Privacy Policy: How Skye Meta Handles Your Data

1. Introduction

Skye Meta Corp ("Skye Meta," "we," "us") respects your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data when you use our products (Bothy, SkyeGate, SkyeWoo, Skye Recognition for Shopify, SkyeProfile, SkyeSkiff (formerly AgentTalk), or any other Skye Meta service) or visit skyemeta.com.

2. Data We Collect

Account & Subscription Data

Email address -- provided when you create an account or subscribe
Email sign-in -- to sign in to your account or the Bothy dashboard, we email you a one-time code. We keep the code only in scrambled form, for 10 minutes; a sign-in lasts 7 days
Production domain -- recorded when you first use SkyeGate or SkyeWoo on a production website. Development and preview hosts are not recorded.
Plugin trials -- if you start a SkyeGate trial, we keep your website's domain and the checks left in the trial
Which websites use our plugins -- we count requests per day for each website that uses SkyeGate or SkyeWoo, kept for 90 days, and our team is notified when a new website starts using them
Payment information -- processed and stored by Stripe; we do not store credit card numbers

Cross-Market Intelligence Newsletter

Email address -- provided when you subscribe to the free Cross-Market Intelligence brief at skyemeta.com/crossmarket. Your address is added to the mailing list when you submit the subscribe form, and we send a welcome email confirming the signup
Subscription status -- your address is stored on the mailing list in our database until you unsubscribe
Signup record -- we keep a record of when and where you signed up, and the wording shown beside the signup button. No IP address or browser details are stored with it
Every issue includes a one-click unsubscribe link, and you can opt out at any time. If you unsubscribe we keep your address on a do-not-email list so we do not email you again. The newsletter is editorial, free, and separate from any paid product account

Wallet Data

Public wallet addresses -- the public addresses of the wallets you connect (EVM 0x addresses, Solana, and the other chains our products support), submitted for verification
Wallet ownership proof -- to show a wallet is yours, your browser asks skyemeta.com for a one-time message (sending the wallet's public address and the site's domain), your wallet signs it (a message, never a transaction), and the browser sends the signature back. We check it and keep a short-lived proof, linked to that address and domain, for 30 minutes, so you sign once per visit. An unused one-time message expires after 2 minutes
Wallet addresses are sent to InsumerAPI for on-chain verification (see Third-Party Services below)
Verification results (pass/fail) may be cached in WordPress transients for up to 30 minutes
We never collect, store, or process private keys or seed phrases

WooCommerce Session Data (SkyeWoo)

Session cookie -- SkyeWoo sets an HTTP-only cookie (skyewoo_session) to track the result of a wallet check during a shopping session
Verified product list -- which gated products the customer has unlocked, stored in a server-side WordPress transient (not in the cookie itself)
Discount eligibility -- whether a verified wallet qualifies for a per-product discount, stored in the session transient
Session data expires after the configured cache duration (default 30 minutes)
No WooCommerce order data, cart contents, or customer account data is collected by SkyeWoo beyond standard WooCommerce behavior

Usage & Analytics Data

Hosting provider's web analytics: counts page views, referring pages, country, and browser and device type in aggregate. It does not use cookies
Google Analytics (only if you agree): pages visited, browser type, device type, referring URL, and approximate location. It loads only after you choose Accept in the cookie banner, and you can change your choice at any time with the Cookie settings link at the bottom of every page that uses analytics (see Cookies below)

License Data

License keys and their domain, status, plan, email, and link to your payment record
License history: activation, deactivation and rotation dates, and which key replaced which. License records, including cancelled licenses and keys that were replaced, are kept for billing, audit and support
Rate limiting: request counts by license key, wallet or network (IP) address, kept for between one minute and one day

