Privacy Notice

BlueSky Consulting (trading as Northlight Studio) decides how and why your personal data is processed when you use the platform, and is therefore the controller. Contact us about privacy at contact@bskysec.com.

• Account data — name, email address, and authentication identifiers (including your Google account ID if you sign in with Google). Used to create and secure your account. Legal basis: performance of our contract with you.
• Content data — the niches and prompts you enter, generated blueprints, scripts, stills, narration and video masters. Used to provide the service and store your work. Legal basis: contract.
• Credit and transaction records — your credit balance and ledger, and the order references we receive from our reseller. Used for billing accuracy and support. Legal basis: contract and legal obligation.
• Support communications — messages you send us. Used to answer you. Legal basis: legitimate interests.
• Usage and device data — log entries, IP address, browser and device identifiers, error reports and feature usage. Used for security, abuse and fraud prevention, and product improvement. Legal basis: legitimate interests.

Where we ask for consent — for example optional analytics or marketing email — you can withdraw it at any time.

Payments are handled by Paddle as Merchant of Record. We do not collect or store your card details; Paddle processes payment information under its own privacy notice and shares only the order and status data we need to credit your balance.

• Service providers and subprocessors: cloud hosting and database providers, AI model and rendering providers that process your prompts to produce output, stock media search providers, email delivery, error monitoring and analytics tooling.
• Paddle, our Merchant of Record, for sale of the product, payments, subscription management, tax compliance and invoicing.
• Professional advisers such as legal and accounting, where necessary.
• Authorities and regulators where required by law or to defend legal claims.

We do not sell your personal data.

Some of our providers operate outside your country, including in the United States. Where data leaves the UK or EEA we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Account and content data are kept while your account is active. If you delete your account, we delete or anonymise your account and generated content within 90 days, except records we must keep for tax, accounting or fraud-prevention purposes, which we retain for the period the law requires. Security logs are kept for up to 12 months.

Subject to local law, you can request access to your data, correction of inaccurate data, erasure, restriction of processing, portability, and object to processing based on legitimate interests. You may withdraw consent where processing relies on it. Write to contact@bskysec.com and we will respond within one month. If you are in the UK or EEA you may also complain to your local supervisory authority.

We apply appropriate technical and organisational measures, including encryption in transit, encryption at rest for stored assets, row-level access controls scoped to your account, and least-privilege access for staff and services.

We use strictly necessary cookies and browser storage to keep you signed in and to protect the service. Any analytics or marketing cookies are optional and set only with your consent; you can clear or block cookies in your browser settings at any time.

We will update this notice when our processing changes and will highlight material changes in-app or by email.