SKYA.one ("SKYA", "we", "us"), operated by Skyram Technologies Pvt. Ltd., respects your privacy. This policy explains what personal data we collect, how we use it, who we share it with, and the rights you have over it. By using skya.one you agree to this policy.
2. Data We Collect
Account data: name, email, password hash, workspace and team membership.
Billing data: plan, invoices, billing address, last 4 of card and payment status (full card details are handled by our PCI-compliant payment processor, we never store card numbers).
Project data: domains, brand names, competitors, keywords, and reports you create.
Integration data: tokens you grant for Google Search Console, GA4 and similar connectors, used solely to fetch metrics for your reports, and the access token and site data of a website platform you connect, such as Webflow (see §7).
Cookies: session cookies for authentication and a small set of analytics cookies (see §8).
3. How We Use Data
Provide, maintain and secure the platform.
Run AI visibility analyses, generate reports, and deliver email notifications you opted into.
Process payments, manage subscriptions and prevent fraud.
Improve product quality, debug issues and measure feature usage in aggregate.
Send transactional emails (receipts, report-ready, security alerts) and, only with consent, product updates.
4. Legal Basis
We process data under one or more of these bases: performance of a contract with you, our legitimate interests in operating the service securely, your consent (for optional communications and non-essential cookies), and compliance with legal obligations.
5. Sharing & Sub-Processors
We do not sell personal data. We share limited data with vetted sub-processors strictly to operate the service:
Cloud hosting and database (managed Supabase & AWS infrastructure).
AI model providers (OpenAI, Anthropic, Google) for the queries you trigger. Inputs may include your domain, brand and competitor names, but never your password or payment details.
Payment processor and Merchant of Record: Paddle.com Market Ltd ("Paddle") handles checkout, billing, tax compliance, invoicing, refunds, and subscription management for all subscription and credit pack purchases. See Paddle's Privacy Notice. Legacy customers may have purchased via Razorpay; those records remain processed by Razorpay.
Email delivery (transactional email provider) for receipts and notifications.
Ranking data providers (SERP) for the queries you trigger.
Product analytics and session replay (PostHog, Microsoft Clarity), website analytics (Google Analytics) and advertising measurement (Meta). These load only where you have allowed the matching optional cookie category, and never before you choose. You can change or withdraw that choice at any time from the Cookie Policy page.
We may also disclose data to comply with law, enforce our terms, or protect the rights and safety of our users.
6. Data Retention
Account, project and report data is retained for the life of your account. After account deletion, personal data is removed within 30 days, except where retention is required for legal, tax, or fraud-prevention purposes (typically up to 7 years for invoices).
7. The SKYA app for Webflow
This section applies when you connect a Webflow site through the SKYA app for Webflow.
How the connection is made: you approve SKYA on Webflow's own permission screen and choose which sites SKYA may use. SKYA identifies those sites through Webflow's API. It never asks you for a Webflow password, API key or token, and never identifies a connected site from an address you type.
Webflow OAuth credentials: Webflow issues SKYA an access token for the sites you chose. SKYA encrypts it, keeps it where only SKYA's servers can read it, and never sends it to your browser. While you pick a site after approving, the token waits the same way. If you do not pick one, SKYA stops using it after 30 minutes and deletes it within 10 minutes after that.
Site and CMS data: SKYA stores the site id, the site name, the addresses the site answers on and the permissions you granted. It reads your page list to find the page a fix you approved belongs on, and your CMS collection names and fields to place a blog draft. It does not store the content of your pages or CMS items.
Product data: for a Webflow store, when a workspace owner or admin imports products into GPT Ads, SKYA stores each product's name, description, option and variant names, SKU codes and Webflow ids. It never reads orders, customers or payment details, and does not import prices.
What is shared with AI model providers: only when a workspace owner or admin asks SKYA to draft a longer product description, that product's name, current description, option names and variant names are sent to an AI model provider to write the draft. Nothing else SKYA reads from Webflow is sent to an AI model provider, and the access token never is.
What SKYA writes to your site: only what you approve: page titles, meta descriptions and Open Graph fields, draft blog items, and a product description saved as a staged change. SKYA never publishes your site and adds no code, scripts or files to it.
When you disconnect: disconnecting Webflow in SKYA deletes the access token, the products SKYA imported from that site, and product description drafts that were never saved to Webflow, including saves Webflow refused. SKYA keeps the record of each description it did save to your store, and of any save Webflow never answered, which may have landed (the approved text, the text it replaced, who approved it and when), so your team can see what changed; email support@skya.one to have it deleted. Uninstalling SKYA in Webflow ends SKYA's access at once; disconnect in SKYA as well so the imported data is deleted. Account deletion removes all of it as described in §6. Changes already saved in Webflow stay there as ordinary edits you control.
8. Cookies
We use strictly-necessary cookies for sign-in and security. We use a small number of analytics cookies to understand aggregate usage. You can clear or block cookies in your browser; doing so may break sign-in.
Optional cookies are set only after you consent, and you can change or withdraw that consent at any time. Every category, retention period and provider is listed in our Cookie Policy.
9. Security
Data is encrypted in transit (TLS) and at rest. Access to production data is restricted to authorised engineers using least-privilege controls. We run automated security scans and respond to incidents promptly. No system is perfectly secure, please use a strong, unique password.
10. Your Rights
Subject to applicable law (including India's DPDP Act and GDPR), you may request access, correction, export, or deletion of your personal data, withdraw consent, and object to certain processing. Email support@skya.one and we will respond within 30 days.
11. International Transfers
We are based in India and our sub-processors operate globally. Where data is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses.
If we process personal data on your behalf as part of your use of the platform, our Data Processing Agreement applies and sets out the GDPR-compliant terms of that processing, including sub-processors, security measures, breach notification and audit rights.
12. Children
SKYA.one is not directed to children under 16 and we do not knowingly collect their data.
13. Changes
We may update this policy as the product evolves. Material changes will be announced by email or in-app notice at least 14 days before they take effect.
14. Contact
Skyram Technologies Pvt. Ltd. · Kolkata, India · support@skya.one
Legal & contact
Business
Skyram Technologies Pvt. Ltd.
India.
Merchant of Record
Payments are processed by Paddle, our Merchant of Record. Paddle handles billing, taxes and refunds on our behalf.