Privacy

Privacy policy

Effective Date: October 18, 2026

Sky Suite ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the Sky Suite platform, websites, and services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information You Provide

Account Information: Name, email address, phone number, company name, and password when you create an account.
Profile Information: Business details, certifications (e.g., FAA Part 107), service areas, profile photos, and equipment information.
Payment Information: Billing address and payment method details. Payment card numbers are processed and stored by our payment processors and are never stored on our servers.
Client and Contact Data: Information about your clients and contacts that you enter into the CRM, including names, addresses, phone numbers, and email addresses.
Uploaded Content: Files, images, documents, survey data, deliverables, and other content you upload to the Service.
Communications: Messages sent through the platform, support tickets, and feedback you provide.

1.2 Information Collected Automatically

Usage Data: Pages visited, features used, actions taken, timestamps, and session duration.
Device Information: Browser type, operating system, device type, and screen resolution.
GPS and Location Data: If you enable location services, we may collect your device's GPS coordinates for features such as weather lookups, airspace checks, and service area mapping. Location data is only collected when you actively use location-dependent features.
IP Address: Your IP address is collected for security, rate limiting, and general analytics purposes.
Cookies and Similar Technologies: See Section 7 below.

1.3 Information from Third Parties

Payment Processors: Transaction confirmation details from our payment processors.
Public Data Sources: Business information from publicly available sources used to assist with lead generation and marketplace features, only when you actively use those features.

Google user data

Connecting Google is optional.

Sign in with Google: If you sign in with Google we receive your name, email address, profile photo link and Google account ID, whether Google has verified your email address and, for a Google Workspace account, your organization's domain. We use them only to create and sign you in to your SkySuite account. We do not keep the profile photo link, and we keep the Workspace domain only in our sign-in security log.
Google Calendar: If you connect Google Calendar, SkySuite asks to see, create, change and delete events only on Google calendars you own, and in practice uses only your primary calendar. We read event titles, descriptions, times, time zones and locations, and write events you create in SkySuite.
What we store: Encrypted access tokens, the email address of the Google account you connected, and a copy of the events on your primary calendar from up to the past 12 months and the next 12 months, so that they show in your SkySuite calendar and stay in sync. Events are updated every few minutes while connected, and copies of events that ended more than 12 months ago are deleted.
Only you see them: Your copied Google events are visible only to you. Other members of your SkySuite organization do not see them. Like your other calendar events, they still mark those times as busy when SkySuite works out when you are available (for example on booking pages), without showing what they are.
Disconnecting: Revokes SkySuite's access at Google, deletes the stored tokens, and deletes the copied Google events from SkySuite. Events SkySuite created in your Google Calendar stay there until you delete them.
No AI, no ads, no sale: Google user data is never sent to any artificial-intelligence model or AI provider, never used to train AI models, never sold, and never used for advertising. People at SkySuite do not read it except with your permission for support, for security, or when the law requires.

SkySuite's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

SkySuite Social (Office › Marketing › Social videos) is a separate, optional feature that lets you create short feature videos inside SkySuite and, if you connect your YouTube channel, post them directly to YouTube once you approve them. Connecting YouTube is optional and uses a separate Google app ("SkySuite Social") from the Google sign-in and Calendar features described above.

