Effective Date: 04/08/2026

This Privacy Policy describes how Signull Labs Inc. ("Company," "we," "us," or "our") collects, uses, retains, and shares personal data in connection with the Skye mobile application (the "App" or "Services").

BY USING THE APP, YOU CONSENT TO THE PRACTICES DESCRIBED HEREIN. You represent that you are at least 13 (16 in the EEA/UK/Switzerland).

We update this Policy with at least 30 days' notice for material changes.

Section 1: Who We Are

Signull Labs Inc., 12 E 14th St. 3F, New York, NY 10003, USA. Web: signulllabs.com

We act as data controller for personal data described here, except where processing strictly on your behalf.

Table 1: Sub-Processors

The following third-party service providers process data on our behalf:

We will notify users via email or in-App notification at least 30 days before adding a new sub-processor that processes personal data in a materially different way. This table reflects all sub-processors as of the Effective Date.

Section 2: Data We Collect

2.1 Account Information

• Name and email address
• Apple Sign-In credentials and account identifiers
• Account preferences and configuration

2.2 Connected Service Data

When you connect services, we sync and temporarily store data per our retention schedule:

• Email content and metadata (Gmail)
• Calendar events and schedules
• Messaging data (Slack)
• Music preferences (Spotify)
• Health and fitness data (Apple Health) — Sensitive Data
• Financial data and transactions (Plaid) — Sensitive Data
• Reminders and tasks
• Package tracking and delivery info (parsed from email)
• Additional services you explicitly connect

2.3 Location Data

Calendar/email addresses, Apple location services (with permission), IP geolocation. Used for commute estimates, weather, nearby recs. Controllable via settings.

2.4 Technical and Usage Data

• IP address (security only), device info, OS, app version, anonymized analytics, error/crash logs

2.5 Data We Do NOT Collect

• Advertising IDs, cookies, web beacons, browser tracking, biometric data, photos/videos
• Racial/ethnic origin, political opinions, religious beliefs, union membership, genetic data, sexual orientation

Section 3: How We Use Your Data

3.1 Core Service

Processing data for personalized feed, briefings, automated actions, location features, notifications.

3.2 Improvement

Anonymized analytics, debugging, performance monitoring.

3.3 Security & Compliance

Fraud prevention, legal compliance, Terms enforcement.

3.4 What We Do NOT Do

• No AI Training. Never train, fine-tune, evaluate, or benchmark AI models with your data.
• No Sale. Never sell personal data.
• No Advertising. No behavioral/targeted/cross-context advertising.
• No Brokering. No sharing with data brokers.

3.5 Automated Processing

AI generates content and may auto-execute actions per your preferences. Not automated decision-making under GDPR Art. 22. All configurable.

Section 4: How We Share Your Data

We share data only as described in Table 1 (Section 1) and as follows:

4.1 Service Providers

All sub-processors in Table 1 are contractually bound to process data only as directed.

4.2 Financial Data: Plaid

Special Disclosure: Plaid acts as both our processor and an independent service provider. Plaid retains data per its own privacy policy (https://plaid.com/legal/), governed by the Gramm-Leach-Bliley Act. Review before connecting financial accounts.

4.3 Connected Services

Gmail, Calendar, Spotify, etc. process data per their own policies.

4.4 Legal Disclosures

We may disclose data for legal process, safety, and compliance. Where permitted, we'll notify you.

4.5 Business Transfers

In mergers/acquisitions, data may transfer. This Policy continues unless you're notified otherwise.

4.6 De-Identified Data

We may create and share anonymized, aggregated data not subject to this Policy.

4.7 Google User Data

Skye's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace data to develop, improve, or train generalized AI or ML models.

Section 5: Data Retention

Data is retained per the schedule below. At expiration, PII is permanently deleted or irreversibly scrubbed.

5.1 Retention Schedule

The retention periods above may be extended where reasonably necessary for backups, disaster recovery, security logging, fraud prevention, dispute resolution, tax/accounting compliance, or legal holds. Where feasible, retained data will be isolated & access-restricted.

5.2 Post-Deletion

Account deletion within 48 hours. Legal holds may extend retention.

Section 6: Your Choices and Controls

Section 7: Data Security

Industry-standard measures: encryption at rest and in transit, access controls, monitoring, contractual provider requirements. No system is perfectly secure.

Section 8: Data Breach Notification

• GDPR users: Supervisory authority notified within 72 hours where required; affected individuals notified without undue delay if high risk.
• US users: Notification per applicable state breach laws.
• All users: Nature of breach, data affected, measures taken, recommended steps.

Section 9: EEA, UK & Swiss Privacy Rights

9.1 Legal Bases

• Contract (6(1)(b)): Core service delivery
• Consent (6(1)(a), 9(2)(a)): Optional services, sensitive data
• Legitimate Interests (6(1)(f)): Security, anonymized analytics
• Legal Obligations (6(1)(c)): When required

9.2 Your Rights

Access (15), Rectification (16), Erasure (17), Restriction (18), Portability (20), Object (21), Withdraw Consent.

9.3 Automated Decision-Making

No Art. 22 decisions. All automated features configurable.

9.4 Transfers

US processing via SCCs. Pursuing DPF certification.

9.5 Complaints

EU: local DPA | UK: ICO | Swiss: FDPIC

9.6 EU/UK Representative

[TO BE APPOINTED — GDPR Art. 27]

Section 10: California Privacy Rights (CCPA/CPRA)

Know, Delete, Correct, Opt-Out, Limit Sensitive Use, Non-Discrimination.

We do not sell or share data. Contact: privacy@signulllabs.com. Response within 45 days.

10.1 Categories

Collected per Section 2. Disclosed to providers per Section 4 / Table 1. No sales.

10.2 Financial Incentives

We do not offer financial incentives for personal data.

Section 11: Other US State Privacy Rights

Similar rights for VA, CO, CT, UT, TX, OR, MT, and others. Appeal: privacy@signulllabs.com ("Privacy Appeal").

Section 12: Children's Privacy

Not directed to children under 13 (16 EEA/UK/CH). No knowing collection. Promptly deleted if discovered. Contact: privacy@signulllabs.com.

Section 13: International Transfers

US processing. SCCs for EEA/UK/CH transfers. Pursuing DPF certification.

Section 14: Tracking and Do Not Track

Native mobile app. No cookies, web beacons, browser tracking, cross-app tracking, or ad networks. DNT signals don't apply but we respect the principle.

Section 15: Contact Us

Section 16: Changes

Material changes: 30 days' notice. Continued use = acceptance.