Privacy Policy

This policy explains how SPECIAL OPTION, LDA (brand SkyFirstLabs) processes personal data on the Sky platform (web), in the Sky by SkyFirstLabs mobile app (iOS and Android) and on the skyfirstlabs.com website, in accordance with the General Data Protection Regulation (GDPR).

1. Who we are

We have not appointed a Data Protection Officer (DPO), because the company does not meet the criteria in Article 37 GDPR. Privacy matters are handled by the management through the contact above.

2. Controller or processor: who decides about your data

Sky is a business platform. There is no public sign-up. Accounts are created by the organisation that subscribes to Sky (the "Customer"), usually your employer.

• Data the Customer brings into Sky. This includes questions and answers, chats, attached documents, agents, pages and the results of queries to the Customer's databases. For this data, the Customer is the controller and SkyFirstLabs is a processor (Article 28 GDPR). We process it only to provide the service, on the Customer's instructions and under the Data Processing Agreement (DPA) signed with them. To exercise rights over this data, you should first contact your administrator or your organisation. If you write to us, we forward the request to the Customer and help them respond.
• Data we process to manage and protect the service. This includes the account (name, email, role), security logs, notification tokens, support and billing to the Customer. For this data, SkyFirstLabs is the controller, and this policy applies directly to it.
• Website and business contacts. For website and business contact data, we are the controller (section 9).

3. What data we process and why

3.1 Account and access

Your password is never stored in plain text: we store only a hash. When you sign in with Google, Microsoft or Okta, we receive from that provider your email, your name and, if there is one, your profile photo. The identity provider is chosen by your organisation.

3.2 Security and technical logs

The technical logs of the AI component do not store the values of Customer data: values are replaced by their length and SQL literals by "?".

3.3 Content you create in Sky (processed on behalf of the Customer)

• Questions, answers and chats. This includes those made by voice, which are stored as text (section 4).
• Documents attached to a question. In the chat, we extract the text of the document (up to 10 MB per file) and store only that text, in order to answer questions about it. We do not store the original file.
• Knowledge Library. The text extracted from documents the organisation uploads is stored, split into passages for search, in the Customer's database. We do not use object storage services (such as Amazon S3). It is kept for as long as the organisation keeps it and is deleted when the document is deleted.
• Agents, findings, pages, widgets, comments and reactions, created by you or your colleagues.
• Support requests (subject, description, category, platform) and reports of AI answers (section 6).

3.4 Data from the Customer's databases

Sky connects to the data sources the Customer authorises (for example, PostgreSQL or BigQuery) and queries them live, at the time of the question.

• We do not store the rows of Customer data. Charts and widgets re-run the query when they are opened. Results may be held in temporary memory for up to 10 minutes, to avoid repeated queries.
• We store the schema of the sources (table and column names and the descriptions the Customer adds), so that the AI knows where to look.
• To speed up repeated questions, we store the question, the text of the answer and the SQL query for up to 30 days. After that period, they are no longer used and are deleted. The text of the answer may contain figures mentioned in the answer.
• An audit log of queries, stored in the Customer's dedicated database, records the question, the SQL query executed, the number of rows and the first 500 characters of the answer. This log is kept for 12 months.
• Credentials for accessing the sources are stored encrypted.

3.5 Device and notifications (mobile app)

The app does not collect your location, contacts, advertising identifier or the list of other installed apps. It also does not include third-party usage analytics, advertising or crash reporting tools.

On the device, the app stores session tokens in the system's secure storage (Keychain or Keystore) and your preferences. It does not store chats on disk. If you enable biometric unlock (Face ID or fingerprint), the check is carried out by the operating system: no biometric data leaves the device or reaches us.

3.6 Billing and contractual relationship with the Customer

To invoice the Customer, we process data about the organisation and its contact persons (name, email, telephone, billing address). The legal basis is Article 6(1)(b) and (c) GDPR, including tax and accounting obligations.

4. Voice

Voice mode and dictation only work when you turn them on. The system asks for microphone permission the first time you use them.

• While you speak, the audio is streamed in real time, over an encrypted connection, to our servers. From there it goes to Amazon Web Services: Amazon Nova Sonic (Amazon Bedrock, EU Stockholm region), for the voice conversation, and Amazon Transcribe (EU Ireland region), for transcription and captions. Spoken answers are generated by Nova Sonic itself or by Amazon Polly (Ireland).
• We do not store the audio. It is not recorded to disk, to object storage or to logs.
• We store the transcript (the text of what you said and what Sky answered) as chat messages. The transcript follows the content retention rules (section 10).
• On the device, the audio of the answers is held in temporary files in the app's cache, which are reused and overwritten.
• At the root of our AWS organisation, the AWS AI services opt-out policy is active. Content processed by these services, including audio and transcripts, is not used by AWS to improve or train its services.

