Privacy Policy

Controller

The controller of your personal data is HOT SKULLS LABS, IT rešitve in poslovno svetovanje d.o.o. (short name HOT SKULLS LABS d.o.o.), Štihova ulica 13, 1000 Ljubljana, Slovenia, company registration no. (matična številka) 9435174000, tax number 87314185. For any question about your personal data, write to info@hotskulls.si. We have not appointed a data protection officer because the law does not require one; we handle every request through the same address.

What we process

Contact form: when you send us an inquiry, we store your name, e-mail address, company (if you give one) and message, together with the time you sent it, the page you sent it from and the language of the page. From your IP address we compute a salted hash, which we delete after 30 days; we do not store the IP address itself. While we handle your inquiry, we add a status and internal notes to the record. If you book a call, we record in our inquiry records the name, e-mail address, any note and the chosen time entered in the booking form on our site, together with your time zone and the language of the page. The legal basis is Article 6(1)(b) GDPR: we need the data to arrange the call you asked for. With the booking we also store which version of the booking information was shown to you and when. For rate limiting we keep a salted hash of your IP address with these requests and delete it after one day; we do not store the IP address itself. We e-mail you the invitation with a calendar file, reminders before the call and the link to move or cancel it. The call takes place in our online meeting room, which Versiyonbir Teknoloji ve Sanayi Ticaret Limited Şirketi (Türkiye) operates for us as our processor (see «Processors and transfers outside the EU»). During the call the meeting room produces a transcript of the conversation and notes: the notes of the call are kept with your inquiry record, and the meeting room keeps the transcript for 12 months; when your inquiry is anonymised or deleted, the transcript and the notes are deleted too. We keep the booking for the retention period for inquiries set out in «How long we keep your data» (12 months after our last contact with you). E-mail, WhatsApp and phone: if you write to us or call us directly, we process what you send us (on WhatsApp, your phone number, profile name and the content of your messages). We may enter such an inquiry by hand in the same record system. For e-mail, see also "E-mail correspondence" below. Server logs: on every visit our hosting provider technically processes your IP address, browser type, the requested URL and the time of the request in order to deliver and protect the site. We collect information about your visit (pages viewed, approximate location, device) only if you accept analytics cookies in the cookie notice (see "Analytics cookies" below). Providing your data is voluntary; without a name, an e-mail address and a message we cannot reply to your inquiry. Chat assistant (Versiyonbir): the chat window on our pages is the Versiyonbir embed chat, operated for us as our processor by Versiyonbir Teknoloji ve Sanayi Ticaret Limited Şirketi, Kızılırmak Mah. Dumlupınar Bulvarı YDA Center No:9A/158, Çankaya/Ankara, Türkiye; HOT SKULLS LABS d.o.o. is the controller of the chat data. On a page load the widget's script is loaded from our own website and contacts no other server. It sets no cookie; it stores the language you pick in your browser's local storage (vb-chat.lang) and, for the current tab, that you opened the window (vb-chat.opened). This is separate from the analytics cookies below. When you open the window, the widget requests a session token from the operator's service at chat.versiyonbir.com (the request carries the address of our site) and connects to the operator's servers for the conversation. Your messages (text, or your voice while the microphone is on) are sent to AI services to produce the reply, and the reply's text to the speech services that read it out: Anthropic, PBC for the language model, Deepgram, Inc. for speech to text, Microsoft Corporation's Edge read-aloud service for the spoken replies (Slovene included) and, where configured, ElevenLabs, Inc. for spoken replies. The assistant stores no transcript: the conversation lives only in the operator's working memory while it lasts, and the session is deleted 60 seconds after you leave; no voice recording is kept. A conversation is limited to 20 minutes, 40 of your messages, 10 minutes of voice and 1,000 characters per message.

