1. Who processes the data and what this Policy covers
SkyInbox is operated, hosted and supported by SKILLS IT SOLUCOES EM TECNOLOGIA LTDA, trading as Skills IT, Brazilian company registration (CNPJ) 05.699.856/0001-10, Quadra ACSE 1, Rua SE 1, nº 38, sala 10, 2º andar, Plano Diretor Sul, Palmas–TO, CEP 77020-014, Brazil. Privacy contact: contato@skyinbox.com.br. Data protection officer: Adriano Fante, through the same contact.
This is the single Privacy Policy of SkyInbox: it covers the website skyinbox.com.br, the service dashboard at app.skyinbox.com.br, the pipelines and features at kanban.skyinbox.com.br, the chatbots published by Skills IT and the connected channels.
2. Three people, three roles
A customer service platform involves three different people with data at stake, and the LGPD (Brazil's General Data Protection Law) treats each one differently. Almost every question about responsibility is settled here.
| Who | Which data | Role of Skills IT |
|---|---|---|
| Website visitors | Contact sent through the form and, with consent, audience measurement | Controller |
| The customer company and the dashboard users | Registration, billing, credentials, access and activity logs | Controller |
| The customer company's own customer, the person who messages the company on WhatsApp, Instagram, email or the chat on its website | Conversations, attachments, contact details, notes and data collected by chatbots | Processor, on behalf of and under the instructions of the customer company, which is the controller |
In the third case, it is the customer company that decides what is collected and why. Skills IT processes that data within the limits of the Data Processing Agreement, and the privacy policy that applies to that person is the one of the company they spoke to.
3. What data is processed
On the website. Name, company, email, phone number, team size and any free text written in the contact form. The request reaches the Skills IT sales team by email and is recorded in the company's sales system, together with the IP address it was sent from, used only to block automated bulk submissions and deleted within 180 days. With consent, audience and performance measurement data is also processed, as described in the Cookie Policy.
On the platform. Registration data of the company and of dashboard users (name, email, access profile, Google identity when that sign-in is chosen), access and activity logs, and the content of customer service conversations: messages, attachments, audio, images, contact details, labels, notes, pipeline cards and answers collected by chatbots.
What we do not ask for. The website does not ask for identity documents, bank details or sensitive information in any form. A request of that kind on behalf of SkyInbox outside the dashboard is not ours.
4. Purposes and legal bases
Where Skills IT is the controller, each purpose has its own legal basis (article 7 of the LGPD):
| Purpose | Legal basis |
|---|---|
| Replying to a contact made through the website | Preliminary steps related to a contract, at the data subject's request |
| Providing the contracted service: creating accounts, connecting channels, keeping the dashboard running and providing support | Performance of a contract |
| Invoicing and collection | Performance of a contract and compliance with legal and tax obligations |
| Platform security: access logs, login attempt limits and abuse prevention | Legitimate interest, balanced against the impact on the data subject, and legal obligation regarding logs |
| Measuring the website's audience and performance | Consent, collected in the cookie notice and revocable at any time |
| Exercising rights in judicial, administrative or arbitration proceedings | Regular exercise of rights |
For customer service conversations, the legal basis is defined by the customer company, which is the controller. Skills IT processes that data under its instructions.
5. What Sky does with the content
Sky is the artificial intelligence in SkyInbox. To answer a customer, it reads the ongoing conversation and the articles in that company's knowledge base and generates the reply from them.
- No cross-account use. One company's knowledge base and history never feed the reply given to another company's customer.
- There is third-party processing. Text generation uses a language model provider contracted by Skills IT, to which the necessary excerpt of the conversation is sent at the time of the reply. The knowledge base is converted into search vectors by a provider of the same kind. The providers are listed under subprocessors.
- No training on your data. Neither Skills IT nor the model providers it contracts use messages, documents or generated replies to train artificial intelligence models.
- Sky may record notes about a contact, to give context to the next conversation. These notes are visible to the team, can be edited and deleted, and are removed together with the contact.
- The company sets her limits, including switching her off on any channel. What she answers and what she hands over is described in what Sky does not do.
6. Who the data is shared with
Skills IT does not sell personal data or share it for third-party advertising. Data is shared only with those needed for the service to work:
- the subprocessors that host the platform, generate Sky's replies and deliver the website, listed under subprocessors;
- the channel operators that the customer company chooses to connect (Meta for WhatsApp, Instagram and Messenger, Telegram, email providers and others). Without them messages can neither arrive nor be sent, and each has its own terms, accepted by the company when connecting the account;
- services contracted directly by the customer company and connected by it, such as Twilio, Bandwidth, Dialogflow or video providers, which are governed by the contracts between them;
- public authorities, when there is a legal order. In that case Skills IT notifies the affected customer, unless the order itself forbids it.
7. How long data is kept
| Data | Period |
|---|---|
| Contact made through the website | For as long as the sales conversation lasts and up to 12 months after it, to resume the conversation. Deletion can be requested earlier |
| Contact form IP address | Up to 180 days |
| Customer service conversations | For the duration of the contract, with full history on every plan. The customer company may request deletion earlier. On termination, export can be requested within 30 days, after which the data is deleted |
| Registration and billing | For the duration of the contract and, after it, for the periods required by tax and civil law |
| Access logs | For the period set out in Brazil's Civil Rights Framework for the Internet (Marco Civil da Internet) |
| Backups | Daily routine with 7-day retention. Deleted data leaves the service immediately and disappears from backups at the end of that cycle |
8. Data subject rights
Article 18 of the LGPD guarantees, over your personal data, the rights of confirmation and access, correction, anonymisation, blocking or deletion, portability, information about sharing, withdrawal of consent and objection. The full procedure, with deadlines, is in data protection and your rights.
Anyone who is a customer of a company that uses SkyInbox and wants to exercise these rights over the conversation they had with it should send the request to that company, which is the controller. If the request reaches Skills IT, it is forwarded to the company and the person is informed.
9. Security
The measures in place are described on the security page: own infrastructure administered by Skills IT, isolation of data and knowledge base by company, encryption in transit, passwords stored encrypted, login attempt limits, permission profiles, audit trail from the Business plan upwards and daily backups with seven-day retention.
Skills IT does not claim any formal security certification: it holds neither SOC 2 nor ISO 27001. If a security incident poses relevant risk or harm to data subjects, the affected customers and the ANPD (Brazil's data protection authority) are notified within the legal deadlines.
10. International transfers
Some of the providers needed for the service process data outside Brazil: the cloud provider, the channel operators and the artificial intelligence providers used by Sky. These transfers take place to perform the contract and follow the safeguards required by chapter V of the LGPD in the contracts signed with each provider. The list of subprocessors identifies each one.
11. Children and adolescents
SkyInbox is a work tool and is not intended for people under 18. Skills IT does not intentionally collect data from children and adolescents on the website. If the customer company serves this audience through the connected channels, it is up to the company, as controller, to obtain parental consent as required by article 14 of the LGPD.
12. Changes to this Policy
Each version of this Policy remains published at its own dated address. When a change materially alters how data is processed, customers are notified by email before it takes effect.
The Portuguese, English and Spanish versions describe the same processing. In case of any divergence, the Portuguese version prevails.