Your data
Skolbot stores and processes applicant conversations in the European Union. An EU residency mode blocks any routing of answer-generation requests outside the EU.
Data is never used to train models. A data processing agreement (DPA) describes each agent, its purposes and its sub-processors.
European Union
The same commitments for every school, in the data processing agreement.
This page covers the Skolbot service: applicants’ conversations with the agents a school installs. The school is the controller. KYX AI is a processor and acts on its instructions, under the DPA.
For each agent: the data, the purpose, the sub-processors and the retention period. Annex 1 of the DPA gives the details.
The school is the controller: it defines the purposes and the legal basis, and informs applicants. KYX AI, which publishes Skolbot, is a processor under Article 28 of the GDPR and processes data only on the school’s instructions. In Australia, the school also stays responsible for compliance with the Privacy Act 1988 and the Australian Privacy Principles where they apply to it.
Storage and main processing take place in the EU.
The measures are described in the DPA annex.
The agents make no decisions within the meaning of Article 22 of the GDPR. Lead scoring ranks each lead as cold, warm or hot, on criteria the school chooses, for example the intended start date, English level or funding. It only helps your team prioritise follow-ups. An adviser always decides what happens next, and the score is not an admission recommendation.
Applicants know they are talking to an AI, in line with the transparency obligation of the AI Act. Applicants may be minors: the agents do not ask for age unless the school instructs it in writing.
Any data breach is notified to the school no later than 48 hours after discovery. Conversations are deleted 6 months after the last message, as set out in the DPA.
On WhatsApp, the applicant writes first, or has agreed in the school’s CRM to be contacted before any follow-up. One message is enough to stop being contacted.
Some applicants are minors. The agents collect only the fields the school needs to handle the request, and do not ask for age. Lead scoring follows the same rules as for an adult: it helps the team prioritise callbacks, and an adviser decides what happens next.
Answers are sourced from the school's knowledge base, and each one cites its source. The school reviews the answers during onboarding. When a question goes beyond that content, or the applicant asks for a person, an adviser takes over.
No. Neither Skolbot nor its sub-processors use your data to train models.
In the European Union, on Google Cloud. Skolbot is LLM-agnostic: we use the market’s best-performing models for response time and efficiency, called from endpoints in the EU.
Google Cloud (hosting and Vertex AI, EU), Reducto (reading brochures, EU endpoint), Sentry (error tracking, EU region) and Vercel (interface hosting). The full list is in the DPA.
The school operates its WhatsApp Business account under its own contract with Meta. Before any WhatsApp Activate follow-up, the school must hold the person’s consent.
Six months after the last message. The purge is a commitment in the DPA signed with each school.
The agents collect the minimum the school needs to handle the request, and do not ask for age unless the school instructs it in writing. Lead scoring only helps prioritise callbacks. No decision is automated.
It assesses some of the applicant’s criteria, so the school should have its data protection officer (DPO) assess it. The criteria, the data used and the adviser’s role are defined with the school during setup, so the school can describe them in its record of processing.
The school is the controller and approves the content the agents answer from. Each answer is sourced in that content, the school reviews answers during onboarding, and a person can take over the conversation at any time.
30 minutes on your programs, your channels and your CRM.
Updated on
