This Privacy Policy explains how Sky Enterprises Australia ("we", "us", "our") collects, uses, stores, and discloses personal information when you use Frostbyte ("Service"). It is intended to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
By using the Service, you acknowledge you have read and understood this policy.
1. Introduction and Scope
This policy applies to all personal information we collect through the Frostbyte web application and related services, including our website, Feedback Portals, embedded widgets, API, and MCP server. "Personal information" means any information that identifies you or could reasonably identify you, consistent with the definition under the Privacy Act 1988 (Cth).
We operate globally. Where users are located in the European Union or United Kingdom, additional rights under the UK/EU GDPR may apply. Where users are located in California, USA, rights under the CCPA may apply. We aim to meet the most protective applicable standard across our user base.
2. Data We Collect
| Category | What we collect |
|---|---|
| Account | Name, username, email address, and password (stored as a bcrypt hash; we never store your raw password). Profile picture if you upload one. Account identifiers and profile details from GitHub or Google if you sign in with them. |
| Your content | Projects, tasks, areas, releases, comments, and other content you create. Files you upload, such as logos, profile pictures, and attachments. |
| AI features | The requests you make to Frostbyte AI features, the project content those requests need, and the amount of AI you use. Frostbyte Agent chat history is kept in your browser rather than on our servers. |
| Connected tools | API tokens (stored as hashes), connected apps, when and from which IP address a token was last used, and actions taken through them. If you connect GitHub, the repository, commit, pull request, and issue details needed for the integration. |
| Usage | Pages visited, features used, actions taken, and session duration. Activity history within projects, such as task creation, edits, and status changes. |
| Device and technical | IP address, browser type and version, operating system, device identifiers, cookies, and approximate location. Referrers and campaign parameters on our public pages. Session recordings when you are signed in, including mouse movements, clicks, scrolls, and what appears on screen, which can include your project content. |
| Communications | Messages and attachments you send through our contact forms or by email, and any reason you give when deleting your account. Which emails we send you and whether you click them. We do not track email opens. |
| Payment | Subscription plan and billing history. Payment method details are handled directly by Stripe; we do not store full card numbers or sensitive payment credentials on our servers. |
We collect this information from you directly, from your use of the Service, and from GitHub or Google if you connect them. We need account data to create your Account, and without it we cannot provide the Service.
3. How We Use Your Data
| Purpose | Data used | Legal basis (EU/UK) |
|---|---|---|
| Providing the Service: accounts, authentication, and the features you use | Account, your content, AI features, connected tools | Contract |
| Processing payments: Subscriptions, billing, and payment history through Stripe | Account, payment | Contract, legal obligation |
| Transactional emails: verification, password resets, billing, and service notifications | Account | Contract |
| Lifecycle and marketing emails: onboarding and product updates, which you can opt out of at any time | Account, usage | Legitimate interests, or consent where required |
| Security and fraud prevention: detecting abuse, unauthorised access, and policy violations | Device and technical, usage | Legitimate interests |
| Analytics and session recording: understanding how people find and use our website and the Service, through DataFast and PostHog | Account, usage, device and technical | Legitimate interests |
| Product improvement: improving features and fixing bugs using activity records and events from our servers | Usage, device and technical | Legitimate interests |
| Support: answering your questions and requests | Account, communications | Contract, legitimate interests |
| Legal compliance: meeting our obligations, including responding to lawful requests | Any relevant data | Legal obligation |
Our legitimate interests are keeping the Service secure, understanding how it is used, improving it, and telling you about it.
We only use your data for the purpose for which it was collected, or a directly related purpose you would reasonably expect (APP 6). We do not make decisions about you using solely automated processing that have legal or similarly significant effects.
