Data processing addendum

Effective 24 October 2026

This addendum forms part of the Terms of use when Skygen processes personal data on a business customer’s behalf. The customer is the controller and Skygen is the processor for that work. This addendum takes priority on that processing; a separately signed agreement takes priority where it expressly changes these provisions.

1. Processing covered

Subject and purpose: requested research, marketing content, campaigns, connected-account operations, reporting and saved workspace. Duration: the service period and time reasonably needed to return or delete customer data, subject to a legal retention requirement.

Operations: collecting, receiving, organising, analysing, generating, storing, transmitting, retrieving, correcting and deleting data needed for the work. People: customer users, employees, professional contacts, prospects, creators and message recipients.

Data: names, roles, employers, contact details, profile content and metrics, uploaded material, prompts, drafts, campaign and account identifiers, messages, replies, delivery records and opt-outs. Some reply previews are limited to five hundred characters. Ordinary marketing workflows are not intended for special-category data or information about children.

Account administration, billing, security and the shared research corpus are separate controller activities under the Privacy Policy. A shared external research fact is not a customer’s private conversation or campaign history. Deleting customer workspace data does not automatically erase independently held corpus information; individuals can exercise their rights directly with Skygen.

2. Instructions and customer responsibilities

Documented instructions include requests, configured connections, permissions, approved work plans and actions, and these terms. We will process customer data on those instructions, including transfer instructions, unless applicable law requires otherwise. If legally permitted, we will tell the customer about such a requirement before processing. We will inform the customer if we believe an instruction infringes applicable data-protection law.

The customer is responsible for a lawful basis, required notices and consent, data accuracy, rights to submitted material and the lawfulness of its audience and campaigns. It must keep authorisations current and respond to individuals’ requests. Technical access through an integration is not permission to use data for an unrelated purpose.

3. Confidentiality and safeguards

We will restrict access to people who need it to provide, secure or support the service and require confidentiality obligations or an applicable statutory duty. We will maintain technical and organisational safeguards appropriate to the processing and its risks.

Implemented application controls include HTTPS, hashed passwords, session controls, account-scoped access checks, approval and permission controls, request limits and restrictions on unsafe outbound URLs. Infrastructure providers supply additional controls. This standard addendum does not claim an independent security certification, absolute prevention of incidents or a dedicated residency arrangement.

Opt-outs are held at your scope and checked across your campaigns. A human-only removal of an eligible manually added suppression records who removed it, when, and the reason given. Recipient opt-outs are not eligible for that removal. Customers must not instruct us to bypass these safeguards.

4. Service providers and transfers

The customer generally authorises providers needed for selected features, described in the provider table. These can include Fly.io and database infrastructure, Cloudflare, AI and research services, browser or execution providers, and authorised mailbox and integration providers. Whop handles billing under its own terms and is not automatically a processor for every customer marketing task.

For a sub-processor handling customer data on our behalf, we will require appropriate written data-protection obligations and remain responsible for our obligations under applicable law. Where required, we will notify customers of intended new or replacement sub-processors and allow a reasonable opportunity for a substantiated objection. We will work to resolve it; if no suitable resolution is available, the affected processing must be discontinued.

We will not make a restricted international transfer without legally required safeguards. Any separate transfer instrument needed must be completed for the relevant parties and processing; this page does not represent an unsigned annex as an executed agreement. Contact us before submitting data subject to restrictions the standard service cannot meet.

5. Requests and incidents

Taking account of the processing and information available, we will reasonably assist with individuals’ requests and relevant security assessments, breach notifications, impact assessments and regulator consultations. We will notify the customer without undue delay after becoming aware of a personal-data breach affecting its customer data and provide available information needed to assess and respond to it.

We will direct or forward requests about customer-controlled data to the customer where appropriate, unless law requires us to act directly. We will not disclose another customer’s private data. Some requests and deletions require manual handling; no automatic account-erasure workflow is promised.

6. Return, deletion and audits

At the end of the relevant service, we will, at the customer’s choice, return or delete data processed on its behalf and delete copies unless law requires retention. Request export before access closes. If immediate backup deletion is impracticable, retained data will be isolated from ordinary use and removed through the applicable replacement or deletion cycle.

Billing records, security evidence, minimal suppression records and independently controlled research data may have separate lawful retention purposes under the Privacy Policy. Ending a subscription or browser session does not itself erase saved account data.

We will make information reasonably needed to demonstrate these obligations available and allow proportionate audits or inspections required by law, subject to confidentiality, security and other customers’ rights. This does not authorise unrestricted access to production systems or other tenants’ records.

7. Contact

Send data-processing requests to privacy@skygen.ai and security reports to security@skygen.ai. Include the account and affected work, without unnecessary personal data or credentials.