Purposes and legal bases

We use the data from the form, e-mail and WhatsApp to reply to your inquiry and to prepare an offer. The legal basis is Article 6(1)(b) of the General Data Protection Regulation (GDPR) where these are steps taken at your request before entering into a contract, or Article 6(1)(f) GDPR (legitimate interest) where you write to us as a company's contact person. We use the IP hash to protect the form against abuse and spam, and the server logs to run and secure the site; the basis is Article 6(1)(f) GDPR. For analytics the basis is your consent (Article 6(1)(a) GDPR). If we enter into a contract, we keep contract and accounting records to meet our legal obligations (Article 6(1)(c) GDPR). We do not use your data for marketing e-mails, we do not sell it, and we make no automated decisions or profiling based on it. The chat assistant uses your messages to answer you and to take steps before entering into a contract at your request; the legal basis is Article 6(1)(b) GDPR. The technical usage records of the chat (without message content) are kept on the basis of our legitimate interest in operating and securing the assistant (Article 6(1)(f) GDPR).

How long we keep your data

We keep an inquiry for 12 months after our last contact with you (the last change to the record). If no contract follows, the record is anonymised automatically after that period: the name, e-mail address, phone number, company, message and internal notes are deleted. If we enter into a contract, the record is not anonymised automatically; we keep it with the contract and accounting records for as long as the law requires. We delete the IP hash after 30 days. We delete the IP hash kept for rate limiting the booking of calls after one day. We keep the transcript and the notes of a booked call for 12 months; they are deleted when the inquiry is anonymised or deleted. We keep e-mail correspondence as described under "E-mail correspondence", and WhatsApp messages only as long as we need them to handle the matter. Server logs are kept by our hosting provider for its own short retention period; we do not keep separate access logs. We keep contract and accounting records for 10 years, as the law requires. The chat assistant stores neither transcripts nor voice recordings: the conversation exists only in the operator's working memory while it lasts, and the session is deleted 60 seconds after you leave. The operator keeps technical usage records without message content (session id, language, durations, the number of messages and the model's usage; your IP address only when a rate limit is hit) for 12 months.

Processors and transfers outside the EU

We use these processors to run the site, the form, our e-mail, the chat assistant and call bookings: – Vercel Inc., for hosting the site and its server functions; the functions run in the EU region fra1 (Frankfurt, Germany). – Neon, Inc., for the Postgres database that stores inquiries and the e-mail correspondence described under "E-mail correspondence"; EU region, Frankfurt, Germany. – Resend, Inc., for sending our e-mail (replies and new messages from our CRM address at crm.hotskulls.si, and notification e-mails to team members, including the one about a new inquiry) and for receiving the e-mail you send to an address at crm.hotskulls.si; e-mail is processed in the EU region (Ireland). – GoDaddy.com, LLC, which hosts our info@hotskulls.si mailbox (US). – Versiyonbir Teknoloji ve Sanayi Ticaret Limited Şirketi (Çankaya/Ankara, Türkiye), which operates the chat assistant and the online meeting room of our booked calls for us; both run on servers of Hetzner Online GmbH in Helsinki, Finland (EU). The meeting room's media server (LiveKit) runs on the same server: it carries the call's audio and video and the caption and notes channels and records nothing; the transcript and the notes stay on that server (12 months). The room sends no e-mail. – Anthropic, PBC, whose language model writes the assistant's replies; in the meeting room it receives the transcript text (sentences with their context for the translation; the whole transcript with the call's brief for the notes and the draft follow-up) (US). – Deepgram, Inc., for speech to text while you speak to the assistant; in the meeting room it receives the live audio of each participant's microphone for the transcript (with the language code and key terms) (US). – Microsoft Corporation, whose Edge read-aloud service speaks the assistant's replies, Slovene included; in the meeting room it receives only the translated text, as the fallback voice of the interpreter (US). – ElevenLabs, Inc., for spoken replies where configured; in the meeting room it receives only the translated text for the interpreter's voice (US). Vercel, Neon, Resend and GoDaddy are headquartered in the United States, so data may be transferred to the US. Such transfers rely on the EU Standard Contractual Clauses (Article 46(2)(c) GDPR) or, where the provider is certified, on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). Versiyonbir is established in Türkiye and its subprocessors for the chat and the meeting room (Anthropic, Deepgram, Microsoft and ElevenLabs) in the United States, so data from the chat and from the meeting room of our booked calls may be transferred to those countries; this is a transfer of personal data to third countries, and it takes place under the applicable safeguards named in Versiyonbir's privacy policy (https://www.versiyonbir.com/en/privacy-notice). For Google Analytics see "Analytics cookies"; for WhatsApp see the section below. We disclose data to public authorities only where the law requires it.