4. Third-Party Services
We share data with the following third-party services to operate the Service. Each has its own privacy policy, linked from its name.
| Provider | What it does | Data it handles |
|---|---|---|
| Anthropic | Powers Frostbyte AI features, including the Frostbyte Agent, Polish task, Auto convert, and release notes drafts | Your request and the project content it needs. Anthropic's commercial terms do not allow it to train models on this content. |
| Stripe | Payments and subscription management | Billing details, email address, subscription status, and revenue attribution details |
| Heroku (Salesforce) | Application hosting in the United States | All data processed by the Service |
| MongoDB Atlas | Database | Application data |
| Amazon Web Services | File storage in a private Amazon S3 bucket in the US East (N. Virginia) region | Files you upload, delivered only through authorised requests to the Service |
| Cloudflare | Content delivery and security | Website traffic, including IP addresses |
| Zoho Mail | Sends and receives email | Email addresses and message content |
| GitHub | Optional sign-in and the optional GitHub integration | GitHub profile information as permitted by your account settings, and task details you sync to linked issues |
| Optional sign-in | Your name, email address, profile picture, and Google account ID | |
| PostHog | Product analytics and session recording for signed-in users, sent through our own domain, sk.skyenterprisesau.com | Your account identifier, name, and email address, page views, feature use, session recordings, and product events sent from our servers |
| DataFast | Analytics and attribution on our public pages and Feedback Portals | Page views, referrers, campaign parameters, IP address, device and browser information, your email address when you sign up, and conversion or revenue attribution |
Google sign-in: Frostbyte asks Google only for your basic profile and email address. We use them to create your Account, sign you in, and show your name and profile picture, and they are then handled like the rest of your Account data, including by the services above. We do not sell this data or use it for advertising, we do not keep the access tokens Google issues, and we delete this data when you delete your Account. Frostbyte's use of information received from Google APIs adheres to the Google API Services User Data Policy.
Tools you connect: If you connect your own agent or app, such as Claude, ChatGPT, Codex, or Cursor, it can read and change your Frostbyte data as you allow. That data is then handled under that tool's terms and privacy policy, not this one.
Project members: People in a project can see its content and your name, username, and profile picture. Anything published to a Feedback Portal, public roadmap, or public changelog is visible to anyone.
Legal disclosures: We may disclose information where required by law, or to protect our rights, users, or the public.
PDF exports are generated within Frostbyte's own application environment. We do not send project data to a separate external PDF generation service.
We do not sell your personal information to third parties.
5. Feedback Portals and Widgets
Frostbyte customers can run public Feedback Portals and embed widgets to collect feedback from their own users. If you use a portal or widget:
- What we collect: Your submission, any name or email address you choose to provide, a hashed version of your IP address, and a cookie and hashed IP address to limit voting to one vote per person. Bug reports sent through a widget also include the page address and your browser's user agent.
- Who can see it: The project's owner and members can see what you submit, including your email address. Your submission and name may appear publicly on the portal. You can submit without giving your email address.
- Emails: If you leave your email address, the project may notify you when your request ships.
- Who is responsible: The customer running the portal decides how it uses your submission. Contact them first about their use of it, or contact us at [email protected].
6. Data Retention
| Data | How long we keep it |
|---|---|
| Account data | While your Account is active. Deleted from our live systems when you delete your Account. |
| Unverified accounts | If you don't verify your email, we send you one reminder, about 3 days after signup or later, and delete the Account 27 days after that reminder. This doesn't apply to an Account with a payment history or a project. |
| Projects you own | While your Account is active, unless you delete them sooner. Deleted from our live systems, with their files and activity history, when you delete your Account. |
| Content in other people's projects | Tasks and comments you added stay with that project when you delete your Account, until its owner deletes them. |
| Feedback Portal submissions | Until the project owner deletes them or the project is deleted. Individual vote records expire after 12 months. |
| Deletion records | When you delete your Account, we keep your email address, username, plan, signup and deletion dates, and any reason you gave for 24 months, so we can understand why people leave and handle disputes. Contact us to have yours deleted sooner. |
| Email and AI usage records | Records of the emails we sent you and of how much AI you used, which do not include your prompts, are kept for analytics, billing, and support until they are no longer needed for those purposes. |
| Payment records | 7 years, as required by Australian financial record-keeping obligations. |
| Server error records | 60 days. |
| Analytics and session recordings | Kept by PostHog and DataFast for as long as they are useful for understanding how the Service is used. Contact us to request deletion. |
| Backups | Up to 30 days on a rolling basis before overwrite. |
You may request deletion of your Account and personal information at any time (see Section 9). Deleted data cannot be restored once it has left our backups. Where we are required by law to retain certain records, such as payment records, we retain only the minimum information required for the required period.
