Who we are
This site is operated by Sekit Technologies, Sociedad Limitada ("Sekit", "we", "us"), a company registered in Spain.
Registered office: C/ Cronista Carreres 10, Bajo, 46003 Valencia, España.
General contact: hello@sekit.ai. Privacy questions: privacy@sekit.ai.
What data we collect
When you visit the site, we receive technical data your browser sends automatically: IP address, browser type, device, operating system, and the pages you visit. On our public pages we only record analytics about how you use the site if you accept analytics cookies.
Inside the Sekit console, once you are signed in, we record product analytics without a cookie banner. These are the events we need to understand whether the product works: pages opened, features used, whether a workflow completed. This analytics does not store anything on your device, and the events are linked to your account identifier and your firm identifier so we can tell one customer's usage from another's. We never attach your name, your email address, or your firm's name to them. The legal basis is explained in the next section.
When you take the free EU AI Act check at /ai-act-check, we collect your name, your company name, and the email you give us (we verify it with a code) so we can send you the report, plus your answers to the questionnaire (country, industry, company size, which AI tools you use and what for, and your role).
When you use the Sekit Platform, we store your account details (name, email and consultancy) and the content your consultancy and its clients upload to the platform: assessments, risks, evidence, documents and portal messages. We process that content on your consultancy's behalf; the consultancy is the controller towards its clients.
When you book a call or submit a form, we collect your name, email, company name, and anything you write in the message field.
Discovery call recordings
When you book a free initial call with Sekit ("discovery call"), that call may be recorded with an AI note-taking assistant. We tell you in writing in the calendar invite and verbally at the start of the call, before activating the recording.
Legal basis: explicit consent (GDPR Article 6(1)(a)). You can decline at the start of the call and the recording will not be activated. Your refusal does not affect our willingness to have the conversation.
We use the recording only to take structured notes, follow up on what was discussed, and prepare a tailored proposal if you decide to proceed. We do not use it to train AI models, we do not share it with third parties for commercial purposes, and we do not publish it.
The recording and transcript stay locally on the Sekit consultant's device. The AI note-taking assistant processes the audio for transcription and summarisation; the current provider is listed under "Who we share data with" below.
Retention: up to 12 months from the date of the call. If you ask for earlier deletion, we process the request within 30 days at most.
Your GDPR rights (access, rectification, erasure, withdrawal of consent, lodging a complaint with the AEPD) apply to this data too. Write to privacy@sekit.ai.
Why we collect it (legal bases under GDPR Article 6)
Public site usage and analytics: improving the site. Legal basis: your consent (you can decline analytics in our cookie banner).
Product analytics inside the signed-in console: understanding how the product is used so we can improve it and support you. Legal basis: legitimate interest, and performance of our contract with your firm. We rely on this rather than consent because the analytics stores nothing on your device, so there is no cookie for you to accept or refuse. You can object to this processing at any time by writing to privacy@sekit.ai.
EU AI Act check answers and email: delivering the report you asked for. Legal basis: performance of a contract.
Booking forms and contact messages: responding to your enquiry and providing the service you asked about. Legal basis: legitimate interest, or performance of a contract once we agree on scope.
Sekit Platform account and content: providing the service your consultancy subscribed to. Legal basis: performance of our contract with your consultancy. For the consultancy's client data, we act as a processor on its instructions (GDPR, Article 28).
Service emails (like your report being ready): delivering the service. Legal basis: performance of a contract.
Who we share data with
We use the following sub-processors. Each one complies with the GDPR or, for transfers outside the EU, is covered by the EU-US Data Privacy Framework or Standard Contractual Clauses.
Vercel (United States, with processing in the European Union): hosts the application and the website, runs background jobs, and runs the service that converts uploaded documents to text.
Vercel AI Gateway (United States): routes the Sekit Platform's AI agent calls to the language-model providers.
xAI (United States) and OpenAI (United States): provide the language models used by the platform's AI agents and assistant. They receive the content each task needs, for example the evidence being assessed or the question you ask.
Anthropic (United States): a language-model provider we use in our internal operations and that may serve Sekit Platform features.
Langfuse (European Union): records technical traces of AI model calls so we can monitor how they work; this may include the content of the request and the response, which we keep to the minimum necessary.
Neon (European Union): hosts the Sekit Platform database.
Amazon Web Services (European Union): stores files uploaded to the Sekit Platform (Amazon S3).
Resend (United States): sends service emails such as sign-in codes, reports and notifications.
Stripe (Ireland / United States): processes subscription payments. Sekit does not store your card details.
HubSpot (European Union): our CRM. Receives the email, name, company, language and industry of people who take the EU AI Act check, and the email, firm name and language of people who write to us from /notify-me, so we can follow up.
Cal.com (Germany / United States): handles calendar bookings.
Granola (United States): AI note-taking assistant that transcribes and summarises discovery calls when you give consent. The recording and transcript stay locally on the consultant's device; Granola processes the audio to generate the summary.
PostHog (European Union): product analytics. Receives the usage events described above, plus your account and firm identifiers once you are signed in. Data is processed on PostHog's EU infrastructure and does not leave the EU.
Google Ireland (Google Tag Manager and Google Analytics): measures traffic on our public pages only. We do not load it in the console, and if you reach the console from a public page in the same visit, we instruct it to stop using storage and stop measuring. Nothing is sent until you accept analytics cookies.
CookieYes (India / European Union): shows the cookie banner on our public pages and records your consent choice.
We do not sell your data. We do not use your data to train AI models.
International transfers
Some of our sub-processors are based in the United States. Transfers are covered by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses and the supplementary measures required under the GDPR. We continue to monitor the legal framework and will update sub-processors if a transfer becomes non-compliant.
How long we keep your data
EU AI Act check data: 24 months after your last activity, then deleted.
Sekit Platform content: while your consultancy's subscription is active and for up to 90 days after it ends, so it can export it or reactivate the account; then we delete it. Backups are deleted when their rotation cycle ends.
Contact-form messages: 24 months.
Site analytics: 14 months.
Booking records and invoices: 5 years, as required by Spanish tax law.
You can ask us to delete any of this earlier; see your rights below.
Your rights under GDPR
You have the right to ask what data we hold about you (access), correct it if it is wrong (rectification), ask us to delete it (erasure), ask us to restrict how we use it (restriction), object to certain processing (objection), get a copy of your data in a portable format (portability), and withdraw your consent at any time (where consent is the legal basis we used).
You also have the right to lodge a complaint with the Spanish data-protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es.
To exercise any of these rights, write to privacy@sekit.ai. We respond within 30 days.
Cookies and tracking
See our Cookie Policy at /cookies for the full list of cookies we use, what each one does, and how to manage them.
Automated decision-making
The EU AI Act check computes its result with fixed rules from your answers; it is indicative and you can always talk to a human. In the Sekit Platform, AI agents draft work that the consultant reviews before using it, except automatic replies to clients' messages in the portal, which do not make decisions with legal effects. We do not make automated decisions that have legal or similarly significant effects on you without human review.
Changes to this policy
When we change this policy, we update the date at the top and, if the change is important, we email you about it.