Skip to content
Skeptral
Go to App
Back to Home
Legal

Privacy Policy

Last Updated: 10 July 2026

At Skeptral ("we", "us", or "our"), the privacy promise is part of the product. This policy describes exactly what we collect in each flow, what we deliberately never store, and who processes it on our behalf. Where the product makes a promise, this document matches the code that keeps it.

1. Who We Are

Skeptral is operated by its founder, a sole trader based in Romania, who is the data controller for the personal data described here. There is no larger company behind it, no data protection officer is legally required at this scale, and we won't invent one. Questions and requests go to privacy@skeptral.com.

2. Free Validations: What We Don't Collect

The free Validate flow is anonymous and its promise is deliberate: the pitch you validate is never stored. Here is what actually happens:

  • Your pitch text is processed in memory only. It is sent to the AI panel to produce the verdict and is never written to our database or to disk.
  • Only the verdict is kept. The result you poll for (score, verdict, reasoning) lives in a job file keyed by an unguessable token, and that file is deleted after 7 days.
  • No account, no email, no tracking identifier is required or created for a free validation.

Because the pitch is never stored, there is nothing for us to delete, share, or train on. A free validation leaves no pitch behind.

3. Dossier Purchases: What We Collect With Your Consent

Buying the one-time €29 dossier is the only flow where we store a pitch, and only behind an explicit, unticked consent box. The consent line you agree to is the whole promise: "The pitch is stored only to build your dossier, never added to the public pool, never used for training."

  • What we store: your pitch (plus any target market and founder context you added), your email address, and your payment status. Card details never touch our servers; Stripe holds those.
  • Why: solely to build your dossier and deliver it to your private link, and to email you that link.
  • How long: until your dossier is delivered and for as long as your private delivery link stays live, so you can come back to it.
  • If you abandon checkout: a pending purchase that never pays is wiped, pitch and email together, within 48 hours.
  • If you're refunded: the stored pitch is scrubbed at the point of refund. Your email stays on the payment record for the audit trail Stripe transactions require.
  • Ad attribution is separate: if, and only if, you allowed ad cookies, we send the ad platform a server-side purchase event containing a hashed (SHA-256) version of your email, never your pitch. Without that opt-in, no event is sent.

4. Accounts

Accounts are open. Creating one stores your email address (which is also how you sign in), your plan, and product usage counts for metering monthly allowances. We don't ask for a name, a profile, or anything beyond what the account needs to function, and account emails are used for sign-in and service messages, never sold.

5. Rate Limiting and Technical Data

We use your IP address to enforce rate limits on the free flows and to contain abuse (burst caps, daily allowances, and a box-wide surge ceiling). These counters live in the server's memory, not in a database, and we don't build profiles from them. Standard infrastructure logs (our host and CDN) may record IPs as any website's do.

6. Who Processes Your Data

We keep the processor list short and name every one:

  • Stripe — payment processing. Your card details go to Stripe directly and never touch our servers.
  • Resend — transactional email: your dossier delivery link and, if you subscribed, the daily verdict (every send carries a one-click unsubscribe).
  • PostHog — product analytics. Runs in memory-only mode (no cookie, nothing persisted on your device) until you opt in via the consent banner.
  • OpenRouter — routes our AI processing to third-party model providers (Anthropic, Google, and others) under their API terms, which do not permit training on your inputs.
  • Hetzner — hosting. Our server runs in Germany, and data is stored on that box (SQLite, no external database service).
  • Cloudflare — DNS and CDN in front of the site.
  • Meta, TikTok, Google (ads) — only if you explicitly allow ad cookies, and only on marketing pages. See the Cookie Policy.

7. Security and Storage

Traffic runs over HTTPS, data lives on a single server in Germany with access limited to the operator, and dossier delivery links carry 128 bits of randomness so they can't be guessed. We don't yet hold formal certifications such as SOC 2, and we won't claim ones we haven't earned; our security page describes the honest posture in detail.

8. Lawful Bases (GDPR)

  • Consent: storing your pitch for a dossier purchase, ad measurement pixels, persistent analytics, and the daily email list.
  • Contract: processing your email and payment status to deliver the dossier you bought.
  • Legitimate interest: rate limiting, fraud and abuse prevention, and error logging that keeps the service running.

9. Your Rights

Under the GDPR (and equivalent laws elsewhere) you can ask for access, correction, erasure, portability, or restriction of your data, and you can object to processing based on legitimate interest. Email privacy@skeptral.com and we action requests within 30 days. You also have the right to complain to your local supervisory authority; ours is the Romanian ANSPDCP. Note that for free validations there is usually nothing to erase: the pitch was never stored.

10. Changes to This Policy

We may update this policy as the product evolves or the law changes. When we do, we'll revise the "Last Updated" date above, and for material changes we'll give notice on the site or by email where we hold an address for you.

Data Controller & Contact: Skeptral, operated by its Romania-based founder, is the controller of the personal data described here. If you have any questions about this policy or your privacy rights, reach us at privacy@skeptral.com.