Privacy

Last updated 2026-09-18

This policy describes how Skycat handles data on the Skycat platform (the “Service”), both an organisation’s own data (“Customer Data”) and personal data about the people who sign in to use it.

What is collected

• Account data. Name, email address, and role, for every person a customer organisation invites.
• Customer Data. Imagery, survey outputs, annotations, and related content an organisation uploads, stored per organisation and isolated from every other organisation on the Service.
• Usage and audit data. Sign-ins, actions taken within an organisation’s account, and error reports (via Sentry), kept to operate and secure the Service.

How data is used

Account data and Customer Data are used only to provide the Service to the organisation that owns them: authentication, processing pipelines, and the features an organisation’s members use directly. Skycat staff access an organisation’s data only for support, and only through the platform’s own impersonation tool, which is time-limited, read-only, and recorded in that organisation’s own audit log with the staff member’s name and reason.

Who else handles it

The Service runs on infrastructure operated by Fly.io (application hosting and database) and Cloudflare (object storage and edge delivery of shared links). Transactional email (invitations, password resets) is sent through Resend. None of these providers is given access to Customer Data beyond what is necessary to host or deliver it.

How long it is kept

This is about the files, while the account is still open. A file stays until the organisation deletes it, or until it is older than a retention period the product offers. Skycat then removes it from the server. Skycat does not have to keep a file for a period the product does not offer. If a storage plan is full, files already stored stay. New files wait until there is room, or the plan is larger. What happens when the account itself ends is set out below.

When an organisation leaves

When an organisation’s agreement with Skycat ends, its administrator (or Skycat staff, acting on that administrator’s instruction) can export the organisation’s data before it is removed. Removing an organisation is irreversible: every product’s records and stored files for that organisation are deleted, pending invitations and memberships are removed, active share links are revoked, and any member account with no other organisation is anonymised. A departing member’s account is never left holding an identifiable record purely because deleting it would break an audit trail Skycat is required to keep for other organisations.

Security

Every organisation’s data is isolated at the database level, and the underlying database is backed up automatically.

Your rights

A person whose account data is held on the Service can ask their organisation’s administrator, or Skycat directly, to correct or delete it, subject to the rules above on leaving and on how long data is kept.

Contact

Questions about this policy, or a request concerning personal data: hello@skycatdrone.com. These terms of use are on the Terms page.