top of page

Skyread Privacy Policy

Last updated: October 28, 2026

This policy explains how Fundas LLC ("Fundas", "we", "us", "our") handles personal information in Skyread, our subscription data service. Skyread delivers public economic, industry and local-market data through a web explorer, a REST API, SQL access, alerts, and a connector for AI assistants such as Claude, ChatGPT and Cursor.

It covers what we collect, why, who we share it with, how long we keep it and your choices. Fundas's other product, RiseIQ, and our website at www.fundas.ai have their own privacy policy.

In short:

  • We collect little: work emails of the people on an account, billing status from Stripe, and usage counts.

  • We do not sell personal information, share it for cross-context behavioral advertising, or use it to train AI models.

  • We never see your conversations with AI assistants, only the data requests they send.

  • Emails and names are encrypted in our database. There are no passwords.

1. Who is responsible

Fundas is the controller (under the CCPA/CPRA, the "business") of the account, billing and usage information described here.

The public data Skyread publishes (government statistics and public records) is not information about our customers (Section 9).

2. Information we collect

  • Sign-up details: Company name (or your name) and email address. We do not ask for a phone number or address. To check that the address can receive email, we look up its domain (never the full address) in public DNS.

  • People on the account: Up to 5 people per company email domain (one person on a personal email account). For each person: email address, an optional name, role (owner or member), when they were invited, last confirmed their email and were last active, and a daily count of their requests. The account owner sees this for everyone on the account; colleagues see only who has access.

  • Sign-in codes: When you sign in, we email a 6-digit code to your address. It works once, for 10 minutes, and stops after 5 wrong tries. Only a keyed hash is stored, and it is deleted within a day.

  • Browser sign-ins: After you enter a code, we set one secure sign-in cookie (Section 5). We store only a hash of it, the browser type (for example "Chrome on Mac") and a shortened network address (the first three parts of an IPv4 address), so you can see where you are signed in.

  • API keys: We generate them, show them once, and store only a one-way hash, plus a short prefix so you can recognize each key, the label you give it, whose key it is, and when it was created, last used and revoked.

  • AI-assistant connections (OAuth): When you connect an assistant, its app registers with us (app name and return address). You approve access as yourself. We store sign-in codes and tokens only as hashes. Access tokens expire after 1 hour and refresh tokens after 30 days.

  • Billing: Stripe processes payments. It collects your card details and, if you give them, billing address and tax ID. We never receive or store card numbers. From Stripe we receive and store your Stripe customer and subscription IDs, subscription status, and trial and billing-period dates.

  • Consent record: When you start a trial, you tick a box agreeing to the Skyread Terms and this policy, including the renewal terms. We record the version accepted and the date and time, on your account and in Stripe's subscription records, as auto-renewal laws require.

  • Usage: The number of requests your account and each person make each day, by channel (API, SQL, AI connector), and how many were refused under the fair-use limit. We do not store the content of your questions, searches or SQL.

  • Alerts you create: Alert name and conditions, plus the delivery address you choose: a webhook address (for example Slack or Teams) and/or an email address at your account's own email domain. Also the alerts that fired and the result of each delivery. Delivery addresses are encrypted.

  • Notifications on your devices: Only if you turn on alert notifications on a device (Account page). Your browser gives us an address at its push service (Apple, Google, Mozilla or Microsoft, depending on the browser) and two keys for that device; we also note a label such as "Chrome on Mac". The address and keys are encrypted in our database. Each notification is encrypted so that only your device can read it: the push service delivers it but cannot see its content.

  • Server logs: Our hosting provider records each request: IP address, date and time, and the page or endpoint requested. Query strings are removed, so logs do not hold search terms, sign-in codes or checkout references. We use logs only for security, abuse prevention and fixing faults.

  • Support: What you send us when you contact us.

We do not collect precise geolocation, government ID numbers or payment card numbers.

3. What we do not collect from AI assistants

When you use Skyread through Claude, ChatGPT, Cursor or another assistant, we receive only the specific requests the assistant sends on your behalf, such as "the local profile for ZIP 10021" or "the restaurants briefing". We do not receive, request, log or store:

  • your conversations, chat history or conversation summaries;

  • the assistant's memory;

  • your files;

  • anything else in your assistant account.

