Data processing
How SkySuite processes personal data on behalf of customers, who our sub-processors are, and how long we keep things. Summarised from the Information Security Policy and the Data Retention and Disposal Policy adopted by Vista UAV LLC on 2026-08-30.
Roles
Where a business customer submits personal data about their own clients or staff to SkySuite, that customer is the data controller and Vista UAV LLC is the processor acting on their instructions. Our sub-processors are listed below.
Processing scope
Lead, contact, job, telemetry, deliverable, and billing data submitted to SkySuite by the customer, plus the account and profile data of the customer's own users. Integrations request only the scopes the product actually uses.
Sub-processors
Stripe (payments), Postmark (transactional email), Plaid (bank connectivity), Cloudflare (CDN and TLS), Cloudflare R2 (object storage), and RunPod (GPU compute, which receives no customer personal data). Payment card data is never stored on our systems and bank credentials are never seen by them. This list is maintained in our Information Security Policy and updated when a vendor changes.
Retention
Account and profile data, operational content (projects, missions, deliverables, messages), and any financial data received via Plaid are retained for the life of the account — or, for a linked bank account, until the customer disconnects it. Application and access logs age out on system journal rotation. Database backups age out on their rotation schedule. Our own billing, tax, and legal records are kept as long as applicable law requires.
Deletion
Deletion is self-serve and takes effect immediately in production. An automated account-deletion engine performs hard deletes across every platform service and revokes connected third-party access — a Plaid item is removed at Plaid so no further data is received. Deleted data is not purged from historical backups mid-cycle; backups expire on their rotation schedule and are used only for disaster recovery, and if a restore occurs the deletions are re-applied. Data under a litigation hold or statutory retention duty is kept until that obligation lapses.
Location and transfers
Vista UAV LLC is a United States company and our retention and privacy practices are designed for a United States customer base. We have not executed Standard Contractual Clauses for EU or UK personal data. If your organisation needs a signed data processing agreement or a specific transfer mechanism, write to [email protected] and we will tell you honestly whether we can meet it today.