Privacy policy

How we collect, store, use, and share your personal information — and your rights under POPIA, GDPR, and the laws of South Africa.

Last updated: 21/05/2026 · Effective: 21/05/2026

1. Who we are

SkySignal is operated by SkyL4rk (Pty) Ltd, a company registered in South Africa (Reg. No. 2018/043553/07). For privacy queries, contact privacy@skysignal.co.za.

2. What we collect

We collect the following categories of personal information:

• Account information — your name, email address, a hashed password, and the workspace and company details you provide when you register.
• Billing information — your plan, token balance, and transaction history. Card details are entered directly with our payment processor, PayFast, and are not stored on SkySignal servers.
• Audience data you upload — the contact details of your own recipients (names, email addresses, and any custom fields you import). SkySignal processes this strictly as your Operator under POPIA — see our POPIA page.
• Usage data — records of the campaigns, audiences, sends, and social posts you create, and engagement data such as opens and clicks where you enable tracking.
• Technical and log data — IP address, browser type, device information, and timestamps, captured automatically when you use the service.
• Cookies — a session cookie to keep you signed in. We do not use third-party advertising or cross-site tracking cookies.

3. How we use it

We use your personal information to:

• Provide, maintain, and operate the SkySignal service.
• Authenticate you and keep your account secure.
• Process payments and manage your subscription and token balance.
• Send you service and transactional messages — billing notices, security alerts, and changes to the service. Optional product or marketing emails are sent only where you have opted in.
• Provide support and respond to your enquiries.
• Monitor, troubleshoot, and improve the service.
• Detect, prevent, and address abuse, fraud, and security incidents.
• Comply with our legal and regulatory obligations.

We do not sell your personal information, and we do not use the audience data you upload for any purpose other than delivering the campaigns you send.

4. Lawful basis for processing

We rely on the following grounds under section 11 of POPIA (and, for data subjects in the EU or UK, the corresponding grounds under the GDPR):

• Performance of a contract — processing your account, workspace, and billing data is necessary to provide the service you signed up for.
• Consent — where you have given it, for example to receive optional product updates. You may withdraw consent at any time.
• Legal obligation — to keep financial and tax records and to respond to lawful requests from authorities.
• Legitimate interest — to secure the service, prevent fraud and abuse, and improve our product, balanced against your rights and interests.

For the audience data you import, you are the Responsible Party and must establish your own lawful basis for contacting each recipient. SkySignal processes that data only as your Operator and on your instructions.

5. Sharing & sub-processors

We do not sell or rent personal information. We share it only with the sub-processors needed to run SkySignal, and only as far as each needs it to do its job:

• PayFast — payment processing (South Africa).
• SkySignal — application and database hosting (South Africa).

Email delivery runs on SkySignal's own relay infrastructure, hosted in South Africa — it is first-party and not a third-party sub-processor. Where you choose to configure your own SMTP server instead, delivery occurs through the provider you have selected, under your own arrangements with them.

We may also disclose personal information where required by law, court order, or a lawful request by a public authority, or where necessary to protect the rights, safety, and property of SkySignal, our users, or the public.

6. Your rights

Under POPIA — and, where applicable, the GDPR — you have the right to:

• Be told what personal information we hold about you and how we process it.
• Request access to that information.
• Request that we correct or delete it.
• Object to processing, including for direct marketing.
• Withdraw consent where processing is based on consent.
• Request that we restrict processing or, where technically feasible, port your information.
• Lodge a complaint with the Information Regulator of South Africa, or your local supervisory authority.

To exercise any of these rights, email privacy@skysignal.co.za. We will respond within the timeframes required by law, and we may need to verify your identity before acting on a request.

7. Retention

We keep personal information only as long as we need it for the purposes set out in this policy:

• Account and workspace data — for as long as your account is active. After you close your account, we delete or anonymise it within a reasonable period, except where we are required to retain it.
• Billing and financial records — for the period required by South African tax and company law (generally five years).
• Audience data you upload — for as long as you keep it in your workspace. It is deleted when you delete it, or when you close your account.
• Technical and log data — for a limited period for security and troubleshooting, after which it is deleted or anonymised.

8. Security

We maintain appropriate technical and organisational measures to protect personal information, including:

• Encryption of data in transit using TLS.
• Encryption of sensitive stored values, such as access credentials and integration tokens.
• Passwords stored only as salted hashes — never in plain text.
• Role-based access controls, so workspace members see only what their role permits.
• Audit logging of imports, sends, and significant account activity.
• Access to production systems granted on a least-privilege basis.

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. If we become aware of a compromise affecting your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

9. Contact & complaints

Information Officer: Michael Beuster · privacy@skysignal.co.za.

If you have a concern about how we handle your personal information, please contact us first so we can put it right. You also have the right to complain to the Information Regulator of South Africa: inforegulator.org.za.