Privacy, plainly.

Sky website and application privacy notice

Last updated 14 October 2026. This notice covers the public Sky site at skyteknologies.com and the private application at app.skyteknologies.com, including the website enquiry, account, booking, newsletter and private-workspace flows described below. A separate written service agreement may cover client work. For a privacy question or request, email privacy@skyteknologies.com. Sky Technologies is based in India and serves the United States, EU/EEA, United Kingdom, Canada and India. Sky acts as controller for its own account and website operations. For client-directed service data, Sky may act as a processor only where the activity and applicable written service agreement establish that role. This notice does not represent that a data-processing agreement, privacy representative or data protection officer has been signed, appointed or confirmed. Applicable obligations depend on the activities, people and jurisdictions involved.

Purposes and proposed lawful bases

Depending on the activity and applicable law, Sky's proposed basis mapping is: taking steps you request before an agreement and providing the account or service you ask for, contract or pre-contract steps; protecting the site and accounts, administering services and handling necessary non-marketing business contact, legitimate interests where available; the Sky newsletter and Sky-managed optional analytics, your separate consent; and keeping records where a legal requirement applies, legal obligation. These bases are specific to the purpose and are not blanket consent for all processing. Before relying on legitimate interests, Sky still needs to complete and document a balancing assessment; this notice does not say that assessment is complete. Third-party providers may process information under their own roles, terms and legal bases.

1. Information you provide

A website enquiry asks for your name, email, optional company, selected topic and message. A Sky account uses your email and verification state, privacy-notice acknowledgement and any delivery profile, follow-up answers or company-team details you choose to provide. Newsletter forms record the address, consent choice and confirmation state. Marketing is separate from an account, enquiry or one-time worksheet-link request. The free printable incident worksheet does not require an email address; answers typed into the worksheet stay in the current browser tab and are not submitted to Sky. A separate request for its link uses your email for a confirmation request and, after confirmation, one link email. Its additional marketing option is separate: two welcome emails about three and seven days after confirmation, then no more than two editorial notes per month if published. Booking through Calendly opens that separate scheduling service, which handles the information you enter there.

2. How Sky uses those details

Sky uses enquiries to respond, account information to authenticate you and maintain the account, and profile information for the private review and service functions you request. Authorized Sky staff can review submitted profiles and follow-up messages. Account or profile review does not subscribe you to marketing, approve a provider account or authorize sending. Newsletter details are used for the confirmation and messages you separately chose. Resource-only requests do not create a marketing subscription. Operational logs help investigate site availability and misuse. A booking click is not a confirmed appointment.

With your optional analytics choice, the public activity panel creates a random tab identifier in sessionStorage under sky-active-browser-v1 and sends heartbeats while the tab is visible. It counts tabs seen in the last 90 seconds. The server retains a hash of that identifier, estimated country and last-seen time with an approximately one-day expiry. Time zone and language help estimate country. Sky-managed optional activity stays off before a choice and stops after withdrawal; this does not control separately injected hosting telemetry.

3. Account security and browser storage

The account session cookie is named __Host-sky-buyer. It is Secure, HttpOnly, SameSite=Lax, Path=/ and host-only, with a configured 12-hour maximum age. OAuth sign-in uses a separate host-only state cookie to protect the sign-in flow. Cookies set for one Sky host are not shared with the other host. Email-link tokens and session tokens are stored as hashes in the account database, not as raw database values. Google or Microsoft sign-in, when available, supplies sign-in identity; it does not grant mailbox access or authority to send messages. Mailbox integrations require a separately authorized connection.

Personal account security is active. A verified user may set a Sky website password and may enroll an authenticator app. Passwords are stored as salted slow hashes. For an enrolled authenticator, Sky stores an account-bound encrypted secret and hashes of one-use recovery codes. The enrolled factor is required for sign-in methods associated with that account; email access alone does not bypass it. An email-link sign-in remains available for recovery, but it does not bypass an enrolled authenticator. Security changes invalidate existing sessions. The configured account-session maximum age is 12 hours.

