Sailwork · Română

Sailwork privacy policy

Prepared 10 October 2026. Effective date: 15 October 2026.

Who provides Sailwork

Sailwork is provided by Escattle SRL, CUI 54510823, Str. Vidin Nr. 76, Ap. 3, Sector 2, București, Romania. Contact us at sever@escattle.io about this policy or information that Escattle processes.

Sailwork is software installed on a customer's own server. The customer decides which accounts to connect, which records to use, who can use the installation and which AI provider to authorize. The customer is responsible for its business records and for responding to the people whose information those records contain. Escattle is responsible for its own website, enquiries, customer administration and support records. Where Escattle provides managed support that involves personal data on a customer's behalf, the parties must agree the applicable processing terms.

Information and purposes

A connected installation may process account identifiers, selected mail, files and calendar events, social-account and Page identifiers, content prepared for publication, publication results, or accommodation records, according to the connections the customer enables. Access credentials and tokens are held in private files on that customer's server, not in a central Escattle customer-token database. A connection is not permission to publish, send, pay or change an outside record. The supported action flow shows the destination and content for the owner's approval.

Customer-server storage does not mean information never leaves that server. Requests to an enabled service go to that service. Content included in a request to the customer's chosen AI service goes to that provider under that account's terms and settings. A hosting provider operates the underlying server. Users should not include unnecessary personal or confidential information in requests. No credential belongs in an AI prompt or a support message.

The owner-held arrangement does not give Escattle routine administrative access. Under a managed arrangement, authorized support staff may access the customer's server to perform agreed work; local storage is not a claim that such access is impossible. The scope of access and any support copies must be agreed with the customer. We do not sell connected-service data or use it for advertising profiles.

Escattle may receive business contact details, correspondence, support material deliberately supplied to us, invoices and contract information. We use these to answer enquiries, provide agreed services, maintain business records and deal with security or legal requests. Do not send us account passwords, tokens or full customer databases for support.

Legal bases for Escattle's own processing

For information for which Escattle acts as controller, the applicable basis depends on the purpose:

• Enquiries from a person seeking a service for themselves, and performance of their contract: steps taken at that person's request before a contract and performance of the contract.
• Contact with representatives of business customers, ordinary customer administration and support: our legitimate interest in answering business enquiries and providing the agreed service, balanced against the person's rights. Where the individual is directly a party to the service contract, contract performance may apply instead.
• Invoicing, accounting and responses to binding legal duties: compliance with the applicable legal obligation.
• Security, prevention of misuse and establishing or defending legal claims: our legitimate interests in protecting the service and our rights, with necessity and proportionality assessed.
• Optional processing that specifically asks for consent: that consent, which can be withdrawn without making earlier lawful processing unlawful. Declining optional consent does not authorize us to obtain the same information by another route.

The customer's own use of employee, guest, client or correspondent data requires that customer's own appropriate legal basis. OAuth authorization is permission to access a platform account; it is not automatically consent from every person mentioned in that account. Where Escattle acts only on a customer's documented processing instructions, the customer determines the applicable purposes and bases, and our processing agreement governs the assistance.

Connected platforms

Facebook and Instagram connections use only the permissions needed for the selected publishing feature. A publishing connection is not access to a person's private messages or an advertising account. LinkedIn, Google, Microsoft, X and accommodation connections, where available and authorized, are limited by the scopes and resources shown during setup. A platform feature described on this website is not available merely because its provider offers an API: availability, the required account and any review are stated on the integration page.

For Google API data, Sailwork's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to train a generalized AI or machine-learning model. Any AI-assisted processing of Google data must be limited to the user's requested feature and a provider arrangement that permits this use without prohibited training. An installation without that arrangement must not send Google API data to that provider. Human access is limited to the cases permitted by Google's policy, such as the user's affirmative agreement for specific support, security purposes, legal requirements or permitted aggregated internal operations.

Retention, disconnection and deletion

The customer controls retention of business records, drafts, local history and backups on its server. Removing a connection locally stops its configured use but is not, by itself, revocation at the platform or erasure of records already retained. Revoke access at the platform as well. The data-deletion page explains these separate steps.

Escattle retains enquiry and support information only for the service purpose and any applicable legal obligation. The operational retention schedule, including support copies and web logs, is kept no longer than needed for those purposes; invoices and accounting records are kept for the periods required by Romanian law. Contact us for the specific period that applies to your information. We do not promise that a deletion command instantly removes independent backups or a post already published on an external platform.

Providers, location and safeguards

Providers depend on the customer's server, chosen model and enabled connections. Before processing connected-account information through an AI provider, the customer must be told which provider receives it and the relevant terms. Escattle's own service-provider list, processing locations and any applicable international-transfer safeguards are our server hosting in the European Union, Google (email and documents), Anthropic (AI services), GitHub (software code) and Google Workspace (e-mail delivery of messages sent through the contact form on this website). Transfers to providers outside the EU rely on the safeguards those providers offer, such as the EU–US Data Privacy Framework or standard contractual clauses. Credentials are not public application configuration and must not be shared between customers.

Contact form and WhatsApp button

The contact form on this website sends what you type (name, e-mail address or phone number, company, message) and your IP address, used only to limit abuse, to sever@escattle.io by e-mail through Google Workspace. It is used only to answer you. The form loads nothing from third parties. The WhatsApp button is an ordinary link: WhatsApp (Meta) is involved only if you click it.

Your choices and rights

For information held in a customer's installation, contact that customer first; Escattle can explain the software's available controls and assist within its authority. For information Escattle itself holds, contact sever@escattle.io. Depending on the applicable law, you may request access, correction, deletion, restriction, portability or object to processing, and withdraw consent where consent is the basis. We may ask for proportionate proof of identity without requesting account passwords. You may complain to the competent supervisory authority, including Romania's ANSPDCP.

We update this policy when the actual service or data practices change. The date above identifies the published version.