SkyeSkiff Data

Wallet addresses: the public wallet addresses an agent declares a channel or joins a session with, and the signed results of their checks, kept until the channel expires
Channel conditions: the on-chain conditions declared for a channel (token addresses, chain IDs, thresholds), kept until the channel expires
Session tokens: signed session tokens issued to agents after both sides are checked, kept until the channel expires
Credits: credits are added to the balance of the paying wallet. For each payment we keep its transaction hash, the sending and credited wallets, the amount, and the app name if one was given, checked against public blockchain data, so a payment is never counted twice. Payment records and credit balances have no end date, because credits do not expire
Who an agent acts for: when a channel asks agents to show who they act for, the delegation (a signed permission from a principal) or the ERC-8004 agent ID an agent presents is kept by us with its membership until the channel expires. For each check it is sent to InsumerAPI, which checks it and, under its own privacy policy, does not store the request's contents. The delegation itself is not shown to other agents in the channel. They receive the signed result, which names the delegator and identifies the delegation, includes its limits unless the agent chooses to keep them private, and, for a registered agent, includes its agent ID
Pay-per-call payments: for each call paid with x402 we keep the paying wallet's public address, the network and the transaction (or, if settlement could not be confirmed, the amount) so that one payment is never used twice: 30 days for a settled payment, 90 days for one we could not confirm
Channel and session data expires automatically when the channel does (1 hour by default, at most 30 days). We do not keep it after that.

Bothy (Community Memberships)

Community profile: the organization details a community operator provides (name, organizer, location, website and logo), used to operate the community and its registry listing. A logo you upload is stored as a public image file. The community's name and logo are public: they appear in the pass's public details, the registry of recognized passes and, if the operator publishes it, the discount directory. When a community is created, our team is notified with its name, organizer, location, website and account email
Domain verification: to confirm a community's website, we look up a DNS record, or a tag or file the operator places on the site
The pass on a public blockchain: creating a community's pass writes its name and a short ticker permanently on a public blockchain (Base). Claiming a pass mints it to the member's own wallet, which shows publicly that this wallet holds the community's pass
Invitation emails: email addresses of people a community operator invites to claim a membership pass, used solely to send the invitation. Every invitation carries an unsubscribe link. If you unsubscribe we keep your address on a do-not-email list so we do not email you another Bothy invitation, from any community. The claim link in an invitation works for 7 days. When an operator uploads a membership list, addresses waiting for seats are kept until they are invited or removed
Who decides: for member information such as invitation emails and a community's roster, the community operator is the controller and Skye Meta processes that information on the operator's behalf (see section 5 of the Bothy Operator Agreement)
Pass wallet sign-in email: if you create or open your membership pass wallet with your email, that address is used to send one-time sign-in codes and to operate your wallet account. It is processed by our wallet-infrastructure provider (listed below), and it anchors access to the wallet: one-time codes sent to that inbox are how you prove it's you
Membership records: a community's private roster of issued passes, including each member's full wallet address so a pass can be revoked (the dashboard shows it shortened). The membership itself is a non-transferable pass minted to the member's own wallet and recorded on a public blockchain
Recognition shares as little as possible: when a member's pass is recognized in person or through the browser extension, the community or merchant receives only a yes/no result and any applicable benefit (such as a discount), not the member's wallet address or wallet balances. A website that runs SkyeGate or SkyeWoo receives the public address of the wallet the member chooses to share, because the site's server sends that address for the check. It receives the yes/no result, never the member's balances or email
Recognition settings: the passes, tokens and NFTs a store recognizes, its discounts and tiers, and its terms for wallets that are not proven, as set by the operator in the Bothy dashboard. They are stored with the service that checks passes, so recognition can apply them. If the operator publishes them to the discount directory, they are public. When a community's plan ends, its listing is removed; if the community reactivates, a listing it had published is restored
Unpaid communities: a community that was set up but never paid for is deleted, with its license, 120 days after it was created, after reminder emails
Connected Stripe account: if a store connects its own Stripe account, we send Stripe the store's name and website to start the connection, we store the account identifier and the date it was connected with the community, and we create a single-use coupon in that account for a discount code issued for the store after its wallet check (the code, the percentage and its expiry). Codes shown in the browser extension are not created as coupons. We never receive the store's customers' payment details. Disconnecting removes the identifier from our records
Because a membership pass is recorded on a public blockchain, that on-chain record is public and permanent by the nature of the blockchain
We never collect, store, or process private keys or seed phrases