The workspace remembers interface preferences such as theme and navigation state in browser storage. The sidebar_state layout cookie, where used, has a seven-day maximum age. The separate sky-cookie-consent-v1 preference is stored in localStorage for up to 180 days with a version, necessary-storage setting, analytics choice and local timestamps. It is not linked to your account. Accept, reject and settings controls are available; withdrawal stops future Sky-managed optional events, not authentication or user-requested forms. Browser storage failures keep a choice only in page-session memory. Each Sky host and device keeps separate preferences. Global Privacy Control keeps optional analytics off.

The live site shell also loads Manus platform analytics and externally hosted font resources, including Google Fonts. These browser requests can disclose the connection IP address and request metadata to those services. Sky's optional-analytics gate does not control this hosting telemetry or every external resource. No claim is made that no third party is contacted before you choose, and Sky-managed analytics is not described as advertising. The platform analytics event details, identifiers, retention and controls remain subject to verification. The application code review is not enough to establish that advertising tracking is absent across the full live site, and this notice makes no unqualified no-sale or no-sharing promise.

4. Systems, hosting and sharing

If a Sky form has a Cloudflare Turnstile bot challenge enabled, the challenge sends bot-check metadata and a verification token to Cloudflare for server verification. Sky does not send your email address or password to the verification endpoint; form fields are submitted separately to Sky. Challenge deployment status varies by form and has not been independently verified; Sky does not claim Cloudflare certification.

Sky's website and application use Manus-hosted infrastructure; the source review does not verify all production hosting and provider configuration. Site enquiry and subscription records are held in the website database. The application code routes transactional email through Resend for account links, newsletter confirmation and website notifications; actual production provider settings are outside this source review. The booking link opens Calendly, which has its own privacy notice. These services receive information needed for their respective flows.

If the optional Sky website assistant is available, it receives your question and up to six recent chat turns through the assistant's configured model service. The chat transcript remains in browser-page memory until refresh or close; model-service logging may apply. The production model/provider and its retention settings must be verified before they are named in this notice. Asking the assistant alone does not create a support ticket. A separate in-chat enquiry sends the details you submit to Sky; recent chat turns are included only if you separately opt in. Do not enter credentials, recipient lists or sensitive personal information into the assistant.

Personal account security and company employees

A company owner can share service data associated with their account by inviting employees and assigning module permissions and an Owner, Admin, Operator or Viewer role. Invitations store the intended email, a hashed expiring token and acceptance state. An invitation can be prepared before an employee registers; acceptance requires the exact intended verified email and does not create sending permission or Sky staff access. This first version does not email invitations automatically. Company memberships, role changes and session-specific company selection are stored separately from personal account credentials. A company Admin is not a Sky administrator. Removing membership stops further company access, not the employee's own Sky account.

Private inbox-placement testing

If Sky separately grants your verified account access, a placement test stores its label, optional sender note, random message-body marker, assigned Sky seed addresses, account association, action timestamps and mailbox observations. Your report is available only through your account; authorized staff can operate seed inventory and service access. Manual placement testing does not read your own mailbox or connect to a sending account. The separate optional ESP workspace can send one exact reviewed test through a connected provider after your explicit confirmation. Use a harmless test creative with no personal recipient data, passwords or private customer material.

Designated Sky staff may separately authorize dedicated Sky-owned Gmail and Outlook.com seeds using read-only mailbox OAuth, or import Sky-owned AOL/Yahoo seeds with provider app credentials. This mailbox authorization is separate from ordinary Google/Microsoft website sign-in. The grants permit broad mailbox reading, so only dedicated owned seeds should be connected. When scanning is explicitly enabled, the reader retrieves bounded message content transiently to locate test markers and observe folders. It does not save message bodies or attachments, send content to an AI, load remote resources, mark messages read, move messages or send email. Tokens and app credentials are encrypted separately from website session credentials. Google, Microsoft and Yahoo/AOL process their respective mailbox/API requests; the website's existing hosting and database store test records and encrypted credentials.