E-mail correspondence

When you write to info@hotskulls.si, your e-mail arrives in our mailbox, which GoDaddy hosts for us; we read and answer it there and delete it at the latest 12 months after our last contact with you, as for an inquiry (see "How long we keep your data"). When you reply to a message we sent you from our CRM address (an address at crm.hotskulls.si), Resend receives the e-mail for us and we store it in our database: the sender's name and address, the recipients, the subject, the content and, for attachments, only their name, type and size; we do not store the files themselves. We store our replies in the same way. Team members read and answer that correspondence in the admin area; the notification e-mail about a new message that they receive at their own address contains only the sender and the subject. We use the correspondence to reply to your inquiry and to take steps at your request before entering into a contract; the legal basis is Article 6(1)(b) GDPR, and otherwise Article 6(1)(f) GDPR (our legitimate interest in answering the mail we receive). If the correspondence belongs to an inquiry in our records, we keep it with that inquiry. When the inquiry is anonymised or deleted, we delete the correspondence too, unless another inquiry in our records has the same e-mail address; in that case it stays with that inquiry (see "How long we keep your data"). Otherwise we delete a conversation 12 months after its last message. Messages in a conversation marked as spam are deleted 30 days after the last message, whether or not it is linked to an inquiry. If we mark a sender as spam, we keep only a pseudonymised (hashed) form of their e-mail address so that their later messages go straight to spam; we delete it 12 months after their last message. Resend, as our processor, keeps received e-mail and its attachments for up to 30 days; we store only the attachment details (name, type and size).

WhatsApp

The WhatsApp link on this site is a plain link and stores nothing on your device. When you click it, you leave our site and WhatsApp opens, where the privacy policy of WhatsApp Ireland Ltd applies. We see your phone number, profile name and the messages you send us. WhatsApp Ireland may transfer data to WhatsApp LLC and Meta Platforms, Inc. in the US under the EU-US Data Privacy Framework and Standard Contractual Clauses.

Your rights

You have the right to access your data and to have it rectified, erased, restricted or ported, and the right to object to processing based on legitimate interest (Article 6(1)(f) GDPR). You can withdraw your consent to analytics at any time via "Cookie settings" in the footer. Send any request, including a request to delete your inquiry, to info@hotskulls.si; we reply within one month at the latest. If you believe we process your data unlawfully, you can lodge a complaint with the supervisory authority: Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si.

Security

Inquiries and e-mail correspondence are visible only to team members who sign in to the admin area with a link sent to an approved e-mail address. Traffic between your browser and the site is encrypted (HTTPS). No system is completely secure; if a personal data breach occurs, we act as the GDPR requires.

Changes to this notice

We update this notice when the way we process data changes, for example when we switch providers. The version published on this page applies; if the language versions differ, the Slovene version prevails. Last updated: 30 October 2026.

Analytics cookies

Analytics runs only if you accept it in the cookie notice. We use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It measures the pages viewed, the approximate location derived from the IP address, and the device and browser type; it sets the cookies _ga and _ga_* for up to 2 years. Data may be transferred to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework. Until you accept, no Google script is loaded and none of these cookies are set. Your choice is stored in your browser (local storage) for 12 months; you can change or withdraw it at any time via "Cookie settings" in the footer. When you choose a language in the language switcher, the site also sets one necessary cookie, NEXT_LOCALE, which remembers that choice for one year and needs no consent.