Skip to content

Skybox Privacy Policy

Last updated: October 16, 2026

Skybox is operated by Kingbear LLC ("Kingbear", "we"). This policy explains what we collect, why, and the choices you have. It covers openskybox.com, the Skybox application, and the rooms our customers publish with Skybox, including rooms served on a customer's own domain.

Two kinds of people use Skybox. Customers are the companies and their staff who build rooms. Visitors are the people a customer invites into a room. If you are a visitor, the customer who built the room decides what it contains and why you were invited; we process your information on that customer's behalf, and this policy describes what that processing is.

1. What we collect from customers

  • Account details: your work email, name, title, company name, and the password you set. Optionally, a photo, a booking link and a short bio you add to your profile.
  • Billing details, if you subscribe: handled by Stripe. We store your Stripe customer and subscription identifiers and your plan; we never see or store card numbers.
  • Content you add: documents, notes, logos, package templates and room settings.
  • Integrations you connect: if you connect Slack, we store an access token for your workspace, encrypted; if you connect Apollo, we store your Apollo credential, encrypted. We use them only to send the alerts you turn on and to run the imports you start.
  • Usage: which admin pages you use and when, standard server logs, and the IP address and timestamp of sign-in and password-reset requests (kept as a one-way hash in our logs).

2. What we collect from visitors

  • The work email you type at the door, the door code (checked, not stored in your session), and a session cookie so you don't have to re-enter them for 30 days.
  • What you do in the room: entries, documents opened or downloaded, and clicks on a booking link, with timestamps. This activity is shown to the customer's sales team for that room.
  • Business profile information, on some rooms. Where this is enabled for the customer's workspace, and the room's entry screen says so, we send your work email to a third-party business data provider (currently Apollo.io) and store what it returns: name, job title, employer, location, a link to your public professional profile, and a photo. This is shown to the customer's team alongside your activity. We do this once per email per customer and keep the result.
  • Technical data: IP address, browser and device type, in standard server logs.

We never show a visitor any information about other visitors.

3. Why we use it

  • To run the service: open the right room to the right people, deliver documents, and show customers who engaged.
  • To send alerts customers have turned on: an email when a visitor enters, and, where the customer has connected Slack, a message when they enter, open a document or click to book time.
  • To bill customers and keep accounts secure.
  • To improve the product, using aggregate usage that does not identify a visitor.

We do not sell personal information. We do not use visitor information for our own advertising.

4. Who we share it with

Service providers acting on our instructions: Supabase (database and file storage), Vercel (hosting), Resend (email delivery), Stripe (payments), Slack (alerts, where a customer connects it), and Apollo.io (business profile lookup and list import, where a customer uses it). Each receives only what its function needs.

With the customer who built the room: everything in section 2 about visitors to their rooms.

When required by law, or to protect the rights and safety of Kingbear, our customers or others.

5. Cookies

Skybox sets a session cookie when you enter a room (expires after 30 days of inactivity) and a sign-in cookie for customers. We do not use advertising or cross-site tracking cookies.

6. Retention

  • Visitor activity and profile information: kept while the room and the customer's account exist. When a customer deletes a room, that room's activity records are deleted. Profile information is held at the company level and deleted when the customer's account closes. When a customer's account is closed, its data is deleted within 30 days, except what we must keep for billing or legal reasons.
  • Documents: kept until the customer removes them or the account closes.
  • Server logs: 90 days.

7. Security

Data is encrypted in transit and at rest. Documents are served through short-lived signed links, never public URLs. Integration credentials are encrypted with keys held separately from the database. Access to customer data within Kingbear is limited to staff who need it to operate the service.

8. Your choices and rights

  • Customers can edit or delete their content, rooms and profile at any time, and can close their account by contacting us.
  • Visitors: the customer who built the room is responsible for your information in it. To see, correct or delete what a room holds about you, contact that company; we will assist them. You can also contact us directly and we will forward your request.
  • Depending on where you live, you may have rights to access, correct, delete or restrict use of your personal information, and to object to processing.

9. Children

Skybox is a business tool and not directed to anyone under 18. We do not knowingly collect information from children.

10. Changes

We will post changes here and update the date above. Material changes affecting visitors will also be reflected on room entry screens.

11. Contact

Kingbear LLC · 15953 N Greenway-Hayden Loop, Suite J, Scottsdale, AZ 85260 · hello@openskybox.com