What we ask for: one permission only: to upload videos to the YouTube channel you choose (the youtube.upload scope). We do not ask for your Google account email, your profile or any other YouTube permission.
What we store: an encrypted OAuth access token and refresh token, so that SkySuite can upload the videos you approve on your behalf; the date you connected; and a record of each video SkySuite posted on your behalf (its YouTube video ID and link, title, caption, privacy setting, the time it was posted, and whether it succeeded). We do not store your Google account email or your YouTube channel name. If you connect more than one channel, each is a separate connection with its own token, and the name SkySuite shows for it is the one you type in SkySuite.
Why: solely to upload the specific videos you create and approve inside SkySuite Social to your own YouTube channel, and to show you the result (success, failure, or a link to the video) inside SkySuite Social.
What we never do: SkySuite never uploads a video to YouTube without your explicit approval of that specific video, and only uploads it to the channel you connected. SkySuite does not read, change or delete anything on your YouTube: not your other videos, comments, subscribers, playlists or analytics. YouTube/Google user data from this feature is never sold, never used for advertising, and never sent to any AI model or AI provider.
Revoking access: Press Disconnect at Office › Marketing › Social videos › Connections. SkySuite asks Google to revoke its token, then deletes the connection record, including both tokens. Pressing Reconnect does the same first, before Google's screen opens. If Google cannot be reached at that moment, SkySuite still deletes its copy; you can also revoke access directly from your Google account at security.google.com/settings/security/permissions at any time.
Retention: The connection record and token are deleted immediately on disconnect. If you don't disconnect yourself first, we delete them within 30 days of a verifiable request at [email protected] (45 days if we need an extension, with notice to you) — the same commitment in Section 5 below, which also applies to a deletion request made through the Data deletion page. That request also deletes the rendered social videos SkySuite created for you.

SkySuite's use and transfer of information received from YouTube APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Privacy Policy. Using the YouTube posting feature also means you agree to the YouTube Terms of Service — see the Terms of Service page.

If you connect a Facebook Page in SkySuite Social, SkySuite can post the feature videos you create and approve to that Page as Reels. Connecting a Page is optional.

What we ask for: permission to see the Facebook Pages you manage (pages_show_list), to read basic engagement on the Page for diagnostics (pages_read_engagement), and to publish posts to the Page you choose (pages_manage_posts).
What we store: encrypted OAuth access tokens for the connected Facebook account and Page, the name of the Facebook login you connected with, and the list of Pages you shared with SkySuite that you can post to (each Page's ID and name), including the Page you connected.
Why: solely to post the specific videos you create and approve inside SkySuite Social to the Page you connected.
Session length: Facebook logins last about 60 days. SkySuite shows a warning on the Connections page 7 days before yours ends, so you can press Reconnect.
What we never do: this data is never sold, never used for advertising, and never sent to any AI model or AI provider.
Revoking access: Press Disconnect at Office › Marketing › Social videos › Connections, which immediately revokes SkySuite's access at Facebook and deletes the stored token. If you connected several Pages through the same Facebook login, disconnecting one Page deletes that Page's token, and SkySuite's access at Facebook is revoked when you disconnect the last one. You can also remove the SkySuite Social app yourself in Facebook, under Settings & Privacy › Settings › Apps and Websites.
Retention: The connection record and token are deleted immediately on disconnect. If you don't disconnect yourself first, we delete them within 30 days of a verifiable request at [email protected] (45 days if we need an extension, with notice to you) — the same commitment in Section 5 below, which also applies to a deletion request made through the Data deletion page. That request also deletes the rendered social videos SkySuite created for you.

This feature is governed by Meta's Platform Terms and Data Policy in addition to this Privacy Policy.

AI features

Some optional features use AI: drafting outreach emails and call scripts, the AI phone receptionist that answers calls, summarising weather, writing site-survey reports, the in-app assistant Sky, the blog writer, and processing drone imagery. These send only the information needed for that feature (for example your CRM contact notes, what a caller says to the AI receptionist, or a topic you type) to these providers:

AI service providers that help power features such as the assistant, the AI receptionist and writing tools;
cloud computing providers that process drone imagery;
AI models we run ourselves on infrastructure operated by our hosting partners.

Where an AI service provider receives personal data, we use its business API service, which does not use our data to train its models by default. The blog writer sends only public blog topics and no personal data. Google user data is never sent to any of them.

2. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the Service.
Process payments and manage your subscription.
Send transactional communications (account confirmations, invoices, password resets).
Provide customer support and respond to your inquiries.
Improve and develop new features based on usage patterns.
Detect, prevent, and address security threats and fraud.
Enforce our Terms of Service and comply with legal obligations.
Send optional marketing communications (with your consent; you may opt out at any time — every marketing email contains an unsubscribe link that works in one click, with no login).

We do not use your data to build advertising profiles. We do not sell your personal information.

3. How We Share Your Information

We may share your information only in the following circumstances:

Recipient	Purpose	Data Shared
Payment processors	Payment processing	Billing details, transaction amounts
Email Service Providers	Transactional and marketing emails	Email address, name
Cloud Infrastructure	Hosting and data storage	All data (encrypted at rest)
AI and cloud computing providers (including AI models we run ourselves)	Optional AI features you use	Only the content a feature needs (e.g., CRM contact notes, a topic you type). Never Google user data.
Marketplace Participants	Job referrals (only with your consent)	Business name, service area, contact info

We may also disclose information when required by law, such as in response to a valid subpoena, court order, or government request.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. Data Retention and Deletion

We retain your personal information for as long as your account is active or as needed to provide the Service. Specific retention periods include:

Account Data: Retained while your account is active and for 90 days after account deletion to allow for reactivation.
Uploaded Files and Content: Retained while your account is active. Deleted within 30 days of account deletion unless required for legal compliance.
Payment Records: Retained for 7 years as required by tax and financial regulations.
Usage Data: We keep information about how the Service is used, and use it to improve SkySuite for everyone.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Right to Access: Request a copy of the personal information we hold about you.
Right to Correction: Request correction of inaccurate personal information.
Right to Deletion: Request deletion of your personal information, subject to legal retention requirements.
Right to Portability: Request your data in a structured, machine-readable format.
Right to Opt Out: Opt out of marketing communications at any time.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at [email protected]. We will respond to verifiable requests within 30 days (or 45 days if an extension is needed, with notice).

California Residents (CCPA): We do not sell personal information as defined by the California Consumer Privacy Act. You have the right to know what personal information we collect and how it is used, and to request deletion of your data.

EU/EEA Residents (GDPR): Our legal basis for processing your data includes contract performance, legitimate interest, and consent. You have the right to lodge a complaint with your local data protection authority.

6. Data Security

We take the security of your data seriously and implement industry-standard measures to protect it, including:

Encryption of data in transit (TLS 1.2+) and at rest.
Secure password hashing using bcrypt/scrypt algorithms.
Regular security audits and vulnerability assessments.
Role-based access controls and least-privilege principles.
Rate limiting and brute-force protection on authentication endpoints.
Automated backups with encrypted storage.

While we implement robust security measures, no system is completely secure. We cannot guarantee the absolute security of your information. If we become aware of a data breach affecting your personal information, we will notify you and applicable authorities as required by law.

7. Cookies and Tracking Technologies

We use the following cookies and similar technologies:

Essential Cookies: Required for authentication, session management, and security. These cannot be disabled.
Functional Cookies: Store your preferences (e.g., theme settings, language).
Analytics Cookies: Help us understand usage patterns to improve the Service. These are first-party only and do not track you across other websites.

We do not use third-party advertising cookies or cross-site tracking pixels. We do not participate in ad networks.

8. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal information, we will promptly delete it. If you believe a child has provided us with personal information, please contact us at [email protected].

9. International Data Transfers

Our servers are located in the United States. If you are accessing the Service from outside the United States, your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to such transfers. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy.

10. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a prominent notice on the Service at least 30 days before the changes take effect. The "Effective Date" at the top of this page indicates when this policy was last updated.

12. SMS / Text Messaging

If you provide your mobile phone number and opt in, SkySuite (operated by Vista UAV) may send you SMS text messages related to your account and new chat messages. Opting in is entirely optional and is never a condition of using the Service.

How we use your number: a mobile number you provide for SMS is used solely to deliver the account and chat notifications you opted in to receive. Message frequency varies, and message and data rates may apply.
No sharing for marketing: your mobile opt-in data and phone number are not sold, rented, or shared with any third parties or affiliates for marketing or promotional purposes. We share your number only with the messaging carrier/provider strictly as needed to transmit the messages you requested.
Opting out of text messages: reply STOP to any SMS text message from us to unsubscribe from texts at any time, or turn off SMS notifications in your account settings. Reply HELP to a text for help. Replying STOP works for text messages only; to stop marketing emails, use the unsubscribe link included in every marketing email (one click, no login needed).

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

Email: [email protected]
General Support: [email protected]
Website: https://skysuite.pro