Privacy Policy

Effective date: July 17, 2026

Last updated: July 17, 2026

This Privacy Policy explains how Skybits collects, uses, shares, and protects your personal data when you use the Skybits collaborative document editor and related services (the "Service") or visit our website at skybits.ai (the "Site"). Skybits is operated by Skywood AI, Inc. ("Skywood," "we," or "us"), 855 El Camino Real, #13A-222, Palo Alto, California 94301, USA.

The Service is currently offered as a free Beta release. It is free of charge, we do not process payments, and some features described in this Policy may change as the product evolves. This Policy applies to users in the United States, the European Economic Area (EEA), the United Kingdom, Switzerland, and elsewhere.

Please read this Policy carefully. If you do not want us to handle your data as described here, please do not use the Site or the Service.

1. Our Role: Controller and Processor

For your account data and how you use the Service, Skywood is the data controller — we decide how that data is handled, as described here.

For the content inside your documents, Skywood is a data processor — we store and process it only on your instructions (or your organization's). When you enable the Skybits AI agent or connect another AI assistant, we process the document content, prompts, instructions, generated output, and tool activity needed to carry out the actions you request.

2. Information We Collect

a. Account and identity data

Sign-in is managed by our identity provider, WorkOS. We keep a thin profile: your WorkOS user ID, display name, and email address. Your name and ID also appear on documents, versions, comments, tags, shares, and email invitations you send or receive.

We do not collect avatars, phone numbers, postal addresses, dates of birth, or financial information.

b. Document content and metadata

When you create and edit documents, we store the document content; its title, owner, tags, and sharing permissions; version and edit history attributed to each actor (human or AI agent); comments with their author; and uploaded images with basic file details.

Document content is supplied by you and may contain personal data of your choosing. You are responsible for the personal data you place in documents.

c. AI agent data

When you enable the Skybits AI agent or connect an external AI assistant, we may process the agent identity, the authorizing user, the documents and tools the agent can access, prompts or instructions you provide, generated output, feedback submitted through the report-a-problem tool, and request metadata such as IP address and browser/user-agent.

We store your Skybits AI Agent interaction history, including prompts or instructions, generated output, and related context, so you can review past interactions and so we can provide, debug, secure, and improve the Service. AI model requests are processed to respond to your prompt or instruction. Prompts, generated output, and related request details may also appear in logs, debugging traces, support tools, and Datadog telemetry when needed to operate, debug, secure, and improve the Service.

Our agent audit log records which tool ran, on which document, when, who or what initiated it, and whether it succeeded. We use these records to enforce permissions, debug issues, protect security, and investigate misuse.

d. Usage and device data

We use Datadog to monitor reliability, performance, and security. Datadog may process your email, name, user ID, approximate location from your IP address, device and browser details, pages viewed, performance data, and sampled session replays. Session replays are sampled at 20%. We configure replay masking so text and input contents are masked by default. Where the law requires consent for Datadog cookies or similar technologies, we load them only after you consent through CookieBot.

e. Cookies

We use a secure session cookie to keep you signed in. We use CookieBot to collect and manage cookie choices. With your consent, we use Google Analytics cookies to understand how the Site and Service are used, and we use Datadog cookies or similar technologies for monitoring where consent is required. We do not use cookies for advertising. You can change your choices through the CookieBot banner or your browser settings, and you can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

f. Website visits and contact forms

If you browse skybits.ai without an account, we collect standard technical data (IP address, browser, pages viewed, timestamps) and anything you submit through contact, demo, waitlist, or feedback forms. If you subscribe to updates, we keep your email and preferences; you can unsubscribe at any time via the link in our emails.

3. How We Use Your Data

We use personal data to:

provide, operate, and maintain the Service, including real-time collaboration and version history;
authenticate you and enforce document permissions and sharing;
run the Skybits AI agent, when you enable it, and let AI assistants you connect read, draft, summarize, and apply the edits or actions you request;
send transactional emails such as share and invite notifications;
monitor, debug, secure, and improve the Service;
respond to support requests and feedback; and
comply with legal obligations and enforce our Terms and Conditions.

