Privacy Policy

1. Scope

This Privacy Policy applies to the public SKUantify website and the hosted SKUantify inventory-management application operated by Sky Arkanum. It explains what personal data we process, why we process it, who may receive it, how long we keep it, and the choices and rights available to you.

This policy does not replace a signed client agreement, order form, data processing addendum, or other contract. If a signed agreement gives a customer additional privacy protections, that agreement will apply to that customer in addition to this policy.

Because Sky Arkanum operates from the Philippines, this policy is intended to be read consistently with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules and applicable guidance of the National Privacy Commission. Additional privacy laws may also apply to particular customers, users or data subjects depending on their location and the processing involved.

2. Who is responsible for the data

SKUantify is operated by Sky Arkanum, operating from the Philippines. For general business enquiries, contact us at info@skuantify.com. For privacy, personal-data, data-subject-rights or security-related enquiries, contact privacy@skuantify.com.

Our role depends on the data involved:

• For account, security, support and website-contact data, Sky Arkanum decides why and how the data is processed. Under Philippine privacy terminology, we act as the Personal Information Controller; in other jurisdictions, the equivalent term is usually controller.
• For personal data that a customer puts into its SKUantify workspace, such as a supplier contact person or information about its staff, the customer normally decides why that information is being processed. In that situation the customer is the controller and Sky Arkanumprocesses the data to provide SKUantify as a Personal Information Processor / processor.

3. Personal data we process

SKUantify is an inventory system, not a consumer profiling service. We limit collection to information needed to operate, secure and support the service or information a customer chooses to place in its workspace.

4. Passwords and authentication secrets

We do not store account passwords in readable form. Passwords are hashed with Argon2id before storage. Invitation and password-reset tokens are stored as hashes rather than as the original token. A password change or reset causes sessions issued before the change to be refused.

You are responsible for keeping your password and any valid invitation, reset link or authenticated device secure and for notifying us or your business administrator if you believe an account has been compromised.

5. Customer content and third-party personal data

A customer may enter personal data about people who are not direct SKUantify account holders, for example a supplier contact person. The customer is responsible for having a lawful reason to collect and use that information and for providing any notice required by law. We process that information only to provide and support SKUantify, follow the customer's lawful instructions, protect the service, or comply with law.

SKUantify is not designed to store patient records, government identity numbers, payment-card data, biometric data, criminal records, children's data, or other sensitive personal information unrelated to inventory operations. Customers should not place such information in free-text fields, notes, images or references unless it is genuinely necessary, lawful and covered by appropriate safeguards and an agreed scope with us.

6. What we do not do with personal data

• We do not sell or rent personal data.
• We do not share personal data with advertising networks for their own targeted-advertising purposes.
• At the date of this policy, we do not embed advertising pixels, session-replay tools or third-party behavioral analytics in the public website or SKUantify application.
• We do not use customer inventory content to train our own AI models.
• SKUantify currently has no self-service card checkout and does not collect payment-card numbers through the website or application.

7. Why we process personal data

We process personal data only where there is a lawful and legitimate reason to do so. Depending on the situation, that includes:

• Providing a contract or requested service: creating accounts, operating workspaces, recording inventory activity, generating reports, providing support and administering an agreed plan.
• Legitimate operational and security interests:preventing abuse, securing accounts, diagnosing errors, maintaining service reliability and protecting customers and the platform, provided those interests do not override applicable privacy rights.
• Legal obligations: complying with valid legal, regulatory, tax, security or law-enforcement requirements.
• Consent: where the law requires consent or where we specifically ask for it for an optional activity. We do not treat use of the service as blanket consent for unrelated processing.
• Customer instructions: where we act as a processor for personal data placed in a customer workspace.

8. Cookies and similar technologies

The public marketing website does not intentionally use advertising or analytics cookies. The authenticated SKUantify application currently uses the following cookies:

• skuantify_session — a signed authentication cookie used to keep a user signed in. In production it is HTTP-only, Secure, SameSite=Lax, scoped to the application, and expires after seven days.
• skuantify_theme — stores only the user's light/dark appearance choice. It is SameSite=Lax and may remain for up to one year so the application can render the chosen theme on a later visit.

The SKUantify mobile app does not use cookies. After you sign in, it stores the same signed, seven-day authentication token in the device's secure storage (the Android Keystore) and sends it with each request to the server. What else it keeps on the device is set out in section 18. Signing out removes the stored token from the device.

We do not currently use cookies for cross-site advertising. If we add optional analytics, advertising or other non-essential tracking later, we will update this policy and provide consent controls where required before enabling that processing.

9. Who receives personal data

We disclose personal data only to people or organizations that need it for a defined purpose, including authorized members of the customer's own workspace, service providers that help us operate SKUantify, professional advisers where necessary, and authorities where disclosure is legally required.

