Privacy policy
Last updated: October 29, 2026
This policy explains which personal data Squadico processes, for what purpose, on which legal basis, for how long and with whom, and how you can exercise your rights under the General Data Protection Regulation (GDPR).
Data controller
The data controller for the personal data described here is Squadico.
Our two roles
Squadico is the controller of the data it needs to run your account: who you are, your organization, your subscription. For the content your organization entrusts to its agents (documents, conversations, files, the people your agents talk to), your organization is the controller and Squadico processes it on its behalf, only to run the service.
Data we process
- Account: name, email address, language, sign-in details.
- Organization: its name, its members and their roles, its settings.
- Content: agents, knowledge bases, conversations, attachments and generated files.
- Billing: plan, invoices and payment status. Card details are handled by Stripe and never reach Squadico.
- Audience measurement: pages viewed and interactions, only if you accept it.
- Technical logs: requests, errors and their traces, to keep the service running and secure.
Purposes and legal bases
- Providing the service you subscribed to: performance of the contract.
- Keeping the service secure and diagnosing incidents: our legitimate interest.
- Measuring audience to improve the product: your consent, which you can withdraw at any time.
- Invoicing and keeping invoices: our legal obligations.
AI providers
Squadico does not use an AI provider of its own. Your organization brings its own key, chooses the provider and contracts with it directly: what your agents send to a model goes to the provider you chose, under your contract with it.
Subprocessors
These companies process personal data on our behalf, under a contract that binds them to the GDPR.
| Subprocessor | Purpose | Location |
|---|---|---|
| Google Cloud | Hosting of the application and of stored files | European Union (Belgium) |
| Aiven | Database hosting | European Union (Netherlands) |
| Stripe | Online payment and invoicing | European Union (Ireland), United States |
| PostHog | Audience measurement, with your consent | European Union (Germany) |
| Mailgun | Sending sign-in and invitation emails | European Union |
Transfers outside the European Union
Squadico and its data are hosted in the European Union. When a subprocessor may access data from outside it, as Stripe can from the United States, the transfer is covered by the European Commission's standard contractual clauses or by the EU-US Data Privacy Framework.
How long we keep data
- Account and organization: for as long as the account exists, then erased when it is deleted. What is needed to prove the contractual relationship (identity of the customer, subscription, acceptance of the terms) may be archived for 5 years, the limitation period for commercial claims (French Commercial Code, art. L110-4).
- Conversation traces: as long as your plan provides, 365 days at most.
- Invoices: 10 years, as French commercial law requires.
- Your cookie choice: 6 months, after which we ask again.
Security
The measures we take to protect your data are described on our security page.
The cookies Squadico uses and how to change your choice are described in our cookie policy.
Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability and to withdraw your consent at any time. Write to contact@squadico.com to exercise them. If you believe your rights are not respected, you can lodge a complaint with the CNIL.