Bothy Scanner

Staff sign-in: staff sign in with the community's scanner code and a PIN the operator sets. The PIN is held by InsumerAPI, the service that checks passes, not by us. After sign-in we keep a random session identifier, linked to the community, for up to 12 hours, and the scanner page keeps it in the browser's session storage until staff sign out or close the tab
What a scan reads: the camera image is read on the device; only the decoded pass QR code is sent. A pass QR is signed, valid for about a minute, and does not carry the member's full wallet address. It is checked for this community's recognition settings, and staff see whether the pass is recognized, the discount it earns, and the name of the pass or token behind it. Staff never see the member's wallet address or balances
Scan records: neither Skye Meta nor InsumerAPI keeps the scanned QR code, or a record of who was scanned. When a scan or a sticker tap gives a member of another community a discount, we add one to that store's count of member visits for the month, with the name of the community's pass and the discount given, and keep a scrambled (hashed) form of that one pass code for 8 days so the same code is not counted twice. The count holds no wallet address, name or email. Monthly counts are kept for about 13 months so a bill can be checked. Ordinary request logs (the time, the address called, the network address and whether it succeeded) are kept by InsumerAPI's hosting for 30 days and are not used to build a record of scans
Counter stickers: signed-in staff can program NFC stickers for the counter, give each one a label, and revoke it. Each sticker has a serial number and a secret written into its link. The link is shown once, to program the sticker, and Skye Meta does not keep it. The sticker list (serial, label, dates, and whether it is revoked) is kept for the store by InsumerAPI, the service that checks passes, with the secret only in scrambled (hashed) form. A revoked sticker is deleted 12 months after it is revoked. While a community's subscription is inactive, its stickers show that recognition is paused and give no discount, and they work again when the community reactivates. The community owner can also see and revoke stickers from the dashboard
Live taps: while signed in, the scanner shows each sticker tap at this store as it happens: the time, the code on the member's screen, whether the pass was recognized, the discount and the name of the pass. Staff never see the member's wallet address or balances

Bothy Pass (skyemeta.com/pass/)

Opening your pass: you open your pass with the email you claimed it with (see Pass wallet sign-in email above) or by connecting a crypto wallet. Your email goes only to our wallet-infrastructure provider, which sends the sign-in codes; InsumerAPI never receives it
Kept in this browser: your email sign-in session; if you combine wallets, a list of how each was connected (for example Email or MetaMask) with a shortened address (the first six and last four characters); and a random session ID for InsumerAPI that holds no personal data. After a sticker tap, the tab's session storage keeps that tap for up to 10 minutes, so reloading the page still shows it. "Sign out" ends the email session and clears the remembered wallets. It does not clear the random session ID, or the permission a browser wallet extension keeps for the site
Reading your pass: to show what your wallets hold, the page sends their public addresses to InsumerAPI and to public blockchain nodes. Only public chain data is read, and nothing is signed for this. The page also reads InsumerAPI's public list of recognized passes and tokens, and fetches public token lists and token logos from public hosts, which see only your network address
Your pass code: InsumerAPI signs the QR code your pass shows, and a new one replaces it about every minute. The code never contains your full wallet address. It does carry a summary of the passes and tokens it was made from (token symbols with amounts rounded to two decimals, pass identifiers with counts, and a shortened address for each combined wallet), which the scanner uses to recognize you. Anyone who scans it with an ordinary QR app can read that summary; staff see only the result
Counter stickers: when you tap a store's sticker with your phone, your pass opens with that store's details. We look up the store's public name and logo to show you. The check runs at InsumerAPI, using the sticker's details, your pass code and its holdings summary. InsumerAPI records the tap for the store so its staff can match your screen in the scanner's live taps: the time, the one-time code shown on your phone and when it expires, the discount and the passes or tokens that earned it, whether you were recognized, and an anonymous browser identifier used to confirm the tap, which is removed within 24 hours. The record holds no wallet address in any form and no balances, and it is deleted 12 months after the tap. The one-time code expires after 30 minutes. Staff see the time, the code on your screen, whether your pass was recognized, the discount and the name of the pass, never your wallet address or balances
No analytics: the pass page loads no analytics and sets no analytics cookies

Bothy Pass connect window (skyemeta.com/pass/connect/)

A website that runs SkyeGate or SkyeWoo opens this window when you choose "Membership pass (email)", so you can use a pass held in an email wallet. You sign in with the email you claimed it with. The email is entered in the window, never on the website
If you approve, the window hands the website only the pass wallet's public address and a one-time ownership proof (see Wallet ownership proof above). If you cancel or close the window, nothing is sent
The window loads no analytics, sends the website nothing before you approve, and keeps nothing in your browser beyond the same email sign-in session as your pass

