Skiply asks retailers to trust us with two sensitive things: images captured inside their customers' homes, and the return data behind them. This page explains how we think about protecting both.
Our product is in development. We are working with a small number of prospective retail partners and we are not yet processing mass production returns at scale.
That shapes how we handle data right now. We hold very little of it, we collect only what a return actually requires, and we would rather delay a feature than take on data we are not ready to protect. As we move toward production, the controls below move with us, and we will keep this page current rather than let it drift.
These are design decisions and commitments, not controls we still need to build.
We do not do biometrics.
No facial recognition. No faceprints, voiceprints, iris scans, fingerprints, or face geometry. We do not create biometric identifiers, store them, or derive them from images. This is architectural. It is not a setting a customer can enable, and it holds under Illinois BIPA, Texas CUBI, Washington's biometric and health privacy laws, and equivalent rules elsewhere.
We analyze items, not people.
Our models are built to recognize products, brands, packaging, accessories, wear, and damage. We do not infer demographics, income, household composition, or anything else about a person from what appears in the frame.
We do not sell personal information.
We never have, and we do not share it for advertising.
We do not expose one customer's data to another.
Not in a model output, not in a benchmark, not in a conversation.
We collect the minimum.
We ask retailers to send us the least data a return requires, and we do not need direct shopper identifiers to assess an item.
We use reputable infrastructure.
We run on established cloud and third-party services and rely on the encryption and access controls they provide, rather than building our own.
We will have the following in place before a retailer sends us production returns data, and we will tell you honestly where we are in that process at any point during your evaluation.
| Control | Commitment |
|---|---|
| Encryption | TLS 1.2 or higher in transit, encryption at rest for all stored data including images and backups |
| Access control | Role-based access, least privilege, access removed same-day on departure |
| Authentication | Multi-factor authentication required on all internal systems |
| Customer isolation | Logical separation of each customer's data |
| Logging | Access and application logging, retained and reviewable |
| Incident response | A written plan covering detection, containment, remediation, and customer notification |
| Vendor review | Security review of each subprocessor before it touches customer data |
| People | Confidentiality obligations and security training for everyone with access to customer data |
| Retention | Item images deleted or irreversibly de-identified no later than 180 days after a return is resolved |
| De-identification | Direct identifiers and retailer-attributable fields removed before any data is used for model development |
Our longer-term roadmap includes third-party penetration testing, formal access reviews, and a SOC 2 Type II examination. We are not going to put a date on those until we can hold it.
Our capture flow can run on a shopper's own phone, inside their home. We treat that as the most sensitive part of our product, and it is the reason we made the biometric decisions above before writing a line of model code.
A scan may accidentally include a person or a room in the background. We ask retailers to guide shoppers to frame only the item. Before any item data is used for model development, we commit to reviewing and removing images containing incidental people, and we are building automated screening to do that as volume grows.
If someone believes an image of them was captured, they can email info@skiply.ai and we will locate and delete it.
We use a small set of vendors to run the platform. Each one is reviewed for security before onboarding, bound by a written agreement to protect customer data, and allowed to use that data only to provide services to us.
| Subprocessor | Purpose | Data location |
|---|---|---|
| Amazon Web Services | Cloud hosting, storage and compute for the Skiply platform. Platform data, including item images, is stored here and encrypted at rest. | United States |
| Custom (Skiply) | Computer vision inference. Our own condition grading models, built and operated by Skiply on the infrastructure above. | United States |
| Google Gemini | AI model services that support parts of grading and text processing. Receives only the inputs needed for each request. | United States |
| Google Analytics | Website usage analytics. Collects pseudonymous browsing data from our website, not customer return data. | United States |
| Resend | Transactional and support email, such as account notices and replies to inquiries. Processes email addresses and message content. | United States |
Website tools.
Our public website runs on separate services that never receive customer return data or item images. Webflow hosts the site and its forms, Google Workspace handles demo scheduling and inquiry records, and Cloudflare Turnstile screens form submissions for spam.
Customers receive advance notice of material changes to this list as their agreement provides. To get the current list or subscribe to change notifications, email info@skiply.ai.
U.S. state privacy laws.
We act as a service provider or processor for shopper data we handle on a retailer's behalf. We process it only on the retailer's documented instructions, do not sell or share it, and do not combine it with data from other sources except as permitted.
GDPR and UK GDPR.
We will enter data processing agreements with standard contractual clauses and the UK addendum where required, and support customers in responding to data subject requests.
Payment data.
If and when we bill customers, card and bank details go directly to a PCI DSS compliant payment processor. We do not store full payment card numbers.
Certifications.
We do not hold SOC 2, ISO 27001, or any other security certification today. We would rather say that plainly than imply otherwise. A SOC 2 Type II examination is on our roadmap and we will update this page when it is underway.
Data residency.
Customer data is stored in U.S. regions. Talk to us if you have regional requirements.
We know we are early, and we know that means your security team will have questions. We would rather answer them now than have them surface late in procurement. We can provide:
If a control matters to you and we do not have it yet, tell us. We will either build it before you go live or tell you we cannot, and we will not pretend otherwise.
Email info@skiply.ai.