Privacy Policy

Last updated: May 15, 2026 · Effective: May 15, 2026

SkyNimbus Inc. ("SkyNimbus," "we," "us") is committed to protecting your personal information in accordance with Japan's Act on the Protection of Personal Information (APPI) and applicable international data protection laws. This policy describes how we collect, use, store, and protect your personal information when you use the SkyNimbus cloud governance platform.

1. Data Controller

2. Personal Information We Collect

We collect the following categories of personal information, each for a specific and limited purpose:

Data Category	Examples	Purpose of Use	Retention
Account Information	Name, email address, company name	Account creation, authentication, communication	Duration of account + 30 days
Authentication Data	Password hash, MFA tokens, SSO tokens	Secure access to your account	Active session duration; tokens purged on expiry
Cloud Connection Credentials	AWS/Azure/GCP API keys, role ARNs	Read-only access to your cloud cost and resource data	Duration of connection; deleted on disconnect
Cloud Spend Data	Service costs, resource usage, billing periods	Cost analysis, budgeting, anomaly detection, governance	Duration of account or per customer agreement
Usage Data	Login timestamps, pages visited, features used	Product improvement, security monitoring	12 months rolling
Support Data	Ticket content, replies	Customer support	Duration of account + 90 days
Payment Records	Payment amount, method, invoice references	Billing, invoicing	7 years (tax/legal requirement)

3. Purpose of Use

We use your personal information exclusively for the following purposes. We will not use your information beyond these stated purposes without your prior consent:

• Service provision — Operating the SkyNimbus platform, including cloud cost analysis, governance scoring, anomaly detection, and budget management
• Authentication & security — Verifying your identity, preventing unauthorized access, enforcing MFA
• Customer support — Responding to tickets, troubleshooting issues
• Billing — Processing payments, generating invoices
• Product improvement — Analyzing usage patterns to improve features (aggregated/anonymized where possible)
• Legal compliance — Meeting regulatory obligations including APPI, tax records retention
• Security monitoring — Detecting and preventing fraud, unauthorized access, or abuse

4. Third-Party Provision & Sub-Processors

We do not sell your personal information. We share data with the following service providers only as necessary to operate our platform:

Provider	Purpose	Data Shared	Location
Resend	Transactional email delivery	Email address, name	United States
Cloud hosting provider	Server infrastructure	All platform data (encrypted at rest)	See data residency section
AWS/Azure/GCP APIs	Cloud cost data retrieval (on your behalf)	Your cloud API credentials (read-only)	Per your cloud provider regions
Let's Encrypt	SSL/TLS certificate issuance	Domain name only	United States

All sub-processors are contractually obligated to protect your data. We maintain agreements ensuring security measures equivalent to our own.

5. Cross-Border Data Transfers

Your data may be processed in jurisdictions outside Japan. When this occurs, we ensure protection through:

• Contractual safeguards with all sub-processors
• Encryption in transit (TLS 1.2+) and at rest
• Our Self-Hosted Database option, which allows you to keep all operational data within your own infrastructure in Japan or any jurisdiction you choose

For customers requiring data residency in Japan, our self-hosted database feature provides full tenant data isolation — your cloud spend data, connections, budgets, and governance data remain in your PostgreSQL instance, under your control.

6. Data Security

7. Your Rights Under APPI

As an individual whose personal information we hold, you have the following rights. To exercise any of these rights, contact privacy@skynimbus.net.

Right	Description	How to Exercise
Access / Disclosure	Request disclosure of your retained personal data	Settings → My Data → Download, or email privacy@skynimbus.net
Correction	Request correction of inaccurate personal data	Settings → Profile, or email privacy@skynimbus.net
Deletion	Request deletion of your personal data	Settings → My Data → Delete Account, or email privacy@skynimbus.net
Cessation of Use	Request we stop using your data for specific purposes	Email privacy@skynimbus.net
Cessation of Third-Party Provision	Request we stop sharing your data with third parties	Email privacy@skynimbus.net

We will respond to all data subject requests within 14 business days. Identity verification may be required.

8. Data Retention & Deletion

We retain personal information only as long as necessary for the purposes stated in this policy:

• Account data is deleted within 30 days of account closure
• Authentication tokens are automatically purged upon expiry
• Audit logs are retained for 24 months for security purposes
• Payment records are retained for 7 years per tax requirements
• Support tickets are retained for 90 days after account closure

When data is deleted, it is permanently removed from our active systems. Backup retention does not exceed 90 days.

9. Cookies & Tracking

SkyNimbus uses only essential cookies required for platform functionality:

• sn_access — Session authentication (HTTP-only, 1 hour)
• sn_refresh — Session refresh (HTTP-only, 7 days)

We do not use advertising cookies, analytics trackers, or third-party tracking pixels. No cookie consent banner is required as we only use strictly necessary cookies.

10. Breach Notification

In the event of a data breach that may affect your rights and interests:

• We will notify the Personal Information Protection Commission (PPC) promptly
• We will notify affected individuals without delay via email
• We will provide details of the nature of the breach, data affected, and remedial measures taken

11. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email to all registered users at least 30 days before taking effect.

12. Contact