We use each request only to answer it and do not keep it afterwards. The one exception: when you ask the assistant to create an alert, we store that alert (Section 2).

Your assistant's provider (for example Anthropic or OpenAI) handles your conversation under its own privacy policy.

4. How we use information, and our legal bases

  • Create and run your account; sign you and your assistants in; manage seats: Performance of our contract with you

  • Bill your subscription through Stripe and keep records of your consent to its terms: Contract; legal obligation

  • Send service messages: sign-in codes, invitations, trial and renewal notices, alerts you set up, security notices, changes to our terms: Contract; legal obligation

  • Keep the service secure, prevent abuse and enforce fair-use and seat limits: Our legitimate interest in running a secure, reliable service

  • Fix faults and understand overall usage, in aggregate, to improve the service: Our legitimate interest

  • Comply with law, respond to lawful requests, and establish or defend legal claims: Legal obligation; legitimate interest

We do not use your information for automated decisions that have legal or similarly significant effects on you. Skyread does not combine your information with data from RiseIQ.

5. Cookies and browser storage

Skyread runs no analytics or advertising trackers.

  • Sign-in cookie. After you sign in with an emailed code, we set one cookie that keeps you signed in for up to 7 days. It is strictly necessary for the service, cannot be read by page scripts, is sent only over HTTPS to Skyread, and is deleted when you sign out.

  • Session storage. If you sign in with an API key instead, the page keeps the key in your browser's session storage, which is cleared when you close the tab.

  • Local storage. The site remembers display choices such as light or dark mode, whether you finished the guided tour, a count of visits and when you last chose "Not now" to installing the app (so the invitation does not keep appearing). This stays in your browser and is never sent to us.

  • Fonts and charts. Pages load fonts from Google Fonts and a chart library from the jsDelivr network. Like any web request, these providers receive your IP address and browser details when the page loads.

6. Service providers ("sub-processors")

  • Railway Corporation: Location: United States; What it does: Hosting, compute, database storage and server logs

  • Google LLC (Google Workspace): Location: United States; What it does: Sending email: sign-in codes, invitations, notices and alert emails; support email

  • Stripe, Inc.: Location: United States; What it does: Subscription billing, payment processing, invoices, tax calculation and the billing portal

  • Cloudflare, Inc.: Location: United States; What it does: Public DNS lookup of a sign-up address's domain (the domain only, never the address)

Each is bound by data-protection terms at least as protective as this policy. We will update this list before engaging a new provider that processes personal information on our behalf.

Services you choose to connect are not our sub-processors: your AI assistant, the Slack, Teams or other webhook you give us, and your browser's push service if you turn on notifications (it receives only an encrypted message it cannot read). We share information with them only as you direct.

We may also disclose information when required by valid legal process; to protect the rights, safety or property of our users, the public or Fundas; or to a successor in a merger, acquisition or sale of assets, which must honor this policy (we will notify you of the transfer).

7. Retention

  • Account details, people and active API keys: While your account is open

  • Accounts that end (cancelled, expired or unpaid): Deleted automatically 24 months after the account ends, with their people, keys, usage counts and alerts. Ask us to delete sooner and we will do it within 30 days.

  • People removed from an account: Their sign-ins, keys and assistant connections end immediately; the record of who had access is deleted 24 months after removal. Invitations nobody accepts lapse after 14 days.

  • Revoked API keys: 24 months after revocation

  • Browser sign-ins: 30 days after they end

  • Notification devices: Until you turn notifications off on that device, the person is removed from the account, or the push service tells us the device is gone (for example the app was uninstalled)

  • Sign-in codes: Deleted within a day

  • Expired or revoked assistant tokens: 30 days

  • Daily usage counts: 24 months

  • Alert history: 24 months

  • Alerts you delete: Switched off immediately; removed within 90 days

  • Server logs: Kept by our hosting provider for no more than 30 days

  • Backups of account records: A daily encrypted backup, kept for 30 days, so a hardware failure cannot lose your account. Deleted records leave the backups within 30 days.