Bothy at the Door

First open: you connect your wallet and sign one message (never a transaction). We check the signature, then set the bothy_door_session cookie and keep your public wallet address with it for 30 days, so later opens on that phone do not ask you to sign again. Your pass and the door's open hours are still checked on every open
Door log: every attempt is recorded for that door with the time, whether it opened, the reason if it did not, and a shortened wallet address (the first six and last four characters). We keep the most recent 500 attempts per door
The lock: when a member is recognized, we send the cloud lock provider the instruction to unlock that lock. It receives no wallet address or personal data from us

Demo Store

The demo store at demo.skyemeta.com takes no payment and asks for no personal data. A discount code you enter there is sent to check whether it is valid for the demo store. The page sets no cookies and loads no analytics

Skye Meta Recognition (Browser Extension)

Stored on your device only: the public wallet addresses you connect, your settings, and any discount code waiting to be applied are kept in your browser's extension storage. They are not sent to us
Reading your holdings: to see what a connected wallet holds, the extension sends that public address to public blockchain nodes, and for Solana NFTs to InsumerAPI, the service our products are built on. Only public chain data is read, and nothing is signed for this. The extension cannot move your assets
Which sites take part: the extension downloads the list of participating stores and recognized tokens, then compares the site you are on against that list inside your browser. Your browsing history is not sent anywhere
Proving your wallet (optional): at a store that gives more to holders who prove their wallet, you can choose to sign a message with it. The signature is a message, not a transaction: it costs nothing and cannot move your assets. Only if you sign, the extension sends that wallet's public address and the signed message to InsumerAPI, which checks the signature, reads the wallet and works out the discount. The address is not kept, and the store still sees only the code and the discount. If you do not sign, the code is created without sending your wallet anywhere
Discount codes: when you reveal, copy or apply a discount, a one-time code is created and the event is recorded with the store, the code, the discount, the tier and the token symbol. Your wallet address and balances are never part of that record
Using a Bothy pass: if your pass is in an email wallet, the extension opens a page on skyemeta.com where you sign in with the email you used to claim it (see Pass wallet sign-in email above). The page hands back the wallet's public address and, if you choose to sign, the signed message. Your email stays on that page
At checkout: on a participating store's checkout page, the extension can fill the discount code field for you. It does not read or store your payment details

Skye Recognition for Shopify

Linking a pass at a store: when a shopper links a pass or wallet at a participating Shopify store, we keep the store, the shopper's customer ID at that store, the community recognized and the wallet that holds the pass, until the link is removed. We re-check linked wallets each week and remove links that no longer qualify
Matching members: the store's app sends us a scrambled (hashed) form of a shopper's verified email to match members who claimed their pass with that email. It never sends the email itself
Member prices: we record the communities a shopper belongs to in a field on their customer record in that store, so the store can apply member prices
Usage: when a member price is used, the app tells us the order's ID, kept for 8 days to count each order once, and the community whose member price was used. Monthly totals, by community, are kept for about 13 months so a bill can be checked. We receive no order contents or payment details

Skye Recognition for Clover

Connecting: when a store connects its Clover account (from the Bothy dashboard or by installing Skye Recognition from the Clover App Market), we keep the Clover merchant ID, the business name, the Clover region, the access and refresh keys Clover issues to the app with their expiry dates, and the date it was connected. The keys are held on our servers only and are never shown in the dashboard or sent to anyone else. A connection started from the Clover App Market is held for at most 30 minutes until the store's owner signs in and confirms it. When the store has no Skye Meta account yet, we also read the Clover account owner's email address and the store's town and state, to fill in the sign-up form for them; the email is used to send the sign-in code, and the town and state become the store's location
What the app reads and changes: it reads the store's business name and its list of discounts. It creates, updates and removes only the member discounts it made (their Clover IDs, names and percentages are kept with the connection, with the time of the last update). It does not read orders, payments, customers or employees, and it sends Clover no member, pass or wallet information
Billing through Clover: we read the store's Skye Recognition plan and its billing status from Clover, to switch the store's plan on or off. Member visits over the plan are reported to Clover as a number each month, with no member, pass or wallet detail. Clover's install, uninstall and plan-change notices reach us so the plan stays in step
Disconnecting: disconnecting in the Bothy dashboard removes the app's discounts from the register and deletes the keys and the connection record. Uninstalling the app in Clover ends its access: Clover tells us, and we delete the keys and the connection record. Any of the app's discounts still on the register can then be deleted in Clover