Our current core service providers are:

Paddle is used only once subscription billing is switched on, and sees billing details only for a customer who checks out. Resend is used only when transactional email is configured. At present the application uses it for self-service password-reset email, for the stock monitoring digest (weekly and limited to what matters by default; each person can make it daily, include everything, or turn it off), to tell an owner when one of their webhook endpoints has been turned off after repeated failures, and to confirm an account deletion request. Contact messages sent to our public email address also pass through ordinary email providers used by the sender and by our business mailbox.

A customer on a plan with API access can create API keys and webhook endpoints. Inventory data then moves to or from systems the customer chooses — their own servers, or services they connect — only as they configure it: webhooks send item, location, quantity and movement details to the addresses the customer registers, signed so the recipient can check they came from SKUantify. Those systems are the customer's recipients, not our service providers. Each API call and webhook delivery is logged (time, outcome, response code, error text) for 30 days so the customer can see and retry what happened.

The application source supports an optional external error-reporting webhook. We will not enable a new production error-monitoring destination that receives personal data without first adding that provider to our maintained privacy/subprocessor information and applying appropriate access and data-protection controls.

10. International processing

Sky Arkanum is based in the Philippines. Our current primary application database is hosted in United States (AWS us-east-2). Our hosting and email providers and their subprocessors may process data in the United States and other countries where they operate.

When personal data is processed outside the Philippines, we remain responsible for our obligations under applicable privacy law and use service providers and contractual arrangements intended to provide appropriate protection for the data. Customers with specific residency or transfer requirements should raise them before onboarding so they can be assessed against the available infrastructure and contract.

11. How long we keep data

We do not keep every category for the same period. Retention is based on the purpose of the data and any contractual, security or legal need to preserve it.

• Customer workspace and inventory data: kept while the customer account is active and for as long as needed to provide the service, complete an agreed handover/export, resolve disputes, meet legal obligations, or carry out a verified closure/deletion request.
• Inventory ledger records: kept as part of the active customer workspace because the product is designed to preserve an auditable movement history. Corrections are normally recorded as new transactions rather than rewriting prior movements.
• Evidence photos: kept for the period the business sets in its settings — between 30 days and 10 years, one year unless changed — and then deleted automatically. The movement or count they were attached to is kept.
• Authentication/security records: kept for the period reasonably needed to operate abuse-prevention and account-security controls. Expired or stale rate-limit records are pruned from the operational table; valid session tokens expire after seven days.
• Invitation and reset records: invitations expire after seven days and password-reset links expire after 24 hours. Associated records may remain for account-security, audit or troubleshooting purposes until they are removed through normal account-data cleanup.
• Support and business communications: kept for as long as reasonably necessary to answer the request, administer the customer relationship, document agreed decisions, or meet legal obligations.
• Provider backups and operational logs: may persist for a limited period under the provider's backup, security and log-retention cycle even after live data is removed. Backup copies are not used as a separate source for ordinary business processing and are overwritten or expire under those systems' retention controls unless preservation is legally required.

A verified deletion or account-closure request will be handled without undue delay and within any deadline required by applicable law. We may retain only the minimum information that must be preserved for legal, accounting, fraud-prevention, security, dispute-resolution or other mandatory purposes, and will not use retained information for an unrelated purpose.

12. Data security

We use technical and organizational safeguards appropriate to the current MVP and the risks of the data we process. Current controls include password hashing with Argon2id, signed sessions, Secure/HTTP-only session cookies in production, password-change session invalidation, tenant-scoped authorization, role and location permissions, rate limiting, hashed one-time tokens, transactional inventory writes, server-side permission checks and controlled access to the production database.

Our infrastructure providers also maintain their own security controls. No internet service can promise absolute security, so we continuously review material security findings and remediate them according to risk.

13. Your privacy rights

Depending on where you live and our role in processing the data, you may have rights to be informed, access your personal data, correct inaccurate data, object to or restrict certain processing, request erasure or blocking, obtain data in a portable form, withdraw consent where consent is the basis of processing, and complain to a privacy regulator.

For personal data we control directly, send a request to privacy@skuantify.com. We may ask for information reasonably necessary to verify identity and prevent someone else from exercising your rights fraudulently.

To have your SKUantify account deleted, ask from the app or the web application, or by email — Delete your account explains how, and what is deleted and kept.

If your personal data was placed in SKUantify by a customer organization and we process it only on that customer's behalf, please contact that organization first. We will reasonably assist the customer with valid data-subject requests as required by applicable law and the customer agreement.

