Privacy Policy

01 Information We Collect

Information you provide directly

• Account information. Name, email address, password (stored as a one-way hash), and workspace name.
• Billing information. Processed entirely by Stripe — we never see or store full card numbers. We retain only the last four digits and card brand for display.
• Client data. Information you add about your clients: business names, domains, NAP details, Google Search Console properties, and similar data.
• Content. Briefs, reports, drafts, comments, tasks, and other content you create inside the Service.
• Communications. Support requests, feedback, and survey responses.

Information collected automatically

• Usage data. Which features you use, when, and how frequently — used to improve the Service.
• Device data. Browser type, operating system, IP address, and screen resolution — used for compatibility and security.
• Session cookies. Required for authentication and CSRF protection. We do not use advertising or third-party tracking cookies.

Information from integrations

When you connect Google Search Console, Google Analytics, Google Business Profile, Ahrefs, SEMrush, or other third-party services, we access only the data necessary to power the corresponding features. OAuth tokens are encrypted at rest. We do not share data between integrations except as required to display features within the Service.

02 How We Use Information

• To provide, maintain, and improve the Service
• To process payments and manage subscriptions via Stripe
• To send service-related communications (account confirmations, billing receipts, security alerts)
• To respond to support requests and inquiries
• To monitor usage patterns and prevent abuse or fraud
• To comply with applicable legal obligations
• To send product updates and marketing emails — you may opt out at any time via the unsubscribe link or by emailing us

03 AI Processing

Some features call third-party AI providers (Anthropic Claude and others). When you use these features, the relevant content (e.g., a content brief prompt) is transmitted to the provider under their enterprise terms.

04 How We Share Information

We do not sell your personal information. We share data only in the following limited circumstances:

• Service providers. Cloud hosting (AWS via Laravel Forge), transactional email (SendGrid / Postmark), payment processing (Stripe), error monitoring (Sentry), AI processing (Anthropic), and SERP data (SerpAPI). Each operates under a written contract restricting use of your data solely to providing services to us.
• Workspace members. Data inside a workspace is visible to all members of that workspace. You control who you invite.
• Legal requirements. Where required by law, subpoena, or court order. We will notify you of any such requests where legally permitted and will challenge overbroad demands.
• Business transfers. In the event of a merger, acquisition, or sale of assets, your data may transfer to the successor entity under terms at least as protective as this policy.

We do not share data across separate workspaces. Multi-tenancy is enforced at the database level — every record is tagged with a workspace ID and Eloquent global scopes prevent any cross-workspace data access.

05 Data Retention

Active accounts. Personal information is retained for the life of your account.

Cancelled accounts. Workspace data is retained in a read-only state for 30 days after cancellation, then permanently deleted. You may export all data via CSV at any time during this window. To request immediate deletion, email support@skyvistaconsulting.com.

Billing records and audit logs. Retained for 7 years to meet legal, tax, and accounting obligations under US federal and state law.

06 Your Rights

Depending on your state of residence, you may have the following rights regarding your personal information:

• Right to Know / Access. Request a copy of the personal information we hold about you and how we process it.
• Right to Correct. Request that we correct inaccurate personal information we maintain about you.
• Right to Delete. Request deletion of your personal information, subject to certain legal exceptions (e.g., completing a transaction, fraud prevention, legal obligation).
• Right to Data Portability. Receive a copy of your personal data in a portable, machine-readable format (CSV).
• Right to Opt-Out of Sale or Sharing. We do not sell or share personal information — see Section 9.
• Right to Non-Discrimination. We will not deny services, charge different prices, or provide a lesser quality of service because you exercised any privacy right.
• Right to Withdraw Marketing Consent. Opt out of marketing communications at any time via the unsubscribe link or by emailing us.

To exercise any of these rights, email privacy@skyvistaconsulting.com. We will verify your identity and respond within 45 days, extendable to 90 days for complex requests with written notice.

07 California Residents — CCPA/CPRA

If you are a California resident, you have additional rights under the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA), enforceable as of January 1, 2023.

