PRIVACY POLICY

1. INTRODUCTION

Skyward LLC (“Skyward,” “Company,” “we,” “us,” or “our”) operates the Skyward Traffic Intelligence Platform (“TIP” or the “Platform”), available at [Website URL], which allows business customers (“Customers,” “you,” or “Platform Users”) to submit SMS traffic data — in real time via API, or in bulk by uploading a file (e.g., .csv or .xlsx) — for automated, machine-learning-based fraud detection and traffic classification.

This Privacy Policy explains how we handle personal data. Because the Platform involves two distinct data relationships, this Policy is organized to keep them clearly separate. Please read Section 2 first — it explains which part of this Policy applies to you and why.

2. TWO ROLES: HOW WE HANDLE DATA ABOUT YOU VS. DATA YOU SUBMIT

We act in two different capacities, and different rules apply to each.

(a) As a Controller — Data About Platform Users
When you register for an account or use the Platform, we collect information about you as the Platform User (e.g., name, email, company name, contact details, usage and log data). For this data, we decide why and how it is processed, and we act as a “controller” under the GDPR. Section 4 describes this data in full.

(b) As a Processor — SMS Data You Submit for Analysis
When you submit SMS traffic data — via real-time API or by uploading a file — for us to analyze, we do so only on your instructions and for the purpose of providing the analysis to you. You are the Data Controller for this data, and we act as your Data Processor. Our processor obligations are set out contractually in the Data Processing Terms incorporated into our Terms of Service (Section 13 there), which govern in the event of any conflict with this Policy as to submitted SMS data. Section 5 below summarizes our practices for transparency.

3. DEFINITIONS

• “Account Data” means information you provide to register for and administer a Platform account.
• “Submitted Data” / “Customer Content” means the SMS traffic data — whether sent via API or contained in an uploaded file — that a Platform User submits to the Platform for analysis, as described in Section 5.1.
• “Data Subject” means an identified or identifiable individual, including both Platform Users (for Account Data) and the third parties referenced within Submitted Data (e.g., the senders or recipients of an analyzed SMS message).
• “Analysis Output” means the fraud-detection results, classifications, or reports generated by our ML algorithms based on Submitted Data.

4. SECTION A — INFORMATION WE COLLECT AND PROCESS AS A CONTROLLER

This Section covers data about you, the Platform User. It does not apply to Submitted Data (see Section B).

4.1 Information You Provide to Us

• Account & registration data: name, email address, company name, and other business contact details you provide when registering.
• Communications: content of support tickets, emails, or messages you send to our team.

We do not currently collect billing information through the Platform itself. If you enter into a Commercial Agreement for paid, non-trial use, that agreement (and any related invoicing) may involve additional information, handled under its own terms.

4.2 Information Collected Automatically

• Technical and usage data: IP address, API request logs, browser type, and device information.
• Platform activity: features used, timestamps, and actions taken within the Platform (this covers your use of the Platform — not the content of files you upload for analysis, which is addressed in Section B).

4.3 How We Use Account Data

Purpose	Legal Basis (GDPR)
Providing the Platform (fraud detection, traffic classification)	Performance of a contract — Art. 6(1)(b)
Improving Platform accuracy and performance (Platform operation only — see Section 5.4 regarding ML models specifically)	Legitimate interest — Art. 6(1)(f)
Compliance with legal and regulatory obligations	Legal obligation — Art. 6(1)(c)
Responding to support requests and inquiries	Performance of a contract — Art. 6(1)(b)

5. SECTION B — SMS DATA YOU SUBMIT FOR ANALYSIS (WE ACT AS A PROCESSOR)

5.1 What Submitted Data Includes

• Full text of the SMS message
• Sender ID (SID)
• Sender and recipient phone numbers
• Message timestamp and message ID
• Other technical parameters needed to process the message (e.g., the SMS User Data Header, or “UDH”) — this is routing/protocol-level metadata, not personal data in itself

The individuals referenced in Submitted Data (e.g., the sender or recipient of an analyzed SMS) are not our customers and typically have no direct relationship with us.

5.2 Methods of Submission

Method	Description
Real-time API	SMS messages submitted individually via HTTP API for immediate analysis.
File Upload	Bulk SMS data uploaded in file format (e.g., .csv, .xlsx) containing the fields listed in Section 5.1.

5.3 Our Role: We Process Submitted Data Only on Your Instructions

• Run the requested ML-based fraud detection and classification analysis and generate Analysis Output;
• Maintain the security, integrity, and availability of the Platform;
• Comply with our legal obligations, within the retention limits described in Section 5.5.

We do not sell Submitted Data, and we do not use it for our own marketing.