SkyeProfile

When you enter a wallet address on SkyeProfile, it is sent to InsumerAPI and to independent trust and reputation providers that score public wallet activity, and the results are shown to you. We do not keep the address. Results for our example wallets are cached for up to 10 minutes

Notifications

When you make a purchase, renew or cancel, our team receives an internal chat notification with your email address, the amount and your license key. It is used only for order monitoring and support and is not shared with anyone else.

3. How We Use Your Data

We use collected data to:

Provide and operate our products (Bothy, SkyeGate, SkyeWoo, Skye Recognition for Shopify, SkyeProfile, SkyeSkiff, and the Skye Meta Recognition extension), including wallet checks, token gating, discounts for qualifying wallets, member prices, and condition-gated agent sessions
Process payments and manage subscriptions
Send transactional emails (sign-in codes, license keys, receipts, renewal reminders, invitations and account notifications)
Send the Cross-Market Intelligence brief to subscribers who opt in, each issue carrying a one-click unsubscribe link
Improve our products and website based on usage patterns
Respond to support requests
Comply with legal obligations

4. Third-Party Services

We share data with the following categories of third-party providers, each of which has its own privacy policy:

Payment processor (Stripe). Receives your payment details and billing information for SkyeGate, SkyeWoo, and Bothy subscriptions and seat purchases. For a store that connects its own Stripe account, Stripe also holds the coupons we create in that account. Stripe Privacy Policy
Wallet check service (InsumerAPI). Provided by The Insumer Model LLC. Receives public wallet addresses and conditions to perform on-chain verification (returns pass/fail). For Bothy, InsumerAPI also holds each store's recognition settings, scanner names and PINs, and receives a one-way (hashed) identifier of the community's license when a store is published. It also reads the holdings of the wallets a member opens the Bothy Pass with, signs the pass code, checks in-person scans and sticker taps, and keeps each store's stickers and tap records (see Bothy Scanner and Bothy Pass above). It receives the pass code with its holdings summary and shortened addresses, and a random browser session ID, never the member's email. The Bothy Pass page and connect window load their code from insumermodel.com. InsumerAPI Privacy Policy
Payment facilitator for pay-per-call (Coinbase). When an SkyeSkiff call is paid per call with x402, receives the signed payment from our server (the paying wallet's public address, the amount and the recipient), checks it, and settles it on-chain to our account. It does not receive the agent's IP address or any other personal information from us.
Email provider. Receives your email address to deliver account-related messages (license keys, receipts, rotation notifications, support replies) and, for subscribers, the Cross-Market Intelligence newsletter.
Wallet-infrastructure provider. Operates email-anchored pass wallets. When you create or sign in to a pass wallet with your email, this provider receives that address and your sign-in events, delivers the one-time codes, and runs the wallet's secure key environment. It does not receive community rosters, your activity on recognizing sites, or anything beyond what operating your wallet requires.
Cloud lock provider. For Bothy at the Door, receives the instruction to unlock a specific lock when a member is recognized. It receives no wallet address or personal data from us.
Database provider. Stores account, license, community, member, session and SkyeSkiff data, and rate-limiting counters.
Hosting provider. Serves the site and our APIs, stores uploaded community logos as public files, and provides cookieless, aggregate page-view analytics.
Internal team chat. Receives purchase, renewal and cancellation notices for order monitoring and support (see Notifications above).
Public blockchain networks and nodes. Receive public wallet addresses to read balances, and the transactions that create, mint and revoke Bothy passes.
Shopify. For stores that use Skye Recognition for Shopify, the store's app exchanges with us the data described under Skye Recognition for Shopify above.
Clover. For stores that connect Skye Recognition for Clover, Clover issues the app access to the store's account and receives the member discounts the app creates (names and percentages), as described under Skye Recognition for Clover above. Clover Privacy Policy
Independent trust and reputation providers. For SkyeProfile only, receive the wallet address you enter.
Revenue share. Part of each payment goes to The Insumer Model LLC through our payment processor. The transfer carries no customer personal data.
Google Analytics (Google). Only if you accept analytics cookies: collects pages visited, browser type, device type, referring URL, and approximate location to help us understand how visitors use the site. Google Privacy Policy

Data shared with InsumerAPI is limited to what is described above: public wallet addresses and conditions, and for Bothy the pass code, its holdings summary, a random browser session ID, and the sticker and tap records. InsumerAPI never receives your email.

