operational records. |
| Raw incoming email copies | All versions in Escalio-managed raw-email storage are removed within 30 days of receipt; daily cleanup starts at 28 days. The resulting ticket follows the organization's content-retention instructions. |
| Automated database recovery and file versions | Automated database recovery uses a verified seven-day window. Replaced/deleted file versions are removed within 30 days of becoming noncurrent, with daily cleanup starting at 28 days. Active files follow the organization's retention instructions. |
| Manual snapshots and other recovery copies | Escalio-managed manual snapshots and encrypted release recovery artifacts: no more than 30 days from creation, with daily cleanup starting at 28 days. Separately held recovery copies remain subject to the same deletion instructions and inventory. A specific legal preservation duty requires a limited scope, restricted access and a review/end date. |
| Billing, tax and contract evidence | Where applicable under German tax law: generally eight years for accounting vouchers, ten years for books and specified accounting records, and six years for business correspondence and other relevant records, normally from the end of the relevant calendar year. The record type and applicable law determine the period; an unresolved tax matter or other lawful hold can extend it. Payment records may outlive the account. |
| Privacy requests and support correspondence with Escalio | Ordinary correspondence is kept while needed to answer the request and resolve related follow-up. After resolution, retain only relevant records needed for a legal duty, demonstrating handling of a privacy request or a specific legal claim. The scope and period depend on that duty or claim; the ordinary German limitation period is generally three years starting at the end of the relevant calendar year, subject to its statutory conditions. This does not justify keeping unnecessary attachments or an entire support history. |
A lawful preservation requirement applies only to the relevant records and period. It is not a reason to retain an unrestricted copy of all customer content.
Deleted information in protected recovery copies is not used for normal service. Applicable deletion and restriction instructions must be reapplied before a restored copy is returned to ordinary use. External mailboxes, messaging services and the public blockchain are outside Escalio’s direct deletion control.
9 Your rights and how to use them
Where the GDPR applies, you can request access, correction, deletion, restriction and, in applicable circumstances, portability. You may object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time.
Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. Use the relevant setting or unsubscribe function, or contact us. Withdrawal of historical marketing consent does not itself delete an account.
Send requests about Escalio’s controller processing to support@escalio.org. We may ask for proportionate information to verify your identity. We normally respond within one month; if a legally permitted extension is necessary, we will explain it within that month. Rights are subject to applicable conditions and exceptions. Requests are normally free.
For an organization’s support records, contact that organization first. We will assist it under our DPA and forward a request sent to us to the appropriate organization where possible. We will not expose another person’s information merely to demonstrate that a record exists.
You may complain to a competent supervisory authority, including the authority where you live, work or believe an infringement occurred. For our establishment in Baden-Württemberg, the authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg: contact and complaints information. You do not have to contact us first.
10 Required information and choices
An email address and the information needed to verify and administer access are required for the relevant account function. Required billing information is needed to complete a purchase and meet legal duties. If you do not provide it, we may be unable to provide that function.
Optional profile fields, a company website, optional integrations and setup-improvement sharing are choices. Declining marketing or setup-improvement sharing does not prevent ordinary use of the service. The organization determines what is required for its own support requests and must explain that to its users.
11 Changes and contact
We will show the date of changes to this notice and explain material changes before relevant new processing begins. Where required, we will provide a separate notice or obtain consent. Updating this notice does not retrospectively authorize unrelated use of personal data.
Privacy contact: support@escalio.org. Postal contact: Vladimir Kozak, Goethestrasse 2/1, 79576 Weil am Rhein, Germany.