5. Artificial intelligence

• Questions and the necessary context are processed by language models hosted on Amazon Bedrock, in the European Union. We use open-weight models (for example, gpt-oss and Qwen) in the Ireland region and Claude models, from Anthropic, through Bedrock's European inference profiles. These profiles may process the request in another EU region (Ireland, Paris, Frankfurt or Stockholm), without leaving the EU.
• We do not keep logs of questions in Bedrock. Model invocation logging is switched off in the Ireland (eu-west-1) and Stockholm (eu-north-1) regions.
• The model providers (for example, Anthropic) do not have access to the questions or the answers, because the models run in accounts operated by AWS.
• Your data is not used to train models, either by us or by AWS. The AI services opt-out policy is active at the root of our AWS organisation.
• AWS may retain requests temporarily for abuse detection, under the terms of the Amazon Bedrock service.
• Vector representations (embeddings) are computed within our own infrastructure, without sending data to third parties.
• Answers are generated automatically and may contain errors. Check the information before making important decisions. Sky does not take decisions that produce legal effects concerning you, or that similarly significantly affect you (Article 22 GDPR).
• We do not send questions or answers to external AI observability services. If we ever do, the values of Customer data are masked before sending and the service is added to the list of sub-processors.

6. Reporting AI answers

On each Sky answer and on each agent finding you can tap Report to flag offensive, inappropriate, wrong or misleading content. The report stores your user identifier, a copy of the reported content (because the answer may be deleted later), the reason and the optional comment you write (up to 2,000 characters). It is kept in the Customer's dedicated database. We use these reports to fix defects and prevent abuse, on the basis of Article 6(1)(f) GDPR.

7. Who we share data with

We do not sell personal data or use it for advertising. We use only the processors needed to provide the service, all under a data processing agreement:

• Identity providers. Google, Microsoft and Okta only receive sign-in requests when your organisation chooses them as an authentication method. In that case, they act under the relationship your organisation has with them.
• Notification content. We only send push notifications for agent findings, mentions and project invitations. Each notification carries a title (for example, “Sales: something changed in your data” or “Ana invited you to ‘Operations’”), a short text with the notification's description, which may include a summary of the finding or the mention, and internal identifiers so the app opens the right screen. It passes through Expo and through Apple's or Google's services on its way to the device.
• Access by the SkyFirstLabs team. To provide support, our team may temporarily access a user's account (for a maximum of 60 minutes per session). Each access is recorded in the audit log. Only our authorised team has access, when necessary.
• Authorities. We may disclose data where required by law.

The up-to-date list is at skyfirstlabs.com/legal/sub-processors.

8. International transfers

Platform data is hosted in the European Union. There are transfers outside the European Economic Area in the case of Expo, Apple and Google (notifications) and some website providers. 650 Industries (Expo) states in its privacy policy that it is certified under the EU-U.S. Data Privacy Framework. In the other cases, we rely on that Framework where the recipient is certified and, where it is not, on the appropriate safeguards provided for in Article 46 GDPR, including the European Commission's Standard Contractual Clauses. You can request a copy of the safeguards through the privacy contact.

9. Website and business contacts

When you visit skyfirstlabs.com or contact us, we process:

• Contact form and bookings: name, work email, company, job title and message. These are used to reply and prepare proposals (Article 6(1)(b) GDPR).
• B2B prospecting: name, work email, job title, company and public LinkedIn data. Each email includes a simple way to object (Article 6(1)(f) GDPR).
• Website statistics: pseudonymous identifiers, pages, country and device type. Only with your consent in the cookie notice (Article 6(1)(a) GDPR). Details in the Cookie Policy.
• Public demo: email, name, company and job title of the person requesting access. Demo session data is deleted after 7 days.

Website providers: Vercel Inc. (hosting and Vercel Analytics, USA), Google (Google Analytics 4, only with consent) and Resend, Inc. (delivery of contact form submissions, USA). On the public demo: Cloudflare, Inc. (Turnstile bot protection), Resend, Inc. (demo emails) and Slack Technologies (internal alert of new requests). Business tools (CRM, prospecting and meeting scheduling) are listed on the sub-processors page.

10. How long we keep data

11. Security

• Encrypted connections (HTTPS/TLS and WSS) between the app, the browser and our servers.
• Database and cache encrypted at rest.
• Data source credentials and two-factor secrets encrypted at application level.
• Each Customer has a dedicated database.
• Infrastructure on a private network, with restricted and logged access.
• Two-factor authentication available.
• Periodic review of access and of providers.

In the event of a personal data breach, we notify the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, and, where necessary, the affected individuals, in accordance with Articles 33 and 34 GDPR. Where the data belongs to the Customer, we inform the Customer without undue delay.

12. Your rights

Under Articles 15 to 22 GDPR, you have the right of access, rectification, erasure, restriction, portability and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time.

• For account and security data (where we are the controller): write to info@skyfirstlabs.com, from your account email address.
• For your organisation's content (where the Customer is the controller): speak to your administrator. If you write to us, we forward the request to the Customer.
• Account deletion: the account is created and removed by your organisation. See Account and data deletion.

We respond within one month, extendable by a further two months for complex requests. We may ask you to confirm your identity.

You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, at www.cnpd.pt, or with the supervisory authority of the country where you live or work.

13. Children

Sky is intended for professional users. We do not knowingly collect data from children under 16.

14. Changes

When the processing changes, we update this policy and the date at the top. If the change is material, we notify Customers in advance and, where possible, also within the app.