SkygenPrivacy Policy
Effective 24 October 2026
This policy covers the website and marketing workspace at skygen.ai. “Skygen”, “we” and “us” refer to the operator of this service. Contact privacy@skygen.ai about personal information, including information obtained through a customer’s research. Paid customers can also use the seller contact identified at checkout and on their Whop receipt.
1. Our role
Skygen determines how account administration, billing records, service security, website measurement and its shared research corpus are used. For personal data in customer-directed lists, private workspace content and campaigns, the customer generally determines the purpose and Skygen processes it on their instructions under the Data processing addendum. A connected platform may separately act as a controller under its own policy.
2. Information we handle
- Account: email address, password hash, account identifiers, sign-in sessions, preferences and activity dates. Passwords are not stored in readable form.
- Workspace: prompts, conversations, company briefs, uploaded material, research, drafts, campaign settings, approvals, reports and task records.
- Connections: account identifiers, permissions, credentials or tokens needed for services you connect, and information those services return.
- Communications: recipients, subjects, messages, delivery and reply records, and opt-outs. Some reply previews are limited to five hundred characters; this is not a limit on all message content we process.
- Billing: plans, purchase and subscription identifiers, amounts, currency, tax information supplied by the provider, renewal dates, refunds and disputes. Whop and its partners collect payment credentials. Skygen does not receive your full card number or card security code.
- Technical: IP addresses, browser and device information, request and error logs, session data, consent preferences and website interaction events where measurement is enabled.
Do not submit sensitive information unnecessary for the task. Skygen is not designed to research private individuals in a personal capacity, make consequential decisions about them or collect special-category data such as health, religious beliefs or sexual orientation.
3. Business and creator research
A customer may ask Skygen to research a business, professional or creator who has never opened an account. Sources can include websites, search results, directories, company registers, public posts and profiles, commercial research APIs, and platforms reached through an authorised connection or authenticated service. Results may contain names, employers, roles, published contact details, profile URLs, public content, creator metrics and supporting sources.
We distinguish published, externally confirmed, scraped, indexed and inferred information. An inferred email address is a guess. A blocked or failed check does not prove a mailbox invalid. Customers must review evidence and have an appropriate basis to use it.
The ordinary crawler reads robots.txt and identifies itself as SkygenResearchBot. Disallow SkygenResearchBot in your robots.txt to exclude it. Authenticated platform connections are a separate access path governed by the platform’s permissions and terms.
Where an SMTP address check is available, it asks the recipient’s mail server about an address and stops before sending message content. Its default budget is twenty recipients per domain per hour. A domain accepting every tested address is not proof that a particular mailbox exists.
4. Purposes and legal bases
- Provide accounts, requested research, content, campaigns and connected-service operations, and remember workspace context.
- Manage purchases, access, allowances, renewal, cancellation, billing disputes and fraud prevention.
- Honour approvals and opt-outs, investigate errors, secure the service and comply with legal obligations.
- Respond to support and privacy requests and maintain required records.
- Measure website use and advertising effectiveness where enabled and lawfully permitted.
Where EU or UK data-protection law applies, we rely on performance of a contract for requested account services, legal obligations for required records, and legitimate interests for security, fraud prevention, service operation and relevant business research. Those interests must be balanced against affected people’s rights. We use consent where required, including for non-essential tracking. Consent may be withdrawn without affecting earlier lawful processing. A basis to hold business information is not automatically permission to send marketing.