We do not sell your personal data to any third party. For a current list of our sub-processors, contact us at support@skyemeta.com.

5. Cookies and Local Storage

Cookies skyemeta.com sets to make the service work (always on, because the feature cannot work without them):

skye_session -- keeps you signed in to your account and the Bothy dashboard after you sign in with an email code. HTTP-only, secure, lasts 7 days, and is removed when you sign out.
bothy_door_session -- set when you unlock a Bothy door with your membership pass. It remembers which wallet you proved, so later unlocks do not ask you to sign again; your pass is still checked every time. HTTP-only, lasts 30 days.

Analytics cookies, only if you agree. Google Analytics sets cookies named _ga and _ga_<ID>, which by default last up to two years. They are set only after you choose Accept in the cookie banner. If you choose Decline, or your browser sends a Global Privacy Control signal and you have not chosen otherwise, Google Analytics is not loaded at all. You can change your choice at any time with the Cookie settings link at the bottom of every page that uses analytics. Our hosting provider's web analytics does not use cookies.

Local storage. Your browser's local storage keeps your analytics choice (skye.consent.analytics) so we do not ask again, plus small interface preferences in the Bothy dashboard (for example, which organization you last opened). While a Bothy dashboard tab is open, session storage keeps your license key so the dashboard stays signed in; it is cleared when you close the tab. After you prove you own a wallet, session storage keeps a short-lived proof for that visit so you are not asked to sign again. On the Bothy Scanner, session storage keeps the staff sign-in for the shift, and local storage remembers the name and logo of the organization last signed in on that device so the sign-in screen can show them. On the Bothy Pass and its connect window, local storage keeps your email sign-in session, any remembered wallets (shortened addresses only) and a random session ID with no personal data, and session storage keeps a sticker tap for up to 10 minutes (see Bothy Pass above). None of this is sent to analytics providers.

On stores that run SkyeWoo. The SkyeWoo plugin, on a merchant's own WooCommerce site, sets an HTTP-only cookie (skyewoo_session) to keep the result of a wallet check during a shopping session. It contains only a random session identifier, not wallet addresses or personal data. Disabling it will prevent a wallet check result from persisting across page loads.

Fonts. The fonts on skyemeta.com are served from our own site, so loading a page does not contact a font provider. The Bothy Scanner page loads its QR-reading code from a public code library host, which receives your IP address as any web server does. The Bothy Pass page and the connect window load their code from insumermodel.com, InsumerAPI's site, which receives your IP address the same way.

