Privacy Policy
Edition dated 19 May 2026 · Version 1.0 · Applies together with the Terms of Use v4.0
This Privacy Policy describes what personal data is collected by KEYSTRA Ltd. / Sky World Community (swcpitch.com), for what purposes and on what legal basis such data is processed, to whom it is disclosed, how long it is retained, and what rights you have as a data subject. If you have any questions, please contact privacy@swcpitch.com.
1. Who We Are
Data Controller:
KEYSTRA Ltd. (trading name: Sky World Community / SWC)
Company No. C984038 | International Business Companies Act, 2016
Suite 9, Ansuya Estate, Revolution Ave, Victoria, Seychelles
Data protection contact: privacy@swcpitch.com
This Policy applies to all personal data processed in connection with the use of swcpitch.com and the AI audit Service. It forms an integral part of the Terms of Use v4.0 and applies together with them.
2. What Data We Collect
2.1. Data You Provide Directly
When completing the AI audit questionnaire you may provide:
- contact details: name, email address, phone number;
- project-related information: business description, industry, stage, team, financial indicators, business model, and other information provided in the questionnaire;
- company information: company name, jurisdiction, legal form;
- communications: the content of correspondence with the SWC team.
2.2. Data Collected Automatically
- technical data: IP address, browser type, operating system, referrer;
- usage data: pages visited, visit time, on-site actions;
- cookie data: described in our separate Cookie Policy.
2.3. Data We Do Not Collect
We do not request, and ask you not to provide: government identifiers (passport details, tax IDs), financial account details (card numbers, bank accounts), medical data, or biometric data. If such data is accidentally included in the questionnaire, we will delete it on discovery.
3. Purposes and Legal Bases of Processing
| Purpose | Data Categories | Legal Basis (GDPR) | Retention |
|---|---|---|---|
| Service provision and AI audit generation | Contact and project data | Art. 6(1)(b) — contract performance | 30 days after audit generation |
| Data transfer to Anthropic for AI audit | Project data (in full) | Art. 6(1)(b) + explicit consent (Art. 49(1)(a)) | Zero data retention |
| Business communications after audit | Contact details | Art. 6(1)(f) — legitimate interest | Until consent withdrawal / 12 months |
| SWC system improvement | Anonymised aggregated data | Art. 6(1)(f) — legitimate interest | Indefinitely (in anonymised form) |
| Abuse prevention and security | Technical data, IP | Art. 6(1)(f) — legitimate interest | 12 months |
| Legal compliance | Data as requested by regulators | Art. 6(1)(c) — legal obligation | As required by law |
| Website analytics (cookies) | Usage data | Consent (Art. 6(1)(a)) | Per Cookie Policy |
4. Disclosure to Third Parties
4.1. Subprocessors
| Subprocessor | Jurisdiction | Purpose | Transfer Mechanism |
|---|---|---|---|
| Anthropic, PBC | USA | AI audit generation via Claude API | Explicit consent (Art. 49(1)(a) GDPR). Zero data retention. |
| Vercel Inc. | USA | Hosting of site and edge functions | Standard Contractual Clauses (SCC) |
| Supabase Inc. | USA / EU | Database and authentication | Standard Contractual Clauses (SCC) |
| Google LLC (Analytics) | USA | Web analytics (consent only) | Consent + SCC |
| Meta Platforms Inc. | USA | Marketing analytics (consent only) | Consent + SCC |
| Microsoft Corp. (Clarity) | USA | UX analytics (consent only) | Consent + SCC |
4.2. Disclosure Required by Law
We may disclose personal data to government authorities, courts, or regulators if required by applicable law or court order. To the extent reasonable, we will notify you of such a request unless prohibited by law.
4.3. What We Do Not Do
We do not sell personal data to third parties. We do not disclose data to advertising networks or data brokers. We do not use data for profiling for purposes unrelated to providing the Service.
