Trust
Security and data handling
A product feed contains live commercial data. This page explains where SKULayer stores it, how customer workspaces stay separate, and what authority people and connected AI clients receive. Everything here describes the shipped product, not a roadmap.
Where your data lives
SKULayer runs on Cloudflare. Application storage is provisioned in Western Europe and content is delivered through Cloudflare's network. Stripe handles card details on its own checkout pages; card data does not pass through SKULayer.
Isolation between customers
Every workspace is structurally isolated, so one customer reading or affecting another's data is prevented by construction rather than by policy. Agency workspaces add a second layer: each client's feeds, rules, runs, and delivery URLs are separated within the workspace.
Credentials and connections
Connecting Google Merchant Center uses the standard Google OAuth flow. Refresh tokens are encrypted at rest, revoked with Google when you disconnect, and deleted from storage.
AI agent access is scoped, previewed, and revocable
AI connections start with the scope you approve, over OAuth or scoped API tokens. Read-only access cannot change data. Write access is a separate grant. Rule changes return an impact preview, actions land in the same activity log as human ones, access can be revoked from the account page, and optional email notifications report every agent change.
Changes are reversible
Every version of a rule is restorable, and you can roll delivery back to any version that ran cleanly. Your live feed only changes when a new version passes every check.
Retention and deletion
Working files from earlier runs are tidied up automatically, so only what the service needs is kept. Deleting your account removes your data.
What we never do with your data
Feed data is processed to provide the service: audits, transformations, delivery. It is not sold, not shared with other customers, not used for cross-customer benchmarking, and not used to train AI models. SKULayer Ltd is an independent software company with no agency services arm and no interest in your accounts beyond serving them.
Third parties we rely on
A short list, and each one processes only what its job requires: cloud hosting and storage, payments, transactional email, the Google APIs you authorise, plus product analytics and error reporting. The current list is named in the privacy policy.
The legal detail lives in the privacy policy and terms. Security questions, or something you believe we should fix: hello@skulayer.com is a monitored inbox, and reports get a human reply.