1. Who We Are
MIRRORMAZE COMMUNICATIONS Ltd. ("MMC", "we", "us") operates Skylight:One, an online research and open-source intelligence platform. We are registered in England and Wales under company number 14868466.
Our registered office is 1 London Road, Ipswich, Suffolk, United Kingdom, IP1 2HA. Privacy enquiries: [email protected].
This notice covers the Skylight SaaS platform and our marketing websites. Privately hosted deployments are outside its scope; their operator's privacy information applies. Our processing is subject to applicable UK data protection law, including the UK GDPR and Data Protection Act 2018.
2. Our Commitments
Your research belongs to you. We claim no ownership of your investigation content and do not sell, rent or disclose it for commercial exploitation. We do not use it to train AI models or develop or improve our service.
We access Your Content only where necessary to provide, secure or support the Services, investigate suspected AUP breaches or unlawful activity, or comply with legal obligations. Such access is recorded. We disclose Your Content to authorities only where legally compelled, challenge requests we consider overbroad, and notify you where legally permitted. Deletion is subject to the backup and legal-preservation arrangements below.
3. Information We Process
Your Content includes browsing and URL history, including full URLs, page titles and content, captured images and files, extracted entities and generated summaries. It may contain personal information about people who do not use Skylight.
Account Information includes your name, organisation, job title, email address, username, permissions, authentication information, preferences, billing information and communications with us. Service Data includes operational telemetry such as session timings, bytes transferred, errors, authentication events and administrative actions. Marketing-site information is described in section 11.
4. Our Role and Lawful Bases
When we process Your Content to provide the Services on a customer's documented instructions, we act as a processor. The customer determines the investigation's purposes and is responsible for identifying its lawful basis and any additional conditions for special-category or criminal-offence data. Our customer agreement does not itself provide a lawful basis for processing information about investigation subjects. Public availability does not remove data protection requirements.
If MMC determines a separate processing purpose, such as investigating misuse for its own security purposes or complying with a binding legal requirement, MMC acts as controller for that processing and must establish an appropriate lawful basis. For information we control, we rely on the following:
| Purpose | Lawful basis |
|---|---|
| Administering an individual customer's account, delivering their subscription, processing payments and providing necessary support | Contract — Article 6(1)(b), including necessary steps requested before entering a contract. |
| Managing accounts, permissions, billing contacts and support where an organisation contracts with us | Legitimate interests — Article 6(1)(f): delivering the organisation's service and administering the customer relationship. |
| Securing accounts and infrastructure, detecting fraud, investigating misuse and maintaining proportionate security audit records | Legitimate interests: protecting customers, third parties and the Services against unauthorised access, fraud and abuse. |
| Using limited card identifiers to detect multiple free accounts | Legitimate interests: preventing misuse of free-account entitlements through necessary and proportionate checks. |
| Diagnosing faults and monitoring availability, capacity and reliability through operational telemetry | Legitimate interests: operating a reliable service. This does not authorise using Your Content for product development or AI training. |
| Responding to general business enquiries | Legitimate interests: responding to people who contact us. Contract applies instead to necessary pre-contractual steps requested by an individual. |
| Fulfilling an individual's merchandise order or promotional entitlement included in their subscription | Contract, where processing is necessary to fulfil the order or entitlement. |
| Keeping legally required tax and accounting records, responding to data protection rights requests, and meeting binding disclosure or preservation requirements | Legal obligation — Article 6(1)(c), limited to what the applicable obligation requires. |
| Establishing, exercising or defending legal claims | Legitimate interests: protecting and enforcing our legal rights, subject to additional conditions for sensitive information. |
| Measuring marketing-site traffic through proportionate server logs and producing internal aggregate visitor reports | Legitimate interests: understanding website usage and maintaining performance, limiting identifiable information to what is necessary. |
| Optional cookies or similar technologies, and promotional communications, where consent is required | Consent — Article 6(1)(a), requested separately for the relevant purpose. Legitimate interests do not replace consent required by electronic communications rules. |
We use contractual necessity only where processing is objectively necessary for a contract with the individual concerned. Before relying on legitimate interests, we assess purpose, necessity and impact, and do not rely on this basis where individuals' interests, rights or freedoms override those interests. You may object by contacting [email protected].
Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing. These bases do not alone authorise special-category or criminal-offence processing; where MMC is controller, we must also satisfy the additional conditions required by law.
5. How We Use Information
We process Your Content to store your research and deliver the features you choose. We do not use it for advertising or independently profile investigation subjects for our own purposes. We use Account Information and Service Data to administer accounts, authenticate users, provide support, manage billing, operate the platform and investigate security incidents or misuse.
Authorised administrators may query and export cross-customer URL history and audit events. These reads are recorded, including filters and row counts, and affected customers can view relevant reads in their organisation audit log.
6. Payments, Verification and Merchandise
Stripe processes payment-card information. MMC does not store full card numbers. For organisation billing, we retain relevant legal names, addresses, company numbers and VAT details. Invoices retain the billing information recorded when issued.
Where card verification is required, Stripe handles the card information. MMC retains a reference and limited metadata, including brand, last four digits, expiry and issuing country. A card identifier may detect multiple free accounts and is deleted when the account is deleted.
For merchandise, we collect a name, UK/EU shipping address, optional telephone number, colour and size. We delete shipping names, addresses and telephone numbers after dispatch and retain colour, size, destination country and dispatch date for operational counts.
7. Artificial Intelligence
Features you choose may send relevant Your Content to OpenAI for processing in the United States. These include summarisation, the in-session assistant, entity extraction and the Klovix Agentic Browser tool. Our configuration does not enable sharing inputs and outputs for model training. AI output is not written to our aggregated logs.
AI-generated extraction and classification support human analysis; we do not make solely automated decisions about individuals that produce legal or similarly significant effects.
8. Providers and International Transfers
Our platform compute, storage and self-hosted PostgreSQL database are hosted on our Hetzner cluster in Helsinki, Finland. Backups are retained in Helsinki for 30 days. AI processing takes place in the United States. Other providers include Stripe.
9. Retention and Deletion
Platform telemetry is retained for 90 days, then deleted. SkylightDrive data, VDE workspaces, emulator devices and browser profiles remain under your control until deletion, subject to applicable service terms. Deleted information may remain in backups for up to 30 days. Billing records are retained for applicable statutory periods. Information subject to a legal preservation requirement is retained for as long as that requirement applies.
10. Security
We use technical and organisational measures intended to protect information, including access controls, password hashing, hashed API keys, authentication protections, organisation-scoped access controls and encryption of stored proxy credentials. No internet-connected service can eliminate all security risk. Users must protect their credentials and follow our Acceptable Use Policy.
11. Websites, Cookies and Similar Technologies
The platform does not use third-party advertising or analytics tracking. Authentication uses client-held tokens. Cookies and other browser storage may still fall within applicable privacy rules, regardless of whether a server sets them. Our marketing websites use Cloudflare, Google Fonts, cookies and server logs. Logs may include IP addresses, requested pages, browser information and approximate location where available. Daily visitor reports are sent through Resend.
12. Your Rights and Contact Details
Where MMC acts as controller, you may have rights to access, correct, erase, restrict or object to processing, and to receive or transfer certain information. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Rights are subject to applicable conditions and exemptions.
Contact [email protected]. For Your Content processed for a customer, we may refer your request to that customer and assist them as appropriate. You may complain to the Information Commissioner's Office. We may update this notice and will communicate material changes where required.