Privacy policy

Who we are

SKULayer is operated by SKULayer Ltd, a company registered in England and Wales (company number 17333273). You can reach us at hello@skulayer.com. This policy explains what personal data we collect, why, and the rights you have over it under the UK GDPR and the Data Protection Act 2018.

The two hats we wear

For your account, billing, and our website analytics, SKULayer Ltd is the data controller. For the product feed data you connect to the service, we act as a data processor: we process that data on your instructions, to run audits, transformations, and channel delivery on your behalf. If your feeds contain personal data, you are the controller of it.

What we collect and why

• Account data (name, email address, password stored as a salted hash): to create and secure your account and to send essential service email such as email verification and password resets. Lawful basis: performance of a contract.
• Billing data: payments are handled by Stripe. Card details are entered on Stripe's systems and never touch our servers; we store only the subscription state Stripe reports to us (plan, status, billing period). Lawful basis: performance of a contract.
• Feed data (the product data in feeds you connect): processed on your behalf to provide the service. We do not sell it and we do not use it to train AI models. Lawful basis: your instructions under our contract.
• Usage analytics: Google Analytics 4 and PostHog help us understand how the site and product are used. In the UK and EEA, analytics cookies are set only with your consent (see the cookie policy). Cloudflare Web Analytics runs without cookies. Lawful basis: consent for cookie-based analytics; legitimate interests for cookieless measurement.
• Technical logs and error reports: kept to run, secure, and debug the service. Lawful basis: legitimate interests.

Who processes data for us

• Cloudflare: hosting, application database, file storage, and cookieless web analytics. Our storage is provisioned in Cloudflare's Western Europe region; content is served from Cloudflare's global network.
• Stripe: payment processing and billing.
• Resend: transactional email (verification and password reset), sent from EU infrastructure (eu-west-1).
• PostHog: product analytics, hosted in the EU.
• Google: Google Analytics 4, consent-gated.

Where a provider processes data outside the UK or EEA, transfers rely on UK adequacy regulations or standard contractual clauses.

How long we keep things

Account and subscription data are kept while your account is active. Compiled feed artifacts are cleaned up automatically: we keep the artifacts of the three most recent complete runs per feed, and failed run artifacts for 14 days. If you delete your account, we delete your account data and stored feed data, keeping only what we must retain for legal or accounting reasons.

Your rights

You can ask for access to your personal data, correction, deletion, restriction, portability, or object to processing, and you can withdraw consent at any time where consent is the basis. Email hello@skulayer.com and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Changes

If this policy changes in a way that matters, we will say so plainly on this page and update the date at the top.