Categories of personal information we collect

• Identifiers: Name, email address, IP address, account credentials
• Commercial information: Subscription plan, billing records, transaction history
• Internet / electronic network activity: Usage data, browser type, feature interaction logs
• Professional information: Company name and job role (when voluntarily provided)

We do not collect sensitive personal information beyond what is necessary to provide the Service. We do not build consumer profiles or make automated inferences for non-service purposes.

Business purposes for collection

We collect personal information to provide and improve the Service, process payments, communicate with users, and comply with legal obligations — as described in Section 2. We do not use personal information for cross-context behavioral advertising.

Third parties with whom we share

We share data only with service providers (Section 4) under contracts that prohibit use beyond providing services to us. We do not sell personal information or disclose it to third parties for their independent commercial purposes.

Your CCPA/CPRA rights

• Right to Know (Categories & Specific Pieces): Request a detailed report of the categories and specific pieces of personal information collected about you in the past 12 months.
• Right to Delete: Request deletion of personal information we have collected from you, subject to legal exceptions.
• Right to Correct: Request correction of inaccurate personal information we maintain.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary to provide the Service.
• Right to Non-Discrimination: We will not deny, degrade, or price-discriminate against you for exercising your CCPA/CPRA rights.

To submit a CCPA/CPRA request, email privacy@skyvistaconsulting.com with "CCPA Request" in the subject line. We will verify your identity before processing and respond within 45 days (extendable to 90 days with written notice).

08 Nevada Residents

Under Nevada Revised Statutes Chapter 603A (Nevada SB 220, effective October 1, 2019), Nevada residents have the right to opt out of the sale of certain covered information to third parties. We do not sell covered information as defined under Nevada law. To submit an opt-out request or ask questions about your Nevada privacy rights, email privacy@skyvistaconsulting.com.

09 Do Not Sell or Share My Personal Information

Sky Vista Consulting does not sell, rent, auction, or trade personal information to or with third parties for their own marketing, advertising, or commercial purposes.

We share data only with service providers (Section 4) under contracts that restrict them from using your data for any purpose other than performing services for us.

This commitment applies to all users regardless of state of residence, including residents of California (CCPA/CPRA), Nevada (NRS 603A), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and all other US states with applicable privacy laws.

10 Security

We implement industry-standard technical and organizational measures to protect your personal information:

• TLS encryption for all data in transit
• AES-256 encryption at rest for sensitive fields (API keys, OAuth tokens, 2FA secrets, recovery codes)
• Per-workspace data isolation enforced at the database query level
• Two-factor authentication (TOTP) available and enforceable for all accounts
• Brute-force rate limiting and session security controls
• Regular security audits and dependency updates

See our Security page for full technical detail. In the event of a data breach affecting your personal information, we will notify you and relevant authorities as required by applicable US state breach notification laws.

11 International Transfers

The Service is hosted in the United States. If you access it from outside the US, your personal information will be transferred to and processed in the US. For EU or UK customers, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission (Commission Implementing Decision 2021/914) for cross-border data transfers. See our Data Processing Addendum for terms applicable to EU/UK customers.

12 Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18, consistent with the Children's Online Privacy Protection Act (COPPA). If we learn that we have inadvertently collected such information, we will delete it promptly. If you believe we have collected information from a minor, contact us at privacy@skyvistaconsulting.com.

13 Cookies & Tracking

We use essential cookies only — session cookies required for authentication and CSRF protection. We do not use advertising trackers, retargeting pixels, or third-party behavioral analytics on the application side of the Service. Our public marketing pages may use minimal, privacy-preserving page-view analytics. We do not engage in cross-site tracking or behavioral advertising.

14 Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and an in-app banner at least 30 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

15 Contact

Questions about this Privacy Policy, your personal data, or to submit a privacy rights request:

• Privacy requests: privacy@skyvistaconsulting.com
• General inquiries: hello@skyvistaconsulting.com
• Phone: +1 702-763-2606
• Mailing address: Sky Vista Consulting, Las Vegas, Nevada, USA