The 30-minute observation cutoff is not a retention period. Test records, observations, access grants and staff-operation audit records remain until Sky processes a valid deletion request or another applicable retention obligation. Contact the privacy addresses above to request access or deletion. Staff can disconnect a seed to remove its stored credential and stop local reading; this does not delete the mailbox or automatically revoke consent at its provider. Inbox-placement observations describe the assigned seed sample, not your subscribers' inbox rate. Using this service does not subscribe you to marketing.

Private domain and IP blocklist monitoring

Blocklist monitoring is a separate service inside your existing Sky account. When this service is enabled, a verified account with an approved delivery profile receives an included allowance of 2 retained monitors. Additional monitor capacity requires a separate purchase and a staff-recorded purchase reference; it does not use inbox-placement tests or credits. Creating an account or receiving profile approval does not authorize email sending, buy a service, or connect your sending credentials.

For each domain or public IPv4 address you own or are authorized to monitor, Sky stores your account association, target, label, ownership acknowledgement, Sky synchronization state, timestamps, sanitized saved results, source catalog metadata and observed listing changes. To operate provider-backed monitoring, Sky sends the target and an opaque monitor label to HetrixTools and reads saved reports and available change history. Your email address, profile, mailbox content and sending credentials are not included in those requests. Provider checks currently follow a nominal 24-hour cadence; Sky retrieves saved results separately. The shared free-plan account has a 32-monitor cap, including Sky-owned and retained client monitors. Paid capacity is still subject to that shared service cap.

Pausing in Sky stops synchronization, not the external provider's retained monitor or its slot. To stop external monitoring or request deletion, contact Sky through the privacy addresses above; staff must handle the provider action separately. Sky records and staff capacity records remain until Sky processes a valid deletion request or another applicable retention obligation. Provider history is limited to the retention available under its plan; Sky's first-observed times are not proof of when a listing originally began.

Provider reports supply positive listings, not individual verified negative results for every catalog entry. No listings reported is not proof of all-source clearance, universal reputation or inbox placement. The separate direct-source DNS engine remains disabled unless staff expressly enables authorized source access; its grants are not client provider-monitor credits. If that independent engine is separately enabled, monitored domains or reversed IP addresses are included in DNS queries to the configured resolver and authorized source providers. Monitoring does not send messages, alter DNS, automatically request delisting or subscribe you to marketing. Email alerts are not currently enabled.

Private authentication monitoring

The authentication-monitoring workspace currently performs manual DNS checks; automatic monitoring is off. A check queries DNS for the domain being examined and does not send an email. Do not describe this feature as continuous monitoring or automated alerting. Any saved monitoring metadata and its retention period need confirmation against the current service code before a final notice is approved.

Private Google Postmaster connections

When Sender Insights is enabled for your verified Sky account, you can separately authorize your own Google account to access Google Postmaster Tools. The Postmaster permission lets Sky discover authorized domains, add a domain at your request, provide Google's DNS ownership-verification record, request verification and read available aggregate Gmail metrics and compliance results. It does not permit reading your mailbox, sending email or changing your DNS. The Google account you connect may differ from your Sky sign-in email. You remain responsible for domain ownership and publishing the requested DNS record without replacing existing mail records.

Sky stores the connected Google identity and account association, encrypted access and refresh tokens, domain permissions and verification status, saved aggregate reports, provider dates and update timestamps. Reports are private to the owning Sky account; the main Sky administrator manages service access and connection-state information, not another client's tokens. Google processes the domain/API requests. Missing or suppressed Google data is not treated as zero or an inbox result; these signals describe personal Gmail traffic and are separate from Sky seed tests.

Disconnect removes Sky's stored grant and local report data and prevents further local access. It does not delete a domain from Google Postmaster, alter DNS or revoke other applications; you may also revoke Sky's authorization in your Google Account. Saved reports cover the most recently retrieved 28-day window, not indefinite provider history. Connection and domain metadata remain until disconnect or a valid deletion request, subject to applicable obligations. This connection does not enroll you in marketing.