A request may be limited or refused only where applicable law permits or requires it, for example where fulfilling the request would expose another person's data, conflict with a legal retention duty, undermine a valid fraud/security investigation, or concern data we are required to preserve for a legal claim. Where appropriate, we will explain the reason.

14. Data exports and corrections

SKUantify supports CSV export for inventory reports and printable report views where available. Customers may also ask us for reasonable assistance with account-level access or export requests that are not available through the product.

Account and catalogue information may be corrected through authorized product workflows. Inventory movement history is intentionally append-only: an inventory mistake is corrected through an authorized corrective transaction so that the historical record remains auditable.

15. Personal data breaches and security incidents

If we become aware of a security incident involving personal data, we will assess and contain it, preserve appropriate evidence, document the incident, and notify the affected customer, regulators and/or data subjects when notification is required by applicable law. Where Philippine mandatory breach-notification rules apply, required notices are made within the legally prescribed period based on the information available at the time.

16. Children

SKUantify is a business operations product and is not directed to children as a consumer service. We do not knowingly invite children to create personal SKUantify accounts for their own use. A customer that creates an account for a worker who is below the age of majority is responsible for ensuring that the account and any related processing are lawful and appropriate for that worker.

17. Automated decisions and profiling

SKUantify calculates inventory status, totals, valuation and operational alerts from business inventory data. It does not currently make automated decisions about a person that produce legal or similarly significant effects, and we do not profile people for advertising.

18. Mobile application

The SKUantify mobile app is a client for the same hosted service described in this policy. When you use it, you sign in to your existing SKUantify account (or create a business), and the app sends the account, catalogue, stock-movement and stock-count information you enter to the SKUantify server. That information is processed and stored exactly as described above for the web application, under the same roles and location permissions.

The app is available for Android. Nothing is recorded without the server: a stock movement, transfer or count only happens when the server accepts it.

What the app keeps on the device.

• Your authentication token, in secure storage, until you sign out.
• Settings you choose: appearance (system, light or dark), whether a sound plays when something is saved, and your stock-alert choices.
• The last screens the server sent — the dashboard, catalogue, item details and the list of counts — so they can still be shown, marked as out of date, when there is no signal. These are kept separately for each account and business, and are deleted when you sign out.
• Drafts: a movement you chose to save while offline, so you do not have to type it again. A draft is not recorded until you send it. It is kept for the account that saved it, and only that account sees it after signing in again, until it is sent or deleted.
• Which stock alerts it has already told you about, so it does not repeat them.

This data stays in the app's private storage. It is excluded from device backups, and removed when the app is uninstalled.

Permissions the app asks for.

• Internet, to reach the SKUantify server.
• Camera, only when you choose to scan a barcode or take a photo as evidence for a movement or count. Barcode images are read on the device and not stored or sent; only the code is used. Evidence photos are sent to the server and stored with the movement or count line, as described in section 3, for the retention period your business sets.
• Photos, through the system photo picker, only when you choose an existing picture as evidence. The app sees only the picture you pick.
• Notifications, only if you turn stock alerts on. The app then checks the server for low-stock items at the locations you can see, roughly every fifteen minutes while signed in, and shows a notification on the device. Nothing is sent by a push-notification service.

It also uses standard Android permissions that are granted on install and never shown as a prompt: vibration, for the buzz when something is saved; network state, to know when the phone is offline; and background work (keeping the device awake briefly, starting after a restart, and a short foreground task) so that stock-alert checks keep running. None of them gives the app access to your data.

The app does not ask for your contacts, location or microphone.

Error reports. If the app crashes, it sends a short report to the SKUantify server: the app version, the operating system, and the error with its technical trace, with anything that looks like a token or email address removed first. It does not include your authentication token, your name or your inventory data, and no third-party crash-reporting service is involved. At most ten are sent per session. The Diagnostics screen in the app shows technical details you can choose to copy and send to us; nothing on it is sent automatically.

The app does not contain advertising or analytics software and does not collect advertising or device identifiers.

Before the app begins collecting new device data, permissions or identifiers that are not already covered here, this policy will be updated and any required platform or consent disclosures will be added.

19. Changes to this policy

We may update this policy as SKUantify changes, our providers change, or legal requirements evolve. The date at the top will identify the current version. If a change materially expands the personal data we collect or materially changes how we use it, we will provide reasonable additional notice where required before the new processing takes effect.

20. Contact and complaints

Privacy questions, access requests, correction requests, deletion requests, complaints and security concerns can be sent to privacy@skuantify.com. General business, sales and service enquiries can be sent to info@skuantify.com.

If you are in the Philippines and believe your privacy rights have been violated, you may also raise a complaint with the National Privacy Commission. If another jurisdiction's privacy law applies to you, you may have the right to complain to the competent privacy or data-protection authority in that jurisdiction.