Privacy Policy

3.1 Account and billing information

Where you subscribe directly, this is collected and processed on our behalf by Polar Software Inc. (“Polar”), our merchant of record and licensing provider.

3.2 API credentials

3.3 Usage and metering data

Necessary to bill you correctly and to enforce plan quotas.

3.4 Technical and security data

IP addresses are personal data under the GDPR even where we cannot link them to a named individual, and we treat them as such.

3.5 Webhook configuration

If your plan includes webhooks, we store the destination URL you supply, the event types, your filters, the creation timestamp, and a delivery failure counter. Do not put credentials, tokens, or personal data in a webhook URL — use a header or a signed path instead.

3.6 Support communications

If you use Priority WhatsApp Support, we process your phone number and the content of your messages. WhatsApp is operated by Meta Platforms, and your use of it is additionally governed by Meta's own privacy terms, which we do not control. Email support correspondence is processed similarly.

3.7 Website and cookies

The API endpoints themselves set no cookies and use no tracking technologies. This website uses:

• Google Ads conversion tracking (the gtag.js tag), to measure advertising performance — a site-wide tag, plus conversion events when a checkout completes, when a FREE Trial application is submitted, and when a Data Marketplace purchase completes. These tags run under Google's Privacy Policy and only after you accept cookiesin the consent banner shown on your first visit. You can change your choice by clearing this site's data, and opt out of personalised advertising via Google Ads Settings.
• Netlify bot protection on all forms, using honeypot fields and automated detection. No third-party CAPTCHA service is used.
• Umami (cloud.umami.is) for aggregate traffic analytics. Umami is cookieless — it sets no cookie and stores no identifier on your device, so it runs without consent. It processes your IP address transiently to derive approximate country and does not retain it.
• Sled (usesled.com), a site-wide tag used for marketing attribution — understanding which channels and campaigns bring visitors to the site. This tag loads only after you accept cookies; if you reject, it is never added to the page.

If you subscribe to our newsletter or opt in to updates, we send service announcements, product updates, and editorial content. You can unsubscribe from any email, or by contacting us.

3.8 AI-generated content (Cloudflare Workers AI)

Certain API features — specifically the AI Flight Briefing endpoint — use Cloudflare Workers AI to generate natural-language summaries from aviation data. When you use these features, the relevant aviation data (METAR, NOTAMs, PIREPs) is sent to Cloudflare Workers AI for processing within Cloudflare's infrastructure, under Cloudflare's Privacy Policy and their Workers AI terms. AI-generated briefings are informational only and must not be relied upon for safety-critical flight decisions (Terms of Use §11).

3.9 Aviation data and third-party individuals

The Service returns aviation data including aircraft registrations, ADS-B positions, callsigns, and flight movements. Some of this can constitute personal data where an aircraft is owned or operated by an individual rather than a company — a privately registered tail number can identify a natural person and reveal their movements.

• Where we process such data, our legal basis is legitimate interests (Art. 6(1)(f)) in operating an aviation information service, balanced against the fact that the underlying broadcasts are unencrypted, publicly transmitted, and already published by aviation authorities and community networks.
• Individuals whose data appears in the Service may exercise the rights in §8 — contact us and we will assess suppression of a specific registration.
• You, as a customer, become an independent controller of any such data you retrieve and retain. Terms of Use §8 applies.

3.10 Tally forms

This website shows a form operated by Tally (tally.so). If you fill it in, we collect what you submit — typically your name, email address, phone number and your answers.

By submitting the form and ticking its privacy policy checkbox, you agree that we may use this information to:

• contact you by email or by phone about your answers, your use case, or SkyLink API plans and services; and
• send you marketing communications, such as product updates, offers and news about SkyLink API.

This processing is based on your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time — use the unsubscribe link in any marketing email, tell us when we call, or write to [email protected]. Withdrawing consent does not affect contact that took place before it, and we will not sell these details or share them with third parties for their own marketing.

5.1 Recipients we disclose to

We do not sell your personal information. We disclose it only to:

Each processor is engaged under a written data processing agreement meeting Art. 28 GDPR. We will also disclose data in connection with a merger, acquisition, or asset sale, subject to notifying you.

5.2 Sources we receive personal data from

The parties below are not recipients of disclosures from us. Data flows the other way: they are platforms you chose to use, and they pass your data to us so that we can serve you.

8.1 Under the GDPR / UK GDPR

You have the right to: access your data; rectify inaccurate data; erase it (“right to be forgotten”); restrict processing; data portability; object to processing based on legitimate interests; and withdraw consent at any time without affecting prior lawful processing.

To exercise these rights, contact [email protected]. We respond within one month, extendable by two further months for complex requests. There is no charge unless a request is manifestly unfounded or excessive.

You may lodge a complaint with your supervisory authority. UK residents may complain to the ICO (ico.org.uk).

8.2 Under the CCPA/CPRA (California)

In the preceding 12 months we have collected the following statutory categories:

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. We have not done so in the preceding 12 months. We do not knowingly collect or sell the personal information of consumers under 16.

California residents have the right to know, delete, correct, opt out of sale/sharing (not applicable here), limit use of sensitive personal information (not applicable here), and to non-discrimination for exercising these rights. You may use an authorised agent, who must provide written proof of authorisation.

To exercise these rights, email [email protected] or use our contact form. We verify your identity by matching your request against the account email and subscription records, and respond within 45 days, extendable once by a further 45.

8.3 Other US states

Residents of states with comparable privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana — have equivalent rights of access, correction, deletion and portability. Use the same contact route as §8.2.

Breach notification

Where a personal data breach is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours of becoming aware of it (Art. 33), and we notify you without undue delay where the risk is high (Art. 34). We maintain an internal breach register.