Privacy Statement

Effective: 2026-04-27 · Last reviewed: 2026-04-27 · Operator: Dan Volsky / SkyMind

1. Summary

SkyMind operates on a Zero Personal Data Architecture (ZPDA). We do not collect, store, or process personal data about visitors to our public website or end-users of the analyzed regions. All analytical content is derived from aggregated, post-GDPR open data published by official statistical agencies.

This page explains the limited categories of personal data we do handle, why, on what legal basis, and your rights under the GDPR.

2. Who is responsible

Operator (data controller): Dan Volsky, operating as SkyMind (sole researcher).
Location: Haifa, Israel.
Contact: info@sky-mind.com.

For privacy questions, data subject requests, or complaints, please write to the address above with the subject line SkyMind privacy.

3. What we do not do

• We do not use cookies for tracking, advertising, or analytics.
• We do not run third-party analytics scripts (no Google Analytics, no Meta Pixel, no fingerprinting).
• We do not log IP addresses, user-agent strings, or referrer headers in our application database.
• We do not buy, sell, share, or rent personal data.
• We do not target advertising. We do not run ads.
• We do not profile individuals. The model operates exclusively on aggregated regional indicators.

4. The only personal data we collect

4.1 Demo request form

When you submit the form on the home page, we collect:

• Required: name, email.
• Optional: company, region of interest, area of interest, free-text message.

Purpose: to contact you about your demo request and answer your questions.
Legal basis: consent (Article 6(1)(a) GDPR) — by submitting the form you consent to being contacted.
Storage: Supabase (EU region), table demo_requests, encrypted at rest, access restricted to the operator.
Retention: kept for up to 24 months from submission, then deleted. Earlier deletion on request.
Sharing: not shared with third parties. Used only by the operator.

4.2 GALOR dashboard authentication

The internal dashboard at sky-mind.com/galor is password-protected. After successful login we set a single HttpOnly, Secure, SameSite=Lax session cookie named galor_auth. The cookie is a HMAC-signed session token only. It does not contain personal information and is not used for analytics. Maximum lifetime: 30 days.

4.3 Email correspondence

If you write to us by email, we will hold the message and your address for as long as needed to handle your request, then delete it.

5. Public open data sources used by the model

Our datasets are built exclusively from official, aggregated, post-GDPR public data:

Country	Sources
🇩🇪 Germany	Eurostat NUTS-3
🇮🇱 Israel	data.gov.il, CBS (Central Bureau of Statistics)
🇦🇪 UAE	Dubai Land Department open data, World Bank
🇸🇦 Saudi Arabia	GASTAT, KAPSARC, Royal Commission for Riyadh City open data
🇶🇦 Qatar	data.gov.qa, Planning & Statistics Authority
🇫🇷 France	Eurostat NUTS-3, INSEE
🌍 Cross-country	World Bank Open Data, Bank for International Settlements

None of these sources contain microdata or individual-level information. They are statistical aggregates produced and published by the respective agencies in compliance with their own GDPR / privacy obligations.

6. Hosting and processors

Service	Role	Region	Safeguard
Vercel, Inc.	Static hosting, serverless functions, edge network	EU (fra1) + global edge	Standard Contractual Clauses (SCCs)
Supabase, Inc.	Database, authentication backend, file storage	EU region	Standard Contractual Clauses (SCCs)
Anthropic, PBC	Claude API for the SkyMind AI assistant	US	SCCs; only the user's question text is sent, no personal identifiers
HeyGen, Inc.	Video rendering for marketing assets	US	SCCs; no end-user data sent

7. Your rights under the GDPR

If we hold any personal data about you (typically only because you submitted the demo form or wrote to us by email), you have the right to:

• Access — request a copy of the personal data we hold about you (Article 15).
• Rectification — ask us to correct inaccurate data (Article 16).
• Erasure — ask us to delete your data ("right to be forgotten", Article 17).
• Restriction — ask us to stop processing your data while a complaint is resolved (Article 18).
• Data portability — receive your data in a machine-readable format (Article 20).
• Objection — object to processing based on legitimate interests (Article 21).
• Withdraw consent — at any time, with no impact on past lawful processing (Article 7(3)).

To exercise any of these rights, email info@sky-mind.com. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. For visitors in the EU, the relevant authority is the Data Protection Authority of your country of residence; in Germany this is your state-level Landesdatenschutzbeauftragter.

8. Security

Technical and organisational measures we apply (per Article 32 GDPR):

• TLS 1.2+ for all data in transit. HSTS enabled on all production domains.
• Encryption at rest for the Supabase database.
• Role-based access. The application reads public datasets through anonymous keys; write access requires a service role key held only by the operator.
• Row-Level Security (RLS) enforced on user-facing Supabase tables.
• Password authentication for the GALOR dashboard with HMAC-signed session tokens (no plaintext password stored anywhere).
• No third-party tracking pixels or fingerprinting libraries are loaded.

9. Data Protection Impact Assessment (DPIA)

A formal DPIA under Article 35 GDPR is not required because the platform does not perform automated decision-making about individuals, does not process special categories of personal data (Article 9), and operates on a Zero Personal Data Architecture. We have nonetheless documented our processing activities in a Record of Processing Activities (ROPA) available on request.

10. Children

SkyMind is not directed at children. We do not knowingly collect personal data from anyone under 16.

11. Changes to this statement

We will publish any material changes to this statement on this page with a new "Last reviewed" date. The current text always reflects our practice.