Privacy Notice

Version 2026-07-17 · Effective July 17, 2026

This Privacy Notice explains how Skygn ("Skygn," "we," "us") collects, uses, discloses, and protects personal data in connection with our software-as-a-service enterprise resource planning platform (the "Service"). Skygn is a business tool: we process data to operate the Service for the organizations that use it. We do not build consumer marketing profiles, and we do not sell or share personal data for cross-context behavioral advertising.

1. Our roles: controller and processor

Our role depends on the data:

• Controller — for the account, authentication, billing, and usage/security data of the people who operate the Service (our direct users). We determine how that data is used.
• Processor— for the business records an organization enters into the Service (its inventory, orders, financials, CRM, and any personal data therein, "Customer Content"). We process Customer Content only on that organization's documented instructions, under our agreement with them. If you are an individual whose data an organization has entered, please direct requests to that organization (the controller); we will assist them.

2. What we collect

• Account data — name, work email, organization, role, and authentication metadata (including MFA enrolment status).
• Usage & security data — sign-in events, IP address, device/browser information, and audit logs, used to secure and operate the Service.
• Billing data — subscription and payment status. Card details are handled by our payment processor (Stripe) and are not stored by us.
• Customer Content — the business records your organization enters, which may contain personal data about its own customers, suppliers, and staff.
• Support & communications — messages you send us and related metadata.

3. How we use personal data

We use personal data to provide, secure, support, and improve the Service; to authenticate users and prevent abuse; to process billing; to communicate about your account and service-related matters; and to meet legal, accounting, tax, and security obligations. We do not use Customer Content for advertising, and we do not use it to train general-purpose AI models. AI features operate only on the data needed to answer a request within your organization.

4. Legal bases (GDPR)

Where the EU/UK GDPR applies and we act as controller, we rely on:

• Contract (Art. 6(1)(b)) — to provide the Service you or your organization signed up for.
• Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse, and improve our product, balanced against your rights.
• Legal obligation (Art. 6(1)(c)) — to meet accounting, tax, and security-record duties.
• Consent (Art. 6(1)(a)) — where we ask for it; you may withdraw it at any time.

For Customer Content we act as processor; the organization determines the legal basis.

5. Sharing & subprocessors

We share data only with subprocessors that help us run the Service, each under contractual data-protection obligations — for example cloud database & auth (Supabase), application hosting (Vercel), payments (Stripe), transactional email (Resend), rate-limiting (Upstash), error monitoring (Sentry), and the AI assistant (Anthropic); plus, only if an organization connects them, accounting sync (Intuit/QuickBooks), bank linking (Plaid), and address autocomplete (Google). We may disclose data where required by law or to protect rights and safety. We do not sell personal data.

6. Data location & international transfers

The Service is primarily hosted in the United States. Our subprocessors may process data in the United States or other regions. Where personal data is transferred across borders (for example from the EEA/UK), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Security

We protect data with encryption in transit (TLS) and at rest, application-side encryption of the most sensitive secrets, strict per-tenant isolation, role-based access controls, append-only tamper-evident audit logging, continuous security monitoring, and a documented incident-response process (including breach notification where required). No system is perfectly secure, but we work to protect your data and respond promptly to incidents.

8. Retention

We retain personal data for as long as needed to provide the Service and to meet legal and accounting obligations, then delete or anonymize it according to our data-retention schedule. Operational logs are retained for defined short windows; financial ledger and tamper-evident audit records are retained for their statutory lifetime.

9. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, export (portability), or restrict/object to certain processing of your personal data, and to withdraw consent or lodge a complaint with a supervisory authority. Where we act as processor, we route such requests to the relevant organization and assist them; where we act as controller, we honor them directly. We may verify your identity before acting.

10. U.S. state privacy rights (CCPA/CPRA and similar)

If you are a California resident (or in a U.S. state with a comparable law), you have the right to know/access, correct, and delete the personal information we hold as a controller; the right to opt out of the sale or sharing of personal information; and the right not to be discriminated against for exercising these rights. We do not sell or share personal information (as those terms are defined under the CCPA/CPRA), so there is nothing to opt out of, but you may still exercise your other rights below.

11. How to exercise your rights

Individual users may contact us at privacy@skygn.ai. If your data was entered by an organization using the Service, contact that organization; its administrators can fulfil access and deletion requests directly through the Service's data-request tools, and we support them.

12. Cookies

We use strictly necessary cookies to keep you signed in and to operate the Service securely. We do not use advertising or cross-site tracking cookies, so no consent banner is required.

13. Children

The Service is a business tool not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children.

14. Changes

We may update this notice; material changes will be posted here with a new version and effective date, and communicated where appropriate.

15. Contact

Questions or privacy requests? Contact us at privacy@skygn.ai or info@skygn.ai.