Private Microsoft SNDS connections

When Microsoft SNDS is enabled for your eligible Sky account, you can supply your own automated-data access key through the private connection form. Sky stores the key encrypted, together with your account association and connection name. The key is used only on the server to retrieve Microsoft's available Outlook.com sending-IP reports; Sky does not ask for your Microsoft password, read your mailbox, send messages, add IP ownership rights or change DNS. You must already have authorization for those sending IPs in Microsoft SNDS. Key renewal remains your responsibility, and a renewal reminder is not proof of the link’s expiry date.

Sky retains sanitized IP-level filter statuses, available command and recipient counts, complaint rates, Microsoft report dates and import timestamps. It excludes sample sender addresses, recipient details and raw report content. Report views cover up to 90 days. Older snapshots are removed during the next successful import; disconnect removes the stored history. Reports are private to the owning Sky account; the main administrator manages service access and connection summaries without seeing clients' stored export links. Missing data, expired or inaccessible export links and ambiguous Microsoft errors are never treated as healthy IP results. These reports are not seed-inbox observations, domain-level attribution, Microsoft 365 or EOP telemetry.

Replacing the connected export link removes the previous connection's saved reports before importing the new link’s data. Disconnect removes Sky's stored export link and local SNDS history and stops further local imports; it does not revoke or delete the key or IP authorization in Microsoft. This integration does not subscribe you to marketing.

Private ESP connections and controlled test sending

When enabled for your verified Sky account, the ESP workspace connects your own provider account using a separately entered API key or cloud credential, or an authenticated TLS SMTP credential. Connections are private to the owning Sky account. Credentials are encrypted and bound to the account, provider and connection; they are not returned in reports. Each provider exposes different domain, report and event controls. Sky does not request account billing, administrator or ownership control, edit DNS, or operate a full marketing campaign service through this workspace.

SMTPGrid is currently disabled in the client application; the reviewed client does not provide an active customer connection control for it. This notice does not describe an active SMTPGrid credential connection or sending flow.

At your explicit request, Sky can create a provider sending-domain identity, retrieve provider-issued DNS instructions and request verification. You publish those records at your DNS host. Separately reviewed event setup can add a Sky event destination where supported without replacing other destinations. Sky validates provider signatures or configured callback authentication and stores only bounded normalized event types, opaque identifiers and timestamps, not raw recipient addresses, private message bodies or raw provider logs. Native aggregate reports retain at most the last retrieved 31-day window; callback event rows are bounded to 90 days and 5,000 rows per connection. Missing values remain unavailable, not zero.

A controlled placement-test send requires a fresh exact-payload review showing the provider, sender, subject, message body and the Sky seeds assigned to your own active test. Confirming sends that reviewed message only to those seeds; it may consume provider quota and is not a campaign or inbox guarantee. The message is processed transiently to send and is not saved in the operation ledger. Unknown send outcomes are not automatically retried. Manual report updates read provider data; there is no automatic campaign sending or new background report schedule.

Disconnect removes Sky's saved credential, reports and event rows and stops local access. Non-secret connection identifiers, version fences and operation history remain to prevent stale updates and duplicate sends until a valid deletion request or applicable retention obligation. Disconnect does not revoke the key, delete sending domains, disable provider webhooks or remove cloud subscriptions; handle those separately at the provider. Connecting or testing does not subscribe you to marketing.

Private report review and pre-send QA

Managed DMARC requires a verified sending-domain ownership challenge. XML or gzip reports you choose to import are processed transiently; Sky saves only normalized report dates, a bounded receiver label, hashes for deduplication, source IPs, message counts, reported alignment and disposition, and your sender-classification notes. Contact fields, raw XML, message bodies and recipient data are not retained. Up to 100 reports per domain are retained within a 90-day view. An optional collector uses a private header token stored only as a hash; it does not create a reporting mailbox, email collector or DNS reporting destination. Receiver coverage is incomplete and reported alignment does not prove inbox placement.

