Privacy Policy

Last updated: November 4, 2026

1. Introduction

Squad as a Service SL ("we", "us", or "our") operates sqaas.io (the "Site"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Site. We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR).

We are the data controller for the information described here. Our products, such as Hilo, have their own privacy policies, and work we do for a client is covered by our agreement with that client.

2. Information We Collect

2.1 Information You Provide

• Contact forms: your name, your email address, the topic you choose, your message, and any other details you decide to include, such as your company
• Other communications: messages you send directly to our email address

2.2 Automatically Collected Information

• Device information: IP address, browser type, and operating system
• Log data: server logs, including access times, requested pages, and errors
• Anti-spam signals: the information Google reCAPTCHA collects to tell people from bots when you use a form
• Usage data: pages visited and events on the pages that use our analytics (see section 4)

3. How We Use Your Information

We use the collected information for the following purposes, on the following legal bases:

• Answering your enquiry and discussing working together: taking steps at your request before a contract, and our legitimate interest in answering business enquiries
• Protecting the Site and our forms from spam and abuse: our legitimate interest in keeping the Site secure
• Understanding and improving the Site: our legitimate interest in knowing how it is used
• Complying with legal obligations: where a law requires us to keep or disclose information

4. Third-Party Services

We use the following third-party services to operate the Site:

• Google (email): form submissions are delivered to our inbox through Gmail, and our correspondence with you is kept there.
• Slack (internal notifications): form submissions, including your details and message, are posted to our team's workspace so we can answer quickly.
• Google reCAPTCHA (spam protection): runs when you use a contact form. Google's Privacy Policy and Terms apply.
• Google Fonts and jsDelivr (delivery of fonts and code): your browser requests files from these services, which receive your IP address when it does.
• Umami (analytics): we run this analytics tool on our own server, and it is loaded on some pages of the Site, such as Kit Digital and Kit Consulting.
• Hosting providers: the servers that run the Site and its contact service process your requests and keep the logs described in section 2.2.

5. Data Storage and Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (TLS)
• Access controls and authentication
• Rate limiting and spam protection on our forms
• Regular software updates

6. Data Retention

We keep your enquiry and our correspondence with you for as long as we need them to answer you and to manage any relationship that follows. After that, we delete them unless a legal obligation, or the need to establish or defend a legal claim, requires us to keep them for longer. Server logs are kept for a limited period for security and troubleshooting.

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to certain data processing activities
• Right to Withdraw Consent: Withdraw consent at any time, where we rely on it

To exercise these rights, contact us at contact@sqaas.io. We will respond within 30 days. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.

8. Cookies and Tracking

We do not set advertising cookies. Our home page sets no cookies of its own, and the following technologies may be used on the Site:

• reCAPTCHA: Google may set cookies and read browser information for spam protection. On the home page it loads only when you start using the contact form.
• Analytics: on pages that use Umami, a session identifier is kept in your browser's session storage and is removed when the session ends.

You can control cookies through your browser settings. Note that blocking reCAPTCHA may stop our forms from working; you can always write to us by email instead.

9. International Data Transfers

Some of the providers in section 4 may process data outside the European Economic Area. When data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

10. Children's Privacy

The Site is not intended for children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time and will publish the new version on this page. The "Last updated" date at the top indicates when the policy was last revised.

12. Contact Us

For questions about this Privacy Policy or to exercise your data protection rights, contact us: