Data processing terms

Version 1, 2026-09-21. For customers who upload personal data of other people and therefore need a processor agreement under Article 28 GDPR. These terms are part of the terms of service for such customers.

Roles

For the content of the files you upload you are the controller and Skycorp Limited is the processor. For your own account data Skycorp is the controller, see the privacy policy.

Instructions

We process the content only to store it, turn it into tables, run the queries your authorised programs send, return the results, and delete it when you or the plan's retention say so. Nothing else, unless the law requires it, in which case we tell you first where we may.

Nature, purpose, categories

Tabular data you choose to upload; the categories of data and of people are decided by you. You must not upload special-category data (Article 9) without telling us and agreeing additional measures.

Our obligations

• People with access are bound to confidentiality. In practice that is the company's owner; there are no employees with access.
• Security measures: TLS in transit; access to your data only through your own tokens or session; every query checked against a read-only allow-list and bounded in time, memory and size; files stored on a server only we can reach, encrypted backups with a key held offline; logs without content.
• Sub-processors: those listed in the privacy policy. We tell you by email 30 days before adding one; you may object and close the account.
• We help you answer requests from the people in your data, to the extent the service allows (export, deletion), and we help with your security assessments within reason.
• We tell you without undue delay, and within 72 hours of learning of it, about a personal-data breach affecting your data.
• On account deletion your content is removed at once, and from backups within 90 days.
• You may audit our compliance through written questions, and on site if a regulator requires it, at your cost and with reasonable notice.

Transfers

Your content is stored in Canada, a country covered by an EU adequacy decision. No other transfer outside the EU or countries with adequacy takes place for your content.

Term

These terms apply for as long as we hold your content and end when it is deleted.