Data Processing Agreement

1. Purpose & Scope

This Data Processing Agreement ("DPA") forms part of the agreement between you (the "Controller") and Skyram Technologies Pvt. Ltd., operator of SKYA.one ("Processor", "we", "us"), for the use of the SKYA.one platform.

Most of what the platform holds is not personal data. SKYA measures how a business appears in AI answers and in search. The material you put in is business information: domains, brand names, keywords, tracked prompts, the answers AI platforms gave, rankings, competitors, backlinks, shelf readings and content drafts. None of that identifies a person, and this agreement does not apply to it.

This agreement applies to the narrower set of cases, listed in §3, where the platform does handle personal data on your behalf. Those cases arise when you invite colleagues, when you connect an outside account or your own website to the platform, and when you buy an add-on that reads what other people wrote about you. If you use SKYA without any of those, there is nothing for us to process on your behalf.

2. Roles of the Parties

You are the controller and we are the processor for the personal data listed in §3. We process it only on your documented instructions, which are given through your use of the platform's features and settings.

We are the controller, not your processor, for our own relationship with you: the account holder's name and email address, workspace and subscription records, billing and tax records held by our payment provider, support correspondence, and product usage. That processing is described in our Privacy Policy and is not governed by this agreement.

3. Subject Matter, Duration & Nature of Processing

Personal data we process on your behalf, and only where the corresponding feature is in use:

• Colleagues you invite. The name, email address and role of each person you add to your workspace.
• Accounts and websites you connect. When you connect Search Console, Analytics, an advertising account, a social account or your own site through a content management system, we hold the access credentials for that connection and the identity of the account it belongs to, together with the figures and the page content that account returns. We use the connection only for the actions you ask for, which are reading your own figures and, where you enable it, publishing changes to your own site.
• The Google Reviews add-on, if you buy it. Reviewer display names, profile image links and review text exactly as Google publishes them, and your replies. For review requests you send: the recipient's first name, a masked form of their email address and a one-way hash of it, the rating they chose, and any private feedback they left. We do not keep the recipient's email address in readable form.
• Anything personal you choose to type in. Names or contact details you enter into a project, a prompt, a report or a content draft.

• Subject matter: provision of the SKYA.one AI visibility, SEO, reputation and reporting services.
• Duration: for the term of your subscription, plus up to 30 days after account deletion for removal of personal data.
• Nature: collection, storage, retrieval, analysis, display and deletion, strictly to deliver the service. We do not sell personal data, and we do not use it to train models.
• Data subjects: your workspace members, the owners of accounts you connect, people who review your business or receive a review request from you, and any individual whose details you enter yourself.
• Categories of data: identifiers (name, email, review author name and profile image link), review and feedback text, account and usage metadata, and integration credentials. We never store full payment card numbers.

4. Processor Obligations

We commit to:

• Process personal data only on your documented instructions, unless required by law.
• Ensure that persons authorised to process the data are bound by confidentiality.
• Apply the technical and organisational measures described in §6.
• Assist you, taking into account the nature of processing, in meeting your obligations for data subject requests, impact assessments and consultations.
• At your choice, delete or return all personal data at the end of the service, subject to legal retention duties.
• Make available the information reasonably necessary to demonstrate compliance with this DPA and allow for audits as described in §9.

5. Sub-Processors

You authorise us to engage the sub-processors listed in our Privacy Policy (§5), which include cloud hosting, AI model providers, payment processing (Paddle.com Market Ltd as Merchant of Record), email delivery and ranking data providers. Each sub-processor is bound by data protection obligations no less protective than this DPA. We remain responsible for their performance. We will notify you of any intended new sub-processor and give you a reasonable opportunity to object.

6. Security Measures

• Encryption in transit (TLS) and at rest across the platform and its backups.
• Row Level Security on all user tables, isolating one customer's data from another's.
• Least-privilege access to production systems, restricted to authorised engineers.
• Automated security scanning, rate limiting on sensitive endpoints, and audit logging of administrative actions.
• Encrypted, access-controlled credential storage for third-party integration tokens.

7. Personal Data Breach Notification

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, provide the information we reasonably have about the nature and impact of the breach, and describe the mitigation steps taken, so that you can meet any notification duties you owe.

8. Data Subject Rights & Assistance

The platform includes self-service export of your account data and full account deletion. For any access, correction, portability, erasure or objection request you receive that you cannot fulfil yourself, email support@skya.one and we will assist within a reasonable timeframe, in any case within 30 days.

9. Audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including responses to written security questionnaires once per year. Where an on-site audit is strictly required by law, it will be conducted during business hours, with reasonable prior notice, at most once per year, and subject to confidentiality and security rules.

10. International Transfers

We are based in India and our sub-processors operate globally. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, for UK data, the UK Addendum.

11. Liability & Termination

Each party's liability under this DPA is subject to the limitations in the Terms of Service. This DPA terminates when the services end, at which point §4's deletion and return obligations apply.

12. Acceptance

By creating an account or continuing to use SKYA.one after this DPA's publication, you accept this DPA on behalf of your organisation and confirm you are authorised to do so. If you require a countersigned copy, email support@skya.one and we will provide one.