Privacy Policy

Last updated: 2 October 2026. Skylabely is a service operated by To The Sky (Malta), contact: contact@skylabely.com.

What Skylabely is

Skylabely reads your store's product feed, cleans it, labels it by your rules and sends it to advertising channels (Google Merchant Center, Meta, TikTok, ChatGPT and others). The data we process is your store's data and, if you choose, the numbers from your advertising accounts.

Data we process

• Your account: email address and password (stored only in hashed form), organisation name.
• Your product feed: titles, descriptions, prices, stock, links, images and the other fields you give us by link or file.
• Google data (only if you press "Connect with Google"): we read per-product performance from your Google Ads account (clicks, cost, conversions, revenue) and product statuses from Merchant Center, we read the reports of the Google Analytics 4 property you choose (sessions, conversions and revenue per product, read-only), and we write to Merchant Center the products and labels you approved. We also see the email address of the connected Google account, so you know which account is linked.

How we use Google data

Data received through Google APIs is used only for the features you see in the app: performance labels, alerts, the campaign plan, Analytics figures next to products, sending products to Merchant Center. We do not sell it, do not use it for our own advertising, do not share it with other companies and do not use it to train artificial intelligence models. The access token is stored encrypted in our database and can be revoked at any time from the app ("Disconnect") or from your Google Account at myaccount.google.com/permissions.

Skylabely's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we secure Google user data

Data received through Google APIs (Google Ads, Merchant Center, Google Analytics) is protected as follows:

• Encryption in transit: every transfer between your browser, our servers and Google's APIs uses HTTPS only (TLS 1.2 or newer).
• Encryption at rest: the database (Supabase, data centre in the European Union) is encrypted on disk. Each store's Google access token is additionally encrypted by the application with AES-256-GCM, using a key kept only in the server configuration, never in the database or in the code.
• Limited access: a store's data is visible only to the members of the organization that owns the store, enforced at the database level (row level security). Google tokens are never sent to the browser; only the server uses them. There is no routine human access to your data; administrative access is limited to the people operating the service, only for troubleshooting, and is logged.
• Minimisation: we request only the permissions the app's features need and read only per-product figures, product statuses and the properties you choose.
• Deletion: "Disconnect" in the app deletes the store's Google token immediately; removing a tool (Google Ads, Merchant Center, Analytics) deletes the figures read from it; deleting the store or the account deletes all of its data. You can also revoke access at any time from your Google Account.
• Incidents: if we learn of unauthorised access to your data, we notify you by email within 72 hours and inform the competent authority under the GDPR.

Who helps us process data

Hosting and database: Vercel and Supabase (European Union). Artificial intelligence features (rule writing, titles, translations, categories) run on Google Cloud Vertex AI; we send only product text, never account or advertising data beyond the requested purpose. Alert emails are sent through Resend.

Retention

For as long as you have an account. When you delete the account or a store, the store's data (feed, rules, numbers, connections) is deleted. Database backups rotate within 30 days.

Your rights

You can request access, correction, export or deletion of your data at any time by writing to contact@skylabely.com. We answer within 30 days.

Cookies

The marketing site uses no tracking cookies. The app uses only what is needed to keep you signed in.