5.4 We Do Not Use Submitted Data to Train or Tune Our ML Models

We do not use Submitted Data — SMS content, phone numbers, or associated metadata — to train, fine-tune, or otherwise adjust the accuracy of our machine-learning models, whether in identifiable, de-identified, or aggregated form. Our ML models are pre-trained exclusively on synthetic and/or anonymized data unrelated to Customer Content. The only related practice is the anonymized fraud-pattern reference examples described in Section 5.5, which are used for internal analyst reference, not for model training.

5.5 Retention and Deletion of Submitted Data

Data Type	Retention Period
SMS content (API)	Not stored after analysis. Temporary processing cache is deleted immediately.
SMS content (file upload)	Not stored after processing. The uploaded file may be retained by you and can be deleted by you at any time; Skyward does not store file contents after processing completes.
Metadata (sender/recipient numbers, timestamps, message ID, Destination, and other technical parameters such as UDH)	Up to 90 days, for billing and dispute resolution.
API access logs	Up to 365 days, for security auditing.

After the applicable retention period expires, data is automatically and permanently deleted.

5.6 Anonymized Fraud-Pattern Reference Examples

To help our team recognize and document known fraud patterns, we may retain anonymized examples of fraudulent SMS text. These retained examples:

• contain only the SMS text itself — no sender/recipient numbers, timestamps, message IDs, Destination, or other identifying metadata;
• cannot be linked to any specific Customer or data subject;
• are used solely for internal reference and documentation — not, per Section 5.4, to train or tune our ML models.

5.7 If You Are an Individual Referenced in Submitted Data

If your phone number or other personal data was submitted to the Platform by one of our Customers, please contact that Customer directly, as they control the collection and use of your data. If you are unable to identify or reach the relevant Customer, you may contact our Data Protection Officer at dpo@skyward.cc and we will reasonably assist, including forwarding your request to the relevant Customer where required by law.

6. HOW WE SHARE INFORMATION

We do not sell, rent, or trade personal data. We may share data with:

Recipient Category	Purpose	Legal Basis
Sub-processors (e.g., hosting providers)	Infrastructure services	Processor agreement — GDPR Art. 28
Law enforcement / regulators	Compliance with legal requests	Legal obligation — Art. 6(1)(c)
The Customer (your counterparty)	Delivering Analysis Output	Performance of a contract — Art. 6(1)(b)

6.1 Current Sub-processors

Sub-processor	Service	Location	Certification
Hetzner Online GmbH	Hosting	Germany	ISO 27001

This list is incorporated into the Data Processing Terms in our Terms of Service, Section 13.5, and updated there when sub-processors change.

7. INTERNATIONAL DATA TRANSFERS

All data is processed within the European Economic Area (EEA). We do not transfer data outside the EEA, except: (a) to countries covered by an adequacy decision of the European Commission; or (b) under Standard Contractual Clauses (EU 2021/914) with appropriate safeguards.

8. RETENTION OF ACCOUNT DATA

Account Data is retained until account deletion or termination of the contractual relationship, after which it is deleted in accordance with our standard deletion practices, save where we are required to retain records for a longer period by law.

9. YOUR RIGHTS UNDER GDPR

As a data subject, you have the following rights:

9.1 Complaints

If you believe your data protection rights have been violated, you may lodge a complaint with a supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

10. SECURITY MEASURES

• In transit: TLS 1.2+ encryption for all API communications.
• At rest: AES-256 encryption for logs and backups.
• Access control: Role-based access, multi-factor authentication, and audit logs.
• Infrastructure: ISO 27001-certified hosting providers.
• Network: VPN-only access to servers, with IP whitelisting.

No system is completely secure; we cannot guarantee absolute security. These measures are also set out in the Data Processing Terms (ToS § 13.6).

11. COOKIES AND TRACKING

Our website uses essential cookies for functionality only. We do not use tracking or analytics cookies without your consent.

12. CHILDREN'S PRIVACY

The Platform is intended for use by business Customers and is not directed at individuals under the age of 18. We do not knowingly collect Account Data from individuals under 18. If Submitted Data happens to reference minors (e.g., a phone number belonging to a minor), the Customer submitting that data is solely responsible for ensuring a lawful basis exists for its collection and use, per the Terms of Service.

13. AUTOMATED PROCESSING

The Platform generates Analysis Output using probabilistic, machine-learning-based fraud detection and classification. Analysis Output may include false positives and false negatives, is provided to the Customer (not the underlying data subjects) to inform — not replace — the Customer's own decisions, and the Customer assumes full responsibility for decisions made in reliance on it, as set out in the Terms of Service.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Policy from time to time. Changes will be posted on this page with an updated date. For material changes, we will notify you via email or through the Platform.

15. CONTACT US

Data Controller: Skyward LLC
Address: 43 Olimlar Street, Mirzo-Ulugbek District, Tashkent, 100164, Republic of Uzbekistan
Data Protection Officer: dpo@skyward.cc
General inquiries: info@skyward.cc
Technical support: support@skyward.cc