  • Consent and billing records: Stripe keeps them under its retention policy and as tax law requires. We keep consent records for at least 3 years, or 1 year after your subscription ends if that is later.

  • Support emails: As long as needed to resolve the request and for our business records

8. Security

  • HTTPS for every connection (with HSTS), and TLS with certificate checks when we send email.

  • Email addresses, names and alert delivery addresses encrypted in our database with AES-256-GCM. The encryption key is kept separately from the database, so a copy of the database or a backup cannot be read on its own.

  • API keys, sign-in codes and tokens stored only as one-way hashes.

  • No passwords: people sign in with a one-time code sent to their email, so access ends when their work mailbox does. Keys and assistant connections pause after 30 days without an email check.

  • Changes made with the sign-in cookie are accepted only from Skyread's own pages.

  • Customer records are walled off from the SQL interface; access is limited to Fundas administrators and every administrative change is logged.

  • Pages that show keys or take sign-ins are never cached and cannot be embedded in other sites.

No system is perfectly secure. If a security breach affects your personal information, we will notify you and the relevant authorities as the law requires.

9. The public data Skyread publishes

Skyread's content comes from public sources such as the Bureau of Labor Statistics, Census Bureau, Bureau of Economic Analysis, Energy Information Administration, Treasury, Federal Reserve, IRS, FDA, USDA, SEC, U.S. Army Corps of Engineers and the World Bank. It is aggregate statistics and public records, and contains no information about our customers.

A few public datasets name businesses or describe events, for example food recalls (firm names and cities), company filings with the SEC and ship inspection scores. The FDA's food adverse-event reports are de-identified agency records; we republish them as the FDA publishes them and add nothing to them.

Census data may never be used, alone or combined with other data, to identify any person, household or business. Our Terms prohibit this.

10. Your controls

On the Skyread Account page you can:

  • see your account: company, status, people, keys and usage;

  • manage people (owner): add and remove people; removing someone ends their access at once;

  • manage keys: create and revoke API keys;

  • disconnect assistants: yours, or everyone's (owner);

  • turn notifications on or off for the device you are using;

  • sign out of every browser;

  • manage billing (owner): update your card, download invoices or cancel online at any time;

  • download your data (owner): everything we hold about your account, as a file;

  • close and delete the account (owner): deleted immediately and the subscription ended. Copies in backups are gone within 30 days; Stripe's billing records are kept as described above.

You can also ask your assistant to delete alerts, or use the alerts API.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a portable copy of your personal information, to object to or restrict certain processing, to withdraw consent where processing relies on it, and to complain to a data-protection authority (in the European Economic Area or the United Kingdom, your local supervisory authority).

How to make a request. Email privacy@fundas.ai or skyread@fundas.ai from your account email. We will verify the request and respond within 30 days, or sooner if the law requires. You may use an authorized agent; we may ask for proof of their authority. We will not discriminate against you for exercising these rights.

California residents (CCPA/CPRA). Section 2 lists the categories of personal information we collect, Section 4 why, Section 6 who receives it and Section 7 how long we keep it. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information for purposes that would give you a right to limit it. We treat a Global Privacy Control signal as a request to opt out of sale and sharing; because we do neither, no further action is needed.

12. International transfers

Fundas is based in the United States, and Skyread is hosted there. If you use Skyread from outside the United States, your information is transferred to and processed in the United States. Where the GDPR, UK GDPR or Swiss law applies, we rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) or another lawful transfer mechanism. We sign a Data Processing Agreement on request.

13. Children

Skyread is for business and professional use. It is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us information, email privacy@fundas.ai and we will delete it.

14. Changes to this policy

We will post any change here and update the date at the top. If a change is material, we will tell account owners by email or in the product at least 30 days before it takes effect, unless the law requires it sooner.

15. Contact

Fundas LLC, Attention: Legal & Privacy 28 Geary St, STE 650 #2045, San Francisco, CA 94108, USA Privacy: privacy@fundas.ai · Skyread: skyread@fundas.ai https://www.fundas.ai

bottom of page