What we hold, and what we do with it.

1. Who we are

SkySale is provided by GRND Labs LLC, a Florida limited liability company ("GRND Labs", "we", "us"). This policy covers the SkySale app and service, any SkySale mobile app, and this website. Questions about it go to privacy@sky-sale.com, and a person will answer.

2. Our role: two kinds of information

About shops. For the business that holds a SkySale account and the people who run it, we decide how the information is used, and this policy applies directly.

About a shop's customers and staff. Customer and staff records are collected by the shop, and we hold and process them on the shop's behalf and on its instructions. The shop decides what to collect and is responsible for telling its customers and staff how it uses their information. If you are a customer of a shop that uses SkySale, that shop is the right place to start with a question or request about your information; we will help the shop act on it.

3. What we collect

From a shop, when it signs up and uses SkySale

• Account and store details: the email address the shop signs in with, store and company name, address, phone, store email, time zone, tax rate, receipt footer, return policy and pay schedule.
• Staff: each employee's name, PIN, role, commission terms and pay records.
• Sales: what was sold or returned, when, by whom, prices, tax, how it was paid, and the last four digits of a card. We never receive or store full card numbers.
• Products, treatments, availability and bookings.
• Billing: your subscription plan and status. Card details for your SkySale subscription are entered on Stripe's page and held by Stripe, not by us.
• Connections you choose to make: tokens for your Gmail account, and the keys for your payment processor or gateway (Maverick, Payarc, Authorize.Net, NMI — including gateways built on it, such as Easy Pay Direct's — or USAePay), and the settlement and chargeback records we read with them, which can include the last four digits of a card.
• The SkySale app: if you turn on notifications, the push token Apple issues for that device and which notifications you chose. It is used only to send those notifications, and is deleted when Apple tells us it is no longer valid or the account is closed.
• What you send us: questions asked in the help chat, feature requests (with the name you give and your account's email address), and emails to support.

About a shop's customers, recorded by the shop

This information belongs to the shop. The shop decides what to record and how to use it; we hold and process it on the shop's behalf, as its service provider, and only to run SkySale for it. If you are a customer of a shop, ask that shop about your information — and we'll help them answer.

• Name, email address, phone number, and, if the shop records them, address, birthday and notes. Notes are free text written by the shop's staff; we ask shops not to use them for health or other sensitive information unless they need it and have the customer's consent.
• What they bought or returned and when, the employees who served them, bookings, and the emails the shop sent them.

Automatically

• Cookies and similar storage that keep you signed in (a session cookie lasting up to 30 days, and a signed cookie that remembers which shop you signed in to for up to a year, until you sign out) and remember preferences such as the company you last used. We use no advertising or analytics cookies, and this website loads no trackers.
• Server logs kept by our hosting providers — such as IP address, browser and the pages requested — used for security and troubleshooting.

4. How we use it

• To provide SkySale: ring up and record sales, work out commission and payroll, keep customer records, send the emails the shop asks us to send, take bookings and reconcile against the shop's processor.
• To sign you in, bill the subscription, and send service messages — sign-in links, billing notices, and warnings such as the notice before a cancelled shop's data is deleted.
• To answer help questions and support requests, and to consider feature requests.
• To keep SkySale secure, prevent abuse, fix problems and improve how it works.
• To meet legal obligations and enforce our terms.

We do not sell personal information, we do not share it for cross-context behavioural advertising, we do not show ads, and we do not use one shop's data to serve another.

5. AI features

Some features send information to Anthropic, whose Claude models generate text for us:

• Help chat: the questions you type and the conversation so far.
• Product set-up: the text of a supplier web page you ask us to read, and a product's name, brand and description, to write descriptions and usage notes.
• Welcome email review: the shop's own products' names, brands, descriptions, benefits and usage notes, to suggest clearer wording.

We send only what the feature needs. Anthropic processes it to return a response to us under its commercial terms, which do not permit it to train its models on this data. We do not use your data to train AI models.

6. Gmail and Google user data

A shop can connect its own Gmail account so customer emails come from its own address. If it does, SkySale asks Google for permission to see the account's email address and basic profile, and to send email from that mailbox. We use it only to send the emails the shop asks us to send — receipts, welcome emails, mass email, booking messages and staff alerts. SkySale does not read, search or organise the mailbox.

SkySale's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, do not sell it, and do not allow humans to read it except with the shop's permission, for security or abuse investigations, or where the law requires. We do not use Google user data to develop, improve or train artificial intelligence or machine-learning models, and it is never sent to the AI features described above. A shop can disconnect Gmail at any time from its Google account settings; closing the SkySale account deletes the tokens we hold.

7. Who else handles it

We use these service providers to run SkySale. Each handles information only to provide its service to us:

Provider	What for
Railway	Hosting the SkySale app and its database
Netlify	Hosting this website
Stripe	Subscription billing, payment details and tax
Resend	Delivering sign-in links and other email we send
Anthropic	The AI features described in Section 5
Google	Gmail, only if a shop connects it
Maverick Payments, Payarc, Authorize.Net, NMI and gateways built on it, USAePay	Reading settlement and chargeback records, only if a shop connects its processor or gateway
Apple	Delivering push notifications to the SkySale app, and the App Store
Mobile carriers	Delivering sale and audit alerts to the phone numbers a shop adds

We may also disclose information when the law requires it, to protect the rights, safety or property of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to it.

8. How long we keep it

• While the account is active — including while a shop is asleep — we keep its information so it can use SkySale.
• After cancelling: the shop keeps working to the end of the period it paid for. Thirty (30) days after the subscription ends, the account and everything in it are deleted, including its customers' and staff's records. We email the shop at least seven days before, and never delete sooner than seven days after that email.
• Closing the account in Settings → Account deletes it and everything in it immediately.
• Once deleted, information is removed from our database and cannot be restored by us. Stripe keeps billing records as the law requires, and hosting providers' logs expire on their own schedules.
• Help chat questions are not stored with your account; feature requests are kept in the email inbox they are sent to.

9. Security

Signing in uses a one-time link sent to the shop's own address, so there is no password to reuse or leak. Money screens are behind each employee's PIN, and sensitive actions need a manager's code. Traffic is encrypted in transit. Mailbox (Gmail) tokens and card-processor and gateway keys are encrypted at rest, with a key kept separately from the database, and are never shown back. No system is perfectly secure; if you find a problem, write to security@sky-sale.com. If a breach affects your information, we will tell you as the law requires.

10. Your choices and rights

A shop can see, correct and export its records in the app at any time, and can delete them by closing the account. Anyone can ask us to access, correct, delete or get a copy of personal information we hold about them, or ask a question about how we use it, by writing to privacy@sky-sale.com. Depending on where you live, you may have further rights under local law, and we will honour them as that law requires; we will not treat you differently for using them. We may need to confirm your identity first. If your information is held for a shop, we will pass your request to that shop and help it respond.

11. Children

SkySale is for businesses and is not directed to children. Shop accounts must be held by adults. We do not knowingly collect personal information from children under 13; if you believe we have, contact us and we will delete it.

12. Where information is kept

SkySale is operated from the United States, and information is stored and processed in the United States. If you use it from elsewhere, you understand your information will be transferred there.

13. Changes to this policy

We will post any change here and update the date at the top. If a change is material, we will also tell shops before it takes effect — with a notice in SkySale, by email to the address the shop signs in with, or both.

14. Contact

GRND Labs LLC · privacy@sky-sale.com for your data, security@sky-sale.com for security, support@sky-sale.com for anything else.