5. International Data Transfers
The principal subprocessor outside the EEA is Anthropic, PBC (USA). The United States is not on the European Commission's list of countries with adequate data protection. Data transfers to Anthropic are based on contract performance (Art. 6(1)(b) GDPR) and your explicit consent to the international transfer (Art. 49(1)(a) GDPR), obtained prior to processing.
We use the Anthropic API in zero data retention mode. As the Service develops, we plan to implement additional safeguards including Standard Contractual Clauses (SCC) and Transfer Impact Assessment (TIA).
6. Data Retention
| Data Category | Retention Period |
|---|---|
| Questionnaire data (project, contacts) | 30 days from AI audit generation |
| Business communications | 12 months from last contact or until consent withdrawal |
| Consent logs and versioning | 3 years (evidentiary retention) |
| Anthropic API request logs | 90 days |
| Technical logs (IP, sessions) | 12 months |
| Anonymised aggregated data | Indefinitely |
| Data transferred to Anthropic | Not retained (zero data retention) |
Upon expiry of these periods, data is deleted or irreversibly anonymised. You may request earlier deletion of your data at any time.
7. Cookies
The site uses cookies and similar technologies. Details are in our Cookie Policy. We use the following categories:
- necessary — basic functionality; no consent required;
- analytics — usage analysis; consent required;
- functional — remember preferences; consent required.
8. Your Rights as a Data Subject
Depending on applicable law (in particular, GDPR for EEA users), you have the right to:
| Right | Description |
|---|---|
| Access (Art. 15) | Obtain a copy of your personal data being processed |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete data |
| Erasure (Art. 17) | Request deletion of data ("right to be forgotten") |
| Restriction (Art. 18) | Request restriction of processing |
| Portability (Art. 20) | Receive data in machine-readable format |
| Object (Art. 21) | Object to processing based on legitimate interest |
| Withdraw consent | Withdraw consent at any time |
| Lodge a complaint | File a complaint with your local supervisory authority |
To exercise any of these rights, contact privacy@swcpitch.com. We will respond within 30 days. For unsubscribing from business communications: unsubscribe@swcpitch.com.
9. AI Processing
In accordance with Art. 22 GDPR, we hereby notify you that the Service does not make automated decisions that produce legal effects concerning you or similarly significantly affect your rights and interests. The AI audit is generated fully automatically without human involvement using the Claude language model (Anthropic, PBC) and:
- is exclusively informational and advisory in nature;
- creates no legal obligations and is not an investment recommendation;
- may contain factual inaccuracies ("hallucinations");
- does not replace professional legal, financial, or business advice;
- does not replace decisions by licensed professionals.
Learn more in the AI Transparency Notice.
10. Data Security
SWC applies the following technical and organisational measures:
- encryption of data in transit (TLS);
- access restriction on a least-privilege basis;
- regular access audits and operation logging;
- use of secure API for interactions with Anthropic.
In the event of a security incident affecting personal data, SWC will notify affected users and (where required) the supervisory authority within the timeframes set by applicable law (for GDPR — within 72 hours of discovery).
11. Children's Data
The Service is not intended for persons under 18 years of age. We do not knowingly collect personal data of minors. If you believe we have data from someone under 18, contact privacy@swcpitch.com — we will delete it.
12. Amendments
We may amend this Policy. Material changes affecting user rights will be notified by email at least 14 days before entering into force. The current version is at swcpitch.com/privacy.
13. Supervisory Authority
EEA residents may lodge complaints with their local data protection supervisory authority. The list of EU supervisory authorities is at edpb.europa.eu.
14. Contact Information
KEYSTRA Ltd. (trading name: Sky World Community)
Suite 9, Ansuya Estate, Revolution Ave, Victoria, Seychelles | Company No. C984038
- Privacy and GDPR inquiries: privacy@swcpitch.com
- Unsubscribe requests: unsubscribe@swcpitch.com
- Legal matters: legal@swcpitch.com
© 2026 KEYSTRA Ltd. / Sky World Community. All rights reserved. Privacy Policy v1.0 dated 19 May 2026.