Legal
Privacy Policy
Last updated 3 October 2026
This policy explains what personal data SkySign collects, why, how long it is kept and what rights you have. It covers the public website at useskysign.com, the SkySign application, and the emails the service sends.
1. Who we are and our role
SkySign is operated by [Legal entity name — to be confirmed], company number [Company number — to be confirmed], registered at [Registered address — to be confirmed] (“SkySign”, “we”, “us”).
We act in two roles:
- As a controller for the personal data of people who sign up, administer an account, contact us, request a demo or visit our website.
- As a processor on behalf of our customers for the personal data of their workforce (the people customers invite to read and acknowledge documents). The customer decides what to upload, whom to assign and how long to keep records; we process that data on the customer’s instructions under our Data Processing Agreement. If you are an employee of a SkySign customer and have a question about your data, your employer is the first point of contact.
2. Information we collect
Account data
- Name, work email address, organisation name and role within SkySign.
- For paying customers: billing contact details and subscription status. Card details are collected by Stripe on its own pages and never reach SkySign.
Content customers upload
- Documents (PDFs, written documents and messages), which may themselves contain personal data.
- Departments, stations and group membership.
Acknowledgement records
- The statement accepted, the typed name, date and time, the document version and file hash, the authentication method, browser details and IP address, and the result of any knowledge check.
Correspondence
- Support requests and demo requests, including the details you choose to include.
3. How we use it and our lawful basis
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Providing the service: accounts, documents, notifications, acknowledgement records, reporting | Performance of a contract (for customers); processing on the customer’s instructions (for workforce data) |
| Billing and account administration | Performance of a contract; legal obligation (accounting records) |
| Security, fraud prevention and service integrity, including audit logs | Legitimate interests in keeping the service and its records trustworthy |
| Responding to support, demo and security enquiries | Legitimate interests; steps prior to a contract |
| Website analytics on the public marketing pages | Consent, where required by cookie rules (see section 6) |
| Service announcements and important notices | Performance of a contract; legitimate interests |
We do not sell personal data, and we do not use customer content for advertising.
4. Employee data processed for customers
When a customer invites its staff to SkySign we process, on the customer’s behalf: name, work email address, department and station, documents assigned, notification and reminder emails sent, and acknowledgement records. We use this data only to provide the service to that customer, and we retain it according to the customer’s instructions and section 9.
Acknowledgement records are designed as evidence: once made they cannot be edited by anyone, including the customer’s administrators. They are removed only when the customer deletes the document, the user or the organisation.
5. Technical and log data
- Standard server logs held by our hosting provider, including request paths, timestamps and IP addresses, used for security and troubleshooting.
- The IP address and browser details recorded with each acknowledgement, kept as part of the evidential record.
- Email delivery metadata from our email provider (delivered, bounced).
8. AI features
Two optional features (a summary of an uploaded PDF, and a writing assistant in the editor) send text to Anthropic’s API only when an administrator chooses to use them. No employee data, acknowledgement records or account data are sent, and customer documents and acknowledgement records are not supplied to generative AI models for training. See AI data processing on our Security & Trust page.
9. Retention and deletion
- Customer accounts: data is retained while the account is active. Deleting the organisation removes its documents, records and users immediately; copies in provider backups expire according to the provider’s retention period.
- Acknowledgement records: retained while the related document and organisation exist, because they are the evidence the service is for. Customers can export them as CSV at any time.
- Employees who leave: the customer may disable the account (history kept) or delete it (history removed).
- Demo and support correspondence: kept for as long as needed to respond and for a reasonable period afterwards, [retention period — to be confirmed].
- Billing records: kept for the period required by accounting law.
10. International transfers
Our primary database and file storage are hosted in [Supabase project region — to be confirmed]. Some providers listed on the Subprocessors page operate outside the United Kingdom and the European Economic Area. Where personal data is transferred to such a provider, we rely on the provider’s standard contractual clauses or an equivalent recognised safeguard. [Confirm the transfer mechanism for each provider with counsel — to be confirmed].
11. Your rights
Depending on where you are, you may have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased, where there is no overriding reason to keep it;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent where processing is based on consent; and
- complain to a supervisory authority, [Supervisory authority — to be confirmed].
To exercise these rights, email privacy@useskysign.com. If you are an employee of a SkySign customer, we will refer your request to your employer where they are the controller, and assist them in responding.
12. Security
How we host, isolate and protect data is described on the Security & Trust page. In short: data is encrypted in transit and at rest, access is enforced at database level per organisation, documents are held in private storage, and acknowledgement records cannot be edited once made.
13. Changes to this policy
We will post changes here and update the date at the top. Where a change materially affects how we use personal data, we will tell account administrators by email or in the application before it takes effect.
14. Contact
Data protection enquiries: privacy@useskysign.com. Security: security@useskysign.com. Postal address: [Registered address — to be confirmed].