We do not sell your personal data. We do not share your data with marketing platforms, advertising networks, or data brokers, and we never use your documents or usage data to build advertising profiles.

4. Legal Bases (EEA / UK / Switzerland)

Where the law requires a legal basis, we rely on: contract to provide the Service and AI features you enable or request; legitimate interests to secure, debug, and improve the Service where those interests are not overridden by your rights; legal obligation to meet legal duties; and consent where required, including for certain analytics, monitoring, or replay cookies. You may withdraw consent at any time.

We share personal data only with the service providers that help us run the Service, when the law requires it, or to protect rights and safety. Our current subprocessors are:

WorkOS — authentication and identity (email, name, user ID, SSO membership);
Datadog — monitoring and observability (identity, IP-derived location, performance data, and masked sampled session replays where enabled);
Amazon Web Services (AWS) — hosting and infrastructure in the United States (stores and transmits documents, profiles, comments, images, and outbound emails on our behalf);
Google LLC (Gemini models) — AI model processing for the Skybits AI agent (prompts, document excerpts, instructions, generated output, and related request metadata), used only to provide requested AI features and not to train Google models on Skybits customer data;
Google Analytics — website and product analytics (usage data such as pages viewed, device and browser details, and approximate location), used only to understand and improve the Site and the Service — never for advertising or ad personalization; and
CookieBot — cookie consent management (your consent choices and related technical data), used to honor your cookie preferences.

These providers may access your data only to perform services for us and are contractually prohibited from using it for their own purposes, including marketing. As of the Beta release, we do not use a payment processor or a third-party email vendor, and we do not work with any advertising network or data broker. If we introduce paid plans, we will add the payment processor to this list and update this Policy before it takes effect.

The list above in this Section 5 is our current, complete list of subprocessors and service providers, and this Policy is where you can always check it. We will update this Section and give 14 days' notice before adding a new subprocessor.

Business transfers. If Skywood is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will use reasonable efforts to ensure the recipient handles it consistently with this Policy.

Aggregated data. We may share aggregated or de-identified information that does not identify you — but never with marketing platforms, advertising networks, or data brokers, and never to build advertising profiles.

6. AI Features and Agents

Skybits offers AI features, including the Skybits AI agent. You may also connect AI assistants of your choosing, for example through an MCP connector or the Skybits Skill.

Skybits AI agent. The Skybits AI agent is off by default. It is not attached to your account and does not work with your account data unless you enable it in your account settings. After you enable it, the agent acts only when you give an explicit prompt or instruction.

When you use the Skybits AI agent, we process the document content, prompts, instructions, comments, metadata, generated output, and other context needed to respond to your request. The agent may read, summarize, draft, edit, organize, or otherwise act on documents according to the permissions and actions you authorize. The agent is isolated through the Skybits Skill and can access only the encrypted account data and document permissions available to it.

Model providers. The Skybits AI agent currently uses Google Gemini models. We may support additional model providers in the future. If we add another AI model provider as a subprocessor, we will update Section 5 before that change takes effect. We require our AI model providers not to train their models on Skybits customer data.

Your connected AI assistants. If you connect an external AI assistant, that assistant is operated by you and the AI provider you selected. Content the assistant accesses is processed under that provider's privacy terms, not ours. Please review its privacy practices before connecting it.

Scope and revocation. AI agents can access only the documents and actions authorized for them, subject to the same roles as collaborators. You can revoke a connection or agent access at any time from your account.

No model training. We do not use your document content, prompts, or generated output to train Skybits AI models or third-party foundation models unless you give us express permission.

7. Data Retention and Deletion

Documents. A deleted document moves to Trash, where you can restore it for 30 days. After that it is automatically and permanently deleted from our live systems, together with its history, permissions, and images.

Backups. Encrypted backups provide point-in-time recovery for about 14 days, and scheduled snapshots are kept for 30 days. Deleted data may persist in backups for that limited period; we do not use backups to restore deleted accounts or documents.

