Privacy Policy

This Privacy Policy describes how Skylo ("Skylo", "we", "us", or "our") collects, uses, discloses, and safeguards your information when you use our website (flyskylo.com), mobile application, and related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree with the terms, please do not access or use the Service.

If you have any questions or requests regarding this Privacy Policy, please contact us at support@flyskylo.com.

1. INFORMATION WE COLLECT

We collect information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("Personal Data"). The categories of Personal Data we collect include:

A. Account & Identity Information

B. Device & Technical Information

C. Location Information

D. Camera & Media Access

E. Verification & Compliance Data

F. Payment & Financial Information

G. Address & Location Data

H. Aircraft & Booking Information

I. Communications & Support Data

J. Technical & Usage Data

K. Third-Party Integration Data

L. Notifications & Preferences

We may also collect information you voluntarily provide to us, such as when you contact support or participate in surveys.

In some cases, you may have the option to use our services without providing certain Personal Data, but this may limit your ability to use specific features of the Service, particularly those related to aircraft rental and verification processes.

2. HOW WE USE YOUR INFORMATION

We use your Personal Data for the following specific purposes:

1. Account Administration & Verification: User authentication, identity verification, role-based access, profile management, and legal compliance.
2. Aircraft Rental & Booking Services: Listing management, availability calculation, booking processing, HOBBS meter verification, location-based services, analytics, and insights.
3. Automated Processing Services:
   • HOBBS meter reading extraction from photos using computer vision technology
   • Fuel receipt processing and verification for wet rental reimbursements
   • Aircraft maintenance tracking and automatic safety blocking when overdue
   • Document verification and processing automation for licenses and maintenance records
   • Intelligent customer support responses and chat assistance
   • Fraud detection and risk assessment algorithms for platform security
   • Personalized aircraft recommendations based on user behavior and preferences
4. Payments & Financial Processing: Payment processing, balance management, owner payouts, transaction history, fee calculation, tax compliance, and fraud prevention.
5. Location-Based Services:
   • Finding nearby airports and aircraft based on your location
   • Providing accurate distance calculations and flight planning
   • Emergency services coordination and safety monitoring
   • Compliance with regional aviation regulations
6. Communication & Notifications: Direct messaging, support ticket management, automated notifications, marketing communications, flight reminders, push notifications, and language personalization.
7. Analytics & Business Intelligence:
   • User behavior analysis to improve app functionality
   • Aircraft listing performance and popularity tracking
   • Revenue optimization and pricing insights
   • Feature usage statistics and user engagement metrics
   • Market trend analysis and demand forecasting
8. Platform Improvement & Operations: Error monitoring, crash reporting, performance optimization, quality assurance, feature development, and user experience enhancement.
9. Security & Safety: Account security, fraud detection, dispute resolution, safety monitoring, data backup & recovery, and threat prevention.
10. Legal & Compliance: Regulatory compliance, legal proceedings, terms enforcement, audit trails, and geographic restrictions.
11. Third-Party Integrations: Payment processing (Stripe), database & storage (Supabase), OAuth authentication, email delivery, push notifications, and AI services (OpenRouter, Google Gemini).

3. HOW WE SHARE YOUR INFORMATION

We may share your Personal Data as described below. In each case, we ensure appropriate contractual provisions are in place to protect your information and only share what is necessary for the specified purpose.

• Infrastructure & Core Service Providers: Supabase (database, storage, auth), Stripe (payments, payouts, KYC).
• Notifications & Communications: Expo push notification service, email service providers.
• Other Platform Users: Pilot-to-owner communications, aircraft listings, public profile information.
• Analytics & Business Operations: Internal analytics, admin & support access.
• Legal & Compliance: Regulatory requirements, safety & security, legal processes.
• Corporate Transactions: Business transfers (merger, acquisition, sale).

We do not sell your Personal Data, share with data brokers, or use for advertising unless you have explicitly consented.