Unified ESP reporting rereads your existing saved provider reports without starting a provider refresh. Metric units, missing values and dates remain source-specific. Alerts evaluate saved report and monitor evidence; Sky stores the rule configuration, bounded evidence, owner labels, investigation state and action history. Labels do not grant access to another user and an action record does not perform or authorize a DNS, provider or mail change. Alerts and action history have a 90-day view and bounded account limits. Automatic evaluation and notification email remain off until separately configured and agreed.

Private domain warm-up drafts

The domain-warm-up workspace saves user-entered configuration and review/version metadata for a private draft. No ramp worker or production-send integration is active. Saving or reviewing a draft does not send, queue, schedule or enable messages. Any controlled placement-test send remains a separate, explicitly confirmed action in the existing test workflow.

Private campaign diagnostics

Campaign Diagnostics analyzes optional HTML, headers and text in browser memory. It does not render the creative, fetch its resources, submit the raw content or save it. If you choose to save a private review, Sky stores structured review metadata such as route labels, sending domain, intended launch date, checklist evidence, reviewer labels, safe finding identifiers/counts and an optional owned placement-test reference. The saved record does not contain the raw creative or headers. A saved checklist is not a sending authorization or performance guarantee.

5. Retention and your choices

Sky keeps the records needed to respond to requests, operate accounts, document newsletter consent and manage business or legal obligations. Expired link and session records are pruned periodically after expiry. An unverified Sky account with no new verification request for 30 days is removed during routine cleanup; verified account, profile and related review conversation records remain until a valid deletion request or another applicable retention obligation. Signed-in sessions expire and can be revoked by signing out. You can edit your delivery profile or ask about, correct or request deletion of your personal information through the contact details above, subject to applicable law. Use unsubscribe to stop Sky's website newsletter and request removal from existing Sky marketing lists. The website newsletter is separate from Sky's earlier sending databases; historical-list requests are passed to Sky's operations team for processing.

Your privacy rights and requests

Depending on the law that applies, you may be able to request access, correction, deletion, restriction of processing, objection or a copy of information in a portable format. Where processing relies on consent, you can withdraw it; withdrawal does not undo processing that was lawful before withdrawal. Rights and exceptions vary by jurisdiction and processing. Requests are handled manually. Sky may make a proportionate identity check to protect information, but do not send a password, government identity document or other sensitive evidence casually; ask first for a suitable verification method. Where GDPR response rules apply, Sky normally responds within one calendar month. A permitted extension will be used only where the law allows it, with notice within the initial period; other laws can set different deadlines.

To exercise a right or ask a question, contact privacy@skyteknologies.com. You may also complain to the UK Information Commissioner's Office, contact your EU/EEA supervisory authority using the European Data Protection Board's authority list, or contact the Office of the Privacy Commissioner of Canada or another Canadian privacy regulator with jurisdiction, where applicable.

Children

Sky's business website and services are not designed or intended for children. Sky does not claim to scan for or verify a visitor's age. If you believe a child has provided personal information to Sky, contact us using the privacy address above.

Items still being verified

This source review does not verify all live hosting telemetry, consent timing for externally loaded resources, production email or assistant-provider settings, provider processing locations, applicable written processor terms, cross-border transfer arrangements, or the operational process for rights and incident handling. Provider countries and transfer destinations have not been fully verified; no adequacy finding or executed Standard Contractual Clauses or UK International Data Transfer Agreement is represented here. This notice does not claim that a representative or data protection officer is appointed, that an automatic erasure or breach-response service is in place, or that any compliance certification has been completed. These matters require operational verification and should be updated if the facts change.

6. Contact

Sky Technologies · No. 202, Verma Niwas, Dhanori, Pune 411015, India · privacy@skyteknologies.com. Contact us using these details if you have a question about this notice or Sky's handling of your information.