Account data. Your profile, audit logs, Skybits AI Agent interaction history, AI request logs, debugging traces, support records, and uploaded images are kept while your account is active or as otherwise needed to provide, secure, debug, and improve the Service. Identity records are held by WorkOS.

Account deletion. To delete your account, email us at the address in Section 12. We will verify your identity, then delete your personal data and the documents you solely own from active systems within the time required by law. We currently handle account deletion manually across our systems and subprocessors. Self-serve account deletion and data export are not yet available.

Shared documents. Because Skybits is collaborative, documents you shared with others, and your contributions (edits and comments) to documents owned by others, may remain available to those collaborators after your account closes, to preserve the integrity of their work. If you want specific shared content removed, contact us and we will address it in line with applicable law.

8. Security

We apply administrative, technical, and organizational measures to protect personal data, including:

Encryption in transit: TLS 1.2+ for all connections, with managed certificates;
Encryption at rest: AES-256 across our data stores, with keys managed through AWS KMS or S3-managed keys;
Network controls: data stores run in private subnets, are not publicly accessible, and are reachable only from the application;
Access controls: least-privilege access, per-workload roles, a fail-closed permission model for documents and agents, and production access limited to authorized personnel on a need-to-know basis;
Authentication: WorkOS sign-on with verified tokens, encrypted session cookies, hashed connector keys, and configurable multi-factor authentication; and
Audit logging: infrastructure and application audit trails covering connector lifecycle, sharing changes, and agent authorization decisions.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your account credentials secure. We do not currently hold SOC 2, ISO 27001, or similar certifications.

9. International Data Transfers

We and our subprocessors are located in, or transfer data to, the United States. When we transfer personal data from the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum or Swiss equivalents, where applicable), backed by Data Processing Addenda with our subprocessors.

10. Your Privacy Rights

a. EEA, UK, and Switzerland

You have the right to access, correct, delete, and port your personal data; to restrict or object to certain processing (including direct marketing); and to withdraw consent where processing is based on consent. You may also lodge a complaint with your local supervisory authority. For GDPR purposes, Skywood is the controller of your account and usage data.

b. United States

If you live in a U.S. state with a comprehensive privacy law, you may have rights to know what personal information we collect, access it, correct it, delete it, receive a portable copy, and opt out of sales, targeted advertising, or certain profiling. We do not sell personal information, share it for cross-context behavioral advertising, or use it for profiling that produces legal or similarly significant effects. California residents may also request our empty list of disclosures to third parties for direct marketing under the "Shine the Light" law. Nevada residents may submit opt-out requests, though we do not sell data covered by that statute.

c. How to exercise your rights

Email us at the address in Section 12. We will verify your identity before acting and respond within the timeframes required by law. We will not discriminate against you for exercising your rights.

d. Do Not Track

Some browsers offer a "Do Not Track" signal. The Site does not currently respond to these signals — but as stated throughout this Policy, we do not share your data with third-party marketing platforms regardless.

11. Children's Privacy

The Site and the Service are not directed to children under 16, and we do not knowingly collect personal data from anyone under 16. If you are under 16, do not use the Service or provide any information to us. If you believe a child under 16 has given us personal data, contact us and we will delete it.

12. Contact Us

For privacy questions or to exercise your rights:

Skywood AI, Inc.
855 El Camino Real, #13A-222
Palo Alto, California 94301, USA

General and privacy inquiries: info@skywood.ai
Legal: legal@skywood.ai

13. Third-Party Links

The Site and the Service may link to third-party websites. We are not responsible for their privacy practices, and a link is not an endorsement. Review the privacy policy of any third-party site before providing information to it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date. For material changes, we will notify you by email or through the Service where required. The updated Policy applies from the date stated at the top unless we say otherwise.

For more information, contact: Skywood AI, Inc., 855 El Camino Real, #13A-222, Palo Alto, California 94301 — info@skywood.ai