4. COOKIES & TRACKING TECHNOLOGIES

We use cookies, local storage, and similar technologies to enhance your experience. This includes authentication/session management, user preferences, app state, analytics, error logging, device information, push notifications, and third-party integrations (Stripe, OAuth). You can control cookies and storage via browser or in-app settings. Disabling may impact functionality.

5. DATA SECURITY

We implement reasonable security measures including multi-layer JWT token security, role-based access control, row-level security, session verification, IP logging, in-transit and at-rest encryption, secure document handling, Stripe integration security, server security, logging & monitoring, and error handling security. No method is 100% secure; contact support@flyskylo.com if you have concerns.

6. INTERNATIONAL DATA TRANSFERS

Your data may be processed in the US, EU, Australia, and other regions where our providers operate. We use legal mechanisms such as Standard Contractual Clauses, adequacy decisions, and explicit consent for international transfers. Technical and organizational safeguards are in place. Contact support@flyskylo.com for details.

7. YOUR RIGHTS AND CHOICES

• Access, update, or export your data via your account or by contacting support.
• Request deletion (with password/OAuth verification and 30-day grace period).
• Restrict processing, data portability, object to processing, or withdraw consent.
• Control communication preferences and payment/banking info.
• Technical choices: cookies, location, data usage.
• Parental rights for minors.

To exercise your rights, contact support@flyskylo.com. We may require identity verification.

8. ADDITIONAL INFORMATION FOR EEA, UK, AND SWISS USERS (GDPR)

• Skylo is the data controller. For EU-specific inquiries, contact support@flyskylo.com.
• Legal bases: contract performance, legitimate interests, legal obligations, consent.
• Enhanced rights: lodge a complaint, contest automated decisions, request safeguard info.
• Contact: support@flyskylo.com for all privacy-related requests.
• Complaint authorities: UK ICO, Swiss FDPIC, or your local data protection authority.

9. ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS (CCPA)

• Categories collected: identifiers, protected classifications, commercial info, biometrics, internet activity, geolocation, audio/visual, professional, education, inferences, sensitive info.
• Rights: know, delete, correct, limit use, opt-out of sale/sharing, non-discrimination.
• Request: Contact support@flyskylo.com for all California privacy rights requests.
• No financial incentives, no direct marketing sharing.

10. CHILDREN'S PRIVACY

The Service is not intended for children under 18. We do not knowingly collect data from children under 18. If we learn we have, we will delete it as soon as possible. Parents or guardians who believe their child has provided us with personal information should contact support@flyskylo.com immediately.

11. DATA RETENTION

• Active accounts: data retained as long as account is active.
• Inactive: flagged after 24 months of inactivity.
• Account deletion: 30-day grace period, backup, permanent deletion after 30 days, immediate removal from Supabase Auth.
• Deletion restrictions: outstanding balance, active bookings/listings, disputes, legal holds.
• Retention: transactions (7 years), messages (3 years), verification docs (account + 2 years), bookings (7 years), backups (90 days).
• Minimization/anonymization after retention periods.

12. LEGAL BASIS FOR PROCESSING

We process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to perform our services, including account creation, aircraft rentals, payments, and customer support.
• Legitimate Interests: Fraud prevention, security monitoring, service improvement, analytics, and business operations, balanced against your privacy rights.
• Legal Obligations: Compliance with aviation regulations, financial reporting, tax obligations, and law enforcement requests.
• Consent: Marketing communications, optional features, and certain data sharing activities where explicit consent is obtained.
• Vital Interests: Emergency situations involving safety or security of individuals.

13. AUTOMATED DECISION-MAKING AND PROFILING

We may use automated systems for:

• Fraud Detection: Automated analysis of booking patterns and payment behavior to identify potentially fraudulent activity.
• Risk Assessment: Evaluation of pilot qualifications and aircraft owner verification status for safety purposes.
• Pricing Optimization: Dynamic pricing suggestions based on market conditions and demand patterns.
• Content Moderation: Automated screening of messages and listings for prohibited content.

You have the right to request human review of any automated decision that significantly affects you. Contact support@flyskylo.com to exercise this right.