5. Service providers and other recipients
| Provider or category | Purpose and information involved |
|---|---|
| Fly.io and database infrastructure | Fly.io hosts the application. Postgres stores durable account and workspace data. Infrastructure services also handle operational logs. |
| Cloudflare | Network and storage services used by parts of the product, including outreach storage. It is not the sole host of all account data. |
| Whop and payment partners | Checkout, payment credentials, taxes, subscriptions, refunds, disputes and fraud prevention. Their separate privacy notices apply to payment processing. |
| OpenRouter and routed model providers | Prompts and the workspace, page, message or research content needed for an AI task. Provider retention and use depend on the applicable terms; a zero-retention agreement is not promised here. |
| Search and research providers | Queries, names, domains and identifiers needed for a lookup. Providers can include Tavily, Exa, Ahrefs and commercial business or contact-data services, depending on the feature and connection. |
| InboxKit, Unipile, Composio and connected platforms | Authorised mailbox and integration operations, including necessary messages, recipients, profile information, credentials and campaign data. |
| Browser, execution and media providers | URLs, task input, files and creative prompts needed for requested work. Sandboxed execution can use E2B; other providers depend on the feature. |
| Website analytics and advertising measurement | Browser identifiers, visits and interaction events where enabled and permitted. The marketing site supports Google Analytics, Google Tag Manager and Google Ads. |
Not every provider is used for every account or task. Information may also reach people operating the service as necessary for support and security, advisers or authorities when legally required or to protect rights, and parties to a business transfer subject to appropriate safeguards.
Private customer conversations, approvals and campaign history are not made visible to other customers through the shared research corpus. Skygen does not train its own foundation models on private workspace content. Third-party AI providers process submitted requests under their applicable terms; do not submit material you are not authorised to send to them.
6. Cookies and browser storage
Essential cookies and browser storage keep you signed in, protect requests, remember consent and retain preferences. Signing out or clearing browser data does not automatically delete server-side workspace or billing records.
The marketing site provides cookie-consent controls. Non-essential analytics and advertising storage are subject to that choice where consent is required. You can clear browser storage or change browser permissions. Whop and other external sites have their own controls and privacy policies.
7. Retention
Account information and saved workspace content are retained while needed to provide your account and requested services, unless you delete supported records or request deletion. Session expiry, cancellation or the end of a trial does not automatically erase an account’s saved work. Account deletion and some other requests require manual handling.
Billing, fraud, dispute and legal records may be retained after closure for the relevant obligation or claim. Technical logs are retained for diagnosis, security and service operation under the infrastructure’s and service’s retention settings; no unverified fixed log-retention period is promised here.
Shared research facts can outlast the account that first found them. Confidence decays, including every 180 days for a company’s address convention. These are half-lives, not expiry dates. Decay is not deletion. An individual may request correction, objection or erasure independently of a customer account.
A minimal suppression record may be retained to prevent further unwanted contact after related research is deleted. Legally required or dispute-related records are restricted to that purpose. Backup copies, where present, may be removed on their replacement cycle rather than immediately.
8. If a customer contacted you
What it covers: everything from whoever wrote to you. The unsubscribe control in a message records an opt-out for the sending account and applies across its campaigns and mailboxes. It does not reach other customers of this service; each customer has its own obligations and suppression list.
You can also reply with unsubscribe, remove me, take me off, stop emailing me or do not contact me, or their Russian equivalents. A reply-based request depends on the sending mailbox being read and processed, so the unsubscribe control is the more direct route. If it fails, contact privacy@skygen.ai with the relevant message details.
For access, correction, erasure or an objection to a research record, contact the same address. We may request proportionate information to verify identity and find the data. A customer cannot use a manually added suppression-removal action to override a recipient opt-out.
9. Rights and international processing
Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, withdraw consent, and complain to your relevant data-protection authority. Rights may be subject to legal exceptions. Skygen is not offered for solely automated decisions about eligibility for employment, credit, housing or similarly significant services.
Providers and operations may process information outside your country, including in the United States. This policy makes no EU-only, UK-only or other exclusive residency commitment. Where a restricted transfer needs an adequacy decision or contractual safeguard, the applicable arrangement must be in place. Contact us about your processing; this page does not itself create a signed transfer agreement or certify a provider’s compliance.
10. Security, children and updates
We use HTTPS, password hashing, session controls and account-scoped access checks. No internet service is risk-free. This policy does not claim SOC 2, ISO 27001 or an independent security certification. Report vulnerabilities to security@skygen.ai.
Skygen is a business service for adults and is not directed to children under 18. Contact us if you believe a child has supplied personal information. We will update this policy as the service changes, show its effective date and communicate material changes where required.
Contact privacy@skygen.ai for privacy requests and bot@skygen.ai about the crawler.