6. Data Retention

Account and license records -- kept for billing, audit and support, including after cancellation and for keys that were replaced. We delete them on request where the law allows
Unpaid communities -- deleted, with their license, 120 days after they were created
Plugin usage counts -- 90 days. Plugin trial records (the website's domain and checks left) are kept so each website gets one trial
Newsletter subscription -- your email and signup record are retained until you unsubscribe. Your address then leaves the mailing list, and we keep it on a do-not-email list, with the date and reason, so we do not email you again
Unsubscribed invitation addresses -- kept on the do-not-email list, with the date and reason, so no Bothy invitation is sent to that address again
Wallet addresses -- processed in real time for verification. Verification results (pass/fail, not wallet addresses) may be cached in WordPress transients for up to 30 minutes to avoid repeated API calls
Wallet ownership proofs -- kept for 30 minutes; an unused one-time message expires after 2 minutes
Bothy sticker taps -- deleted 12 months after the tap; the anonymous browser identifier in a tap record is removed within 24 hours. A revoked sticker is deleted 12 months after it is revoked
Rate limiting data -- request counts by license key, wallet or network address, kept for between one minute and one day
SkyeSkiff -- channel and session data expires with the channel (at most 30 days); payment records and credit balances are kept with no end date, because credits do not expire
Skye Recognition for Shopify -- a recognition link is kept until it is removed or a weekly re-check finds it no longer qualifies; order IDs 8 days, monthly member-visit totals about 13 months
Bothy Scanner sign-ins: the session identifier expires after 12 hours, and stops working, and is deleted, once the community's license is no longer active
Bothy at the Door: the door session and the wallet address kept with it expire after 30 days. The door log keeps the most recent 500 attempts per door; older entries are deleted as new ones arrive
Connected Stripe account: the account identifier is kept until the store disconnects it. Coupons created in the store's Stripe account are the store's records
Connected Clover account: the merchant ID, business name, keys and the list of the app's discounts are kept until the store disconnects or uninstalls the app. An unconfirmed connection from the Clover App Market expires after 30 minutes
Payment records -- retained as required by tax and financial regulations
Analytics data -- Google Analytics data, collected only with your consent, is retained per the provider's settings (currently 14 months). Our hosting provider's web analytics reports are aggregate

7. Data Security

We implement reasonable technical and organizational measures to protect your data, including encrypted connections (TLS), secure API authentication, and access controls. However, no system is perfectly secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Delete your personal data (subject to legal retention requirements)
Export your data in a portable format
Opt out of marketing communications

To exercise any of these rights, contact us at support@skyemeta.com.

9. Visitors in the EEA and the UK

If you are in the European Economic Area or the United Kingdom, the GDPR or UK GDPR applies to our handling of your personal data.

Controller. Skye Meta Corp, 18 Locust Ave. #115, New Canaan, CT 06840, United States, is the controller of the personal data described in this policy, except as set out below for Bothy members. Contact: support@skyemeta.com.

Bothy members. For member information that a community operator gives us, such as the email addresses entered to send invitations and the community's roster, the community operator is the controller and Skye Meta processes that information on the operator's behalf and on its instructions, as set out in section 5 of the Bothy Operator Agreement. If you are a member, you can direct requests to your community. You can also write to us and we will pass the request on and help the community respond. Skye Meta keeps the do-not-email list for Bothy invites itself, as controller, on the basis of legitimate interests, so an opt-out is respected across every community.

Legal bases. We rely on:

Contract -- to provide what you signed up for or bought: accounts and sign-in, licenses, subscriptions and payments, membership passes, SkyeSkiff credits, and related support and transactional emails
Legitimate interests -- to keep the service secure and available (rate limiting, abuse and fraud prevention), to monitor orders, to answer questions, and to measure site use in aggregate with cookieless analytics. You can object to processing based on legitimate interests
Consent -- for Google Analytics cookies and for the Cross-Market Intelligence newsletter. You can withdraw consent at any time, with the Cookie settings link or the unsubscribe link in any issue, without affecting processing that took place before
Legal obligation -- to keep payment and tax records

International transfers. We are based in the United States, and our service providers process data in the United States. Personal data from the EEA or UK is therefore transferred to the United States. Where the law requires it, we rely on appropriate safeguards offered by our service providers, such as standard contractual clauses.

Your rights. You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent. To exercise any of these, email support@skyemeta.com. We will respond within one month. You also have the right to complain to your local data protection authority, or in the UK to the Information Commissioner's Office.

10. California Residents

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you rights over your personal information.

No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months.
Analytics only with consent. Google Analytics loads only if you agree. We treat a Global Privacy Control signal from your browser as a request to opt out, and Google Analytics then stays off unless you choose otherwise.
Your rights. You can ask to know what personal information we collect, use and disclose, and to access, correct or delete it. We will not treat you differently for using these rights. You can also use an authorized agent.
How to ask. Email support@skyemeta.com. We may need to confirm your identity, usually by replying from the email address on your account, before we act. We respond within 45 days.

The categories of personal information we collect, where they come from, why we use them, and who receives them are described in sections 2 to 4 above.

11. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Material changes will be communicated via email.

13. Contact

For privacy-related questions or requests, contact us at:

Skye Meta Corp
18 Locust Ave. #115
New Canaan, CT 06840
United States
Email: support@skyemeta.com