7. International Data Transfers
We are based in South Australia, Australia. Your data is transferred to and processed in countries other than Australia, mainly the United States, where our hosting provider (Heroku), database provider (MongoDB Atlas), file storage provider (Amazon Web Services), AI provider (Anthropic), and other third-party services operate. Some providers, such as Cloudflare, also process data in other countries where they operate.
We take reasonable steps to ensure that overseas recipients handle your personal information in a manner consistent with the Australian Privacy Principles (APP 8). By using the Service, you consent to this transfer.
If you are located in the EU/UK, we rely on the following transfer mechanisms where applicable: Standard Contractual Clauses (SCCs) where available, or transfers to recipients in countries with adequate data protection frameworks. Please contact us at [email protected] if you require further information.
8. Security
We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure (APP 11). Our measures include:
- Encryption in transit via HTTPS/TLS for all Service communications
- Passwords stored as bcrypt hashes and API tokens stored as hashes, never in raw form
- Stored GitHub installation tokens encrypted
- Access controls limiting who within our organisation can access personal data
- Session-based authentication with secure, signed cookies
- Uploaded files stored in a private Amazon S3 bucket with no public access, delivered only through per-file authorised requests
No system is 100% secure. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches (NDB) scheme.
9. Your Rights
You have the following rights regarding your personal information:
- Access: Request a copy of the personal information we hold about you (APP 12). We will respond within 30 days.
- Correction: Update your details in Settings, or request that we correct inaccurate or incomplete information (APP 13).
- Deletion: Delete your Account from Settings, or request deletion of your personal information. We will comply unless we are required by law to retain it.
- Data portability: Export your projects from within the Service, or request your data in a structured, commonly used format where technically practicable.
- Opt out of marketing: Unsubscribe from marketing communications at any time using the link in any email, or by contacting us.
- Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
EU/UK users: You also have the right to object to processing, restrict processing, and lodge a complaint with your local supervisory authority.
California users: You have rights under the CCPA including the right to know, delete, and correct your information, the right to opt out of sale or sharing (we do not sell or share personal information for advertising), and the right not to be discriminated against for using these rights.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
10. Cookies and Tracking
We use cookies and similar technologies to operate the Service. Essential cookies are always on.
- Website analytics (DataFast): On by default in every region until you decline them. They also run on Feedback Portals, which do not show a cookie choice.
- Product analytics and session recording (PostHog): On for all signed-in users in every region. Your cookie choice does not change this. To object, contact us at [email protected].
- Changing your choice: Update your website analytics choice at any time. We remember it for 6 months.
| Name | Purpose | Where it is used | How long it lasts |
|---|---|---|---|
frostbyte-session | Keeps you signed in. Essential to the Service. | Everywhere on Frostbyte | 7 days |
fb_consent | Remembers your cookie choice | Our website and the app | 6 months |
fb_v | Limits Feedback Portal voting to one vote per person | Feedback Portals | 1 year |
datafast_visitor_id, datafast_session_id | Analytics and attribution through DataFast | Public pages and Feedback Portals | Set by DataFast |
| PostHog cookies and local storage | Product analytics and session recording | Inside the app, once you are signed in | Set by PostHog |
| Local storage | Remembers things in your browser, such as dismissed hints and Frostbyte Agent chat history | Inside the app | Until you clear it |
PostHog data is linked to your account and DataFast can receive your email address at signup, so this data is not anonymous. We do not use DataFast or PostHog to sell personal information. You may contact us at [email protected] to request that your session recordings be deleted.
You can manage cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning correctly.
11. Children's Privacy
The Service is only available to users who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a person under 18, please contact us at [email protected] and we will delete it promptly.
By using the Service, you confirm that you are at least 18 years old.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will:
- Post the updated policy on our website with a new "Last Updated" date
- Notify you via email or in-app notice for material changes
Continued use of the Service after the effective date constitutes acceptance of the updated policy.
13. Contact and Privacy Requests
For privacy enquiries, data access or deletion requests, or complaints about how we handle your personal information:
Sky Enterprises Australia
Email: [email protected]
We will investigate and respond within 30 days.
Australian users: If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au/privacy/privacy-complaints.
EU/UK users: You may also lodge a complaint with your local data protection supervisory authority.