14. THIRD-PARTY SERVICES AND INTEGRATIONS

Our Service integrates with various third-party providers. Each has their own privacy practices:

• Supabase (Database & Infrastructure): Database hosting, authentication, and storage services. Data processed under their privacy policy and data processing agreements. Real-time data synchronization and secure file storage.
• Stripe (Payment Processing): Payment processing, KYC verification, and payout services. Subject to Stripe's privacy policy and PCI DSS compliance. Includes Stripe Connect for owner payouts and Stripe Identity for document verification.
• OpenRouter AI (Computer Vision): AI-powered HOBBS meter reading extraction from uploaded images. Document images are processed to extract numerical readings for billing accuracy. Data is processed temporarily and not stored by the AI service.
• Google Gemini AI (Customer Support): Automated customer support responses and intelligent chat assistance. User messages and context are processed to provide relevant support. Conversations may be analyzed to improve service quality.
• Expo (Mobile Infrastructure): Push notification delivery for mobile applications. Minimal data sharing limited to device tokens and message content. Crash reporting and performance analytics for mobile app optimization.
• OAuth Providers (Google, Apple): Authentication services that may collect additional data according to their respective privacy policies. Used for simplified login and account creation processes.
• Email Service Providers: For transactional and marketing email delivery, subject to their privacy practices. Includes booking confirmations, verification emails, and account notifications.
• Internal Analytics Platform: Custom analytics system for tracking aircraft views, user engagement, booking patterns, and platform performance. Data is processed internally and not shared with third-party analytics providers.
• Error Monitoring & Logging: Internal systems for tracking application errors, performance issues, and system monitoring. Helps ensure platform reliability and quick issue resolution.

We recommend reviewing the privacy policies of these third-party services. We are not responsible for their privacy practices but ensure contractual protections where applicable. All integrations are designed to minimize data sharing and protect your privacy.

15. MOBILE APP PERMISSIONS AND DISCLOSURES

Our mobile application requests specific permissions to provide core functionality. Here are the permissions we request and why:

App Store Privacy Label Information

Required Permissions

Data Sharing and Tracking

Google Play Data Safety

For Android users downloading from Google Play, here's our Data Safety disclosure:

16. AI PROCESSING AND DATA RETENTION

AI Processing Details

Data Retention Periods

International Data Transfers

Your data may be processed in countries other than your own, including:

• United States: Supabase infrastructure, OpenRouter AI processing, Stripe payment processing
• European Union: Potential data replication and backup locations
• Cloud Infrastructure: AWS, Google Cloud, or other cloud providers used by our service partners

All international transfers are protected by appropriate safeguards, including standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms as required by applicable data protection laws.

17. DATA BREACH NOTIFICATION

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify relevant supervisory authorities within 72 hours of becoming aware of the breach (where required by law).
• Inform affected users without undue delay if the breach is likely to result in high risk to their rights and freedoms.
• Provide clear information about the nature of the breach, potential consequences, and measures taken to address it.
• Offer guidance on steps users can take to protect themselves.
• Implement immediate containment and remediation measures.

If you suspect a security incident involving your account, contact support@flyskylo.com immediately.

18. CHANGES TO THIS PRIVACY POLICY

• Material changes: 30 days notice via app, email, push, or banner.
• Non-material: update date, summary, or changelog.
• Prior versions available on request.
• Continued use = acceptance. You may close your account if you disagree.

We will maintain an archive of previous versions of this Privacy Policy. To request access to previous versions, contact support@flyskylo.com.

19. GOVERNING LAW AND JURISDICTION

This Privacy Policy and any disputes arising from it shall be governed by and construed in accordance with the laws of the jurisdiction where Skylo is incorporated, without regard to conflict of law principles. Any legal action or proceeding arising under this Privacy Policy will be brought exclusively in the courts of competent jurisdiction in that location, and the parties hereby consent to personal jurisdiction and venue therein.

For users in the European Union, this does not affect your rights under local data protection laws or your right to bring proceedings in your local courts.

20. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at: