Privacy policy

1. Who we are and how to contact us

Skybase is provided by Made by Kiln Ltd, a company registered in England and Wales (number 17470076), whose registered office is at 128 City Road, London, EC1V 2NX, United Kingdom. Made by Kiln Ltd is responsible for the personal data described in this policy.

Skybase (“we”, “us”) provides a project-management service at https://skybase.it and on workspace subdomains of skybase.it. Questions about this policy go to support@skybase.it.

2. What we collect

• Account data: your name, email address, password hash, avatar, role and, if you sign in with Google, the identifier Google gives us.
• Workspace content: projects, columns, jobs, tasks, comments, private notes, labels, custom fields and the files you upload.
• Guest data: the name and email address of any client or collaborator you invite, so we can send the invitation and show who did what.
• Billing data: your plan, seat count and invoices. Card details are collected and stored by Stripe, not by us.
• Notification and email logs: which notifications were sent, delivered, opened or clicked, so your workspace administrators can troubleshoot delivery.
• Usage and technical data: our servers log your IP address, browser details and the pages you request, so we can run the service and keep it secure. We also record which announcements in the app you've seen or dismissed, so we don't show them again, and to count how many people saw them.
• Support requests: what you send us with Help → Send feedback: whether it's feedback, a problem or a question, your message, and your name, email address, role, workspace and its plan. Unless you untick "Include technical details", it also carries the kind of page you were on and the project or job it showed, your browser and device, the size of your browser window, your time zone, language and light or dark theme, whether you were online and connected for live updates, the app version, and the last few errors the app ran into, with web addresses shortened and email addresses taken out. We keep our replies and our staff's notes on your request with it.
• Cancellation feedback: when Pro is cancelled, when the plan started and ends, its billing period and number of seats, and whether it was resumed. If you cancel in the app, also who cancelled and, if you tell us, the reason you choose, the tool you're moving to and anything you write.
• Product update emails, only if you ask for them: whether you said yes or no to them, when, where (when you signed up, in your settings or in What's new), the wording you agreed to and the workspace you were in, and, if you unsubscribe, when and how. For each one we send, we record whether it was delivered, bounced or failed, and whether you reported it as spam or unsubscribed from it; reporting one as spam counts as unsubscribing. We don't track whether you open them or which of their links you click.
• How you found us, when you sign up: when you start signing up, we record which of our pages and which button brought you to the sign-up form, any campaign tags in the sign-up link (utm_source, utm_medium, utm_campaign, utm_term and utm_content), the domain of the website that linked to the sign-up form (never the full address), whether you signed up with your email or with Google, and whether your email address is a work or a personal one (from its domain). This uses no cookie. If the address of the page you're on has campaign tags, as our ads' addresses do, the page passes them on to its sign-up links in your browser, with no cookie. On our ads, utm_term is the keyword the ad was shown for, never what you searched for. If you allowed analytics, we also record how you first found Skybase, from the sb_ft cookie in section 9: the page you were on when it was first recorded, and on which day, the domain of the website that sent you there, its campaign tags, and whether you came from a Google or Microsoft ad (never the ad click's identifier). We use this only in our own reports, to learn which pages and campaigns lead to sign-ups, and we don't send it to Google Analytics. If you sign up through another workspace's referral link, we record which link it was and keep both workspaces' names on the referral, so we can give and check the credit.
• Analytics, only with your consent: if you allow analytics, Google Analytics measures how Skybase is used, on the public pages at https://skybase.it, on the sign-up pages and in the app. Before anything is sent, we take out what could identify you or your work:
  • In the app and on the sign-up pages, page addresses are replaced by the kind of page, such as a job in a project, never its real address. On our public pages we send the page's public address, keeping only campaign tags from the query string.
  • We never send names, email addresses, workspace names, search terms, or anything you put in Skybase.
  • Your account and your workspace are identified by pseudonymous codes, made with a keyed one-way hash, so Google can't connect them to you.
  • A few events, such as a subscription starting, are sent from our servers, and only if you had allowed analytics when you signed up or upgraded.
  • Google keeps this event data for 14 months.

  Until you choose, nothing is sent to Google Analytics, and its code isn't loaded. If you don't allow analytics, Google Analytics sets and reads no cookies. Google's Consent Mode then sends only cookieless signals, with no identifier from a cookie and without the pseudonymous codes, which Google may use to estimate overall numbers.

• Advertising, only with your consent: we advertise on Google search. Our Google Analytics is linked to our Google Ads account, so Google Ads can count how many people who clicked one of our ads went on to sign up, start using their workspace or start paying. When you click a Google ad, Google adds a click identifier to our page's address, and if you allow analytics, it goes to Google Analytics with the page's other campaign tags. If you allow advertising, Google may also set the advertising cookies in section 9, so that a click can be linked to a later sign-up. If you don't, Google sets none of them, and Google Ads gets only Consent Mode's cookieless signals about your visit. We don't use any of this to build audiences or to show you ads elsewhere, and we never send Google your name, email address or anything you put in Skybase.

3. How we use it

To run the service you signed up for: showing the right people the right projects, sending the notifications you have chosen, billing per seat, keeping your files available, investigating abuse, answering your support requests, improving the product, and learning which of our pages and campaigns lead people to sign up. If you ask for them, we also send you occasional product updates by email, each with a link to unsubscribe. We do not sell personal data.

4. Legal bases

Where UK or EU data-protection law applies, we rely on performance of a contract (providing the service), legitimate interests (security, product improvement, fraud prevention, and learning which of our pages and campaigns lead to sign-ups), consent (analytics cookies, product update emails and advertising cookies) and legal obligation (tax and accounting records). The strictly necessary cookies in section 9 rely on our legitimate interest in running a secure service, or on our contract with you.

5. Sub-processors

We use the following providers to deliver the service. Each receives only what it needs for its role.

• Stripe for payments and invoices.
• Mailgun for sending email and reporting delivery events.
• Algolia for search. For each open job it holds a copy of the job's title, description and project name, its due date and priority, its labels' names, the text of its comments, the names of its files, and its tasks' titles and descriptions. With them go ids: the job's project, column, labels, type and assignee, the people who can see it, and who wrote each comment, uploaded each file or holds each task. Every record is labelled with its workspace, and every search is limited to the searcher's own workspace and projects. Algolia is never sent anyone's name or email address from their account (a mention is stored as an id), though it holds what people write as they wrote it. Searches run on our servers, and archiving or deleting a job, comment, file, task, project or workspace removes its records. If you allow analytics, Algolia also receives which search results you open, under a code that doesn't identify you, kept in its EU region and used to improve the order of results. They're deleted when you leave the workspace or the workspace is deleted.
• Amazon Web Services (S3) for private file storage with signed, expiring links.
• Pusher or a self-hosted Laravel Reverb server for real-time updates.
• Slack when a workspace connects it. Skybase posts the updates each project chooses to that project's channel. If a project allows replies, Skybase reads replies to its posts in that channel, asks Slack for the replier's confirmed email address to find the matching person in the workspace, and adds the reply to the job as their comment; anyone it can't match gets a private note in Slack instead. We remember a Slack person's name and email address for a day. If a project allows link previews, a link to one of its jobs, pasted in the connected Slack workspace by someone who can see that job, shows the job's title, project, column, whether it's completed, up to three of its labels, who holds it (a guest is shown only as a guest), due date and priority to everyone in that conversation. Archived jobs, descriptions and comments are never shown.
• GitHub and Google only when you connect them, and only for the data those integrations exchange.
• Anthropic when you use Claude features: the job title and description you choose to send are used to generate suggestions.
• Google (Google Analytics and Google Ads): Google Analytics, if you allow analytics, on the public pages, the sign-up pages and in the app. It receives pseudonymous codes and the kind of page you're on (on our public pages, the page's public address), never your name, email address or workspace content. We also import reports from Google Analytics and Google Search Console into our own reporting: totals such as visits per page and the searches our public pages appeared for, which Google gives us only as totals. Nothing about you is sent to Google for this. Google Ads, if you allow advertising, learns, as described in section 2, whether a click on one of our ads led to a sign-up, a workspace in use or a payment.
• Cloudflare (Turnstile) on the sign-up form and the "Change email" form, to check you're a person and not a bot. It receives your IP address, your browser (User-Agent) and connection (TLS) details, and which site you're on. Cloudflare processes these for us. It also uses them, as a controller, to improve Turnstile's bot detection, under its own Turnstile privacy addendum.

6. Data isolation and staff access

Each workspace runs on its own subdomain with its own dedicated database. Uploaded files are stored privately and every download link is signed and expires after 8 hours.

Support access. Our support team signs in to your workspace only if one of its administrators has switched on support access in Account settings, for 24 hours, 3 days or 7 days. An administrator can switch it off at any time, and it ends by itself when the time is up. While it's on, someone from our support team can sign in as one person in the workspace, usually an administrator, for up to 4 hours at a time, and see and do what that person can, except:

• The person's password, email address or profile
• Billing and the subscription
• Inviting or removing people, changing someone's role, or resetting their password
• The workspace's settings and integrations (Slack and GitHub)
• Deleting projects or the sample workspace
• Private notes on jobs, reading or writing
• Approvals: deciding, asking for approval, and changing, nudging or cancelling an approval request
• Choices only the person should make: their cookie choice, notification settings, product update emails, scheduled report emails, support access, feedback, imports and signing in

Changes they make show under that person's name, and comments they post are marked as posted by Skybase support. Their changes don't send emails, Slack messages or GitHub updates at the time. Afterwards they're part of the workspace like anyone else's: due dates they set bring the usual reminders, automations they create run as usual, and daily summary emails can mention them. They can't schedule report emails. What that person has read, their favourites, their away status and their notification and display preferences stay as they left them.

The record of each visit. We record each visit: who from Skybase, which person they signed in as, why, when it started and ended, and every request their browser made to your workspace. When an administrator switches support access on, we email the workspace's other administrators, and when a visit starts we email all of them, at most once every 30 minutes. Administrators can see each visit, and the changes made, in Account settings. We keep the details of each request for 12 months, and the rest of the record for as long as the workspace exists.

Other access. To run billing and support, our operators can see account details for every workspace: its name and address, plan and billing history, how many people and projects it has, storage used, which features it uses and how active it is, which of its emails bounced or were reported as spam, and the names, email addresses and roles of its people, with when they were invited, last signed in and were last active. They can also look up an email address to see which workspaces it belongs to, and they can keep their own notes on an account. The engineers who run Skybase can reach the servers and databases where your data is stored; they use that access only to keep the service running, fix problems, restore backups and meet legal obligations.

7. Retention and deletion

We keep workspace content for as long as the workspace exists. Archived content stays available to the workspace until deleted. Bulk file exports built in the background are removed after 24 hours. A workspace administrator can request deletion of the whole workspace; deletion is confirmed by email and then carried out, after which its database, its stored files and its search index are removed from active systems, and later from backups.

If you start signing up, we keep your name, email address and sign-up details for 7 days, so you can finish on another device or try again. After 7 days we delete your name, email address and password, your Google sign-in details, and the Google Analytics identifiers and cookie choice stored with it. We keep the dates, the steps you reached (and, if setting up your workspace failed, the step it failed at), whether you signed up with your email or with Google, whether your email address was a work or a personal one, your team-size answer, whether you asked for sample data or for product update emails, and how you found us, for our statistics. If you created a workspace, the record stays linked to it, with its name; otherwise the name you chose for it is deleted too.

Support requests are deleted 2 years after they're resolved, or with the workspace. Your answer about product update emails is kept while your email address belongs to a workspace, and deleted once it belongs to none. We keep the record of each product update email we sent you for 2 years, or until your email address no longer belongs to any workspace, if that's sooner. When a workspace is deleted, we keep our record of its billing (its subscription changes, seat counts and payments) and its cancellation feedback, with the workspace's name, for our records and statistics. From the cancellation feedback we delete anything written in it and who cancelled, and keep the reason, the tool named, the billing period, the number of seats and the dates. The record of its sign-up stays for our statistics, without the workspace's name or anyone's personal details.

8. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, or to object to or restrict certain processing. Email support@skybase.it and we will respond within the time the law allows. Workspace content belongs to the workspace; requests about it may be routed to the workspace administrator.

9. Cookies

Our public pages at https://skybase.it set no cookies from our servers. Signing up, finding your workspace and using the app do. Cookies come in four ways: the ones Skybase needs to work, the one that remembers your cookie choice, analytics cookies (Google Analytics' and our own sb_ft), which are set only if you allow them, and Google's advertising cookies, which are set only if you allow advertising.

Both session cookies are set for skybase.it and its subdomains.

On the sign-up pages only, the Turnstile check may also store strictly necessary data in your browser. It's set by Cloudflare, to tell people from bots.

We advertise on Google search. Google's advertising cookies above are set only if you switch on Advertising in the cookie banner, and we don't use them for remarketing. If you refuse or withdraw advertising, we delete them from your browser. If you switched Advertising on while the banner said we ran no ads, it doesn't count: to allow it, choose again in Cookie settings.

Your light or dark preference, and a few app settings such as a comment you haven't sent yet, are kept in your browser's local storage, not in cookies, and don't reach us until you choose to post or save something.

Changing your mind. Choose Cookie settings in the footer of this site, in the Help menu in the app, or on the sign-up pages. Your new choice applies straight away, on the website and in your workspaces. If you refuse or withdraw analytics, we delete the Google Analytics cookies and sb_ft from your browser, and if you refuse or withdraw advertising, Google's advertising cookies. You can also clear or block cookies in your browser; if you block the strictly necessary ones, signing in won't work.

10. Security

Passwords are hashed, traffic is encrypted in transit, file links are signed and short-lived, email-sending endpoints are rate limited, and administrative access to the platform is protected by allow-lists and audit logging.

11. Children

Skybase is a business tool and is not directed at children under 16. Do not create an account if you are under 16.

12. International transfers

Our sub-processors may process data outside your country. Where required we rely on standard contractual clauses or equivalent safeguards.

13. Changes to this policy

We will post changes here and update the date at the top. Material changes will be announced in the app or by email.

14. Contact

support@skybase.it

Made by Kiln Ltd, 128 City Road, London, EC1V 2NX, United Kingdom