This notice explains how the Sky360 WordPress plugin, made by Sky Web Design, handles Google user data when a website owner connects a Google account to send the website’s email through Gmail (“Sky360 Mail – One-click setup”). It supplements our main privacy policy.
What we access
When a website administrator clicks Sign in with Google in Sky360, Google asks them to grant two permissions:
- Send email on your behalf (
gmail.send) – so the website can send its own emails (contact-form notifications, order receipts, password resets) from the connected Gmail or Google Workspace mailbox. - Your email address (
openid,email) – so Sky360 can show which account is connected and set it as the sender address.
Sky360 cannot read, search, delete or modify any email, contact, calendar or file in the Google account. The gmail.send permission only allows sending new messages.
How the data is used
- The website builds each email itself and sends it directly to the Gmail API from the website’s own server. Email content never passes through Sky Web Design’s servers.
- Sky Web Design’s licence server (skywebdesign.co.uk) stores the Google refresh token for the connection, encrypted, together with the connected email address, the website’s domain and its Sky360 licence key. It uses the refresh token only to issue short-lived (one-hour) access tokens to that one licensed website.
- The website stores a connection key and an encrypted connection secret, plus the connected email address and the current short-lived access token.
Limited Use
Sky360’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:
- use Google user data only to provide the email-sending feature the website owner switched on;
- do not sell it, use it for advertising, or use it to train AI or machine-learning models;
- do not transfer it to anyone else, except as needed to provide the feature, to comply with the law, or as part of a merger or acquisition with the user’s notice;
- do not allow any person to read it, except with the website owner’s explicit consent for support, for security purposes, or where the law requires.
Retention and deletion
The connection is kept until it is removed. Clicking Remove Connection in Sky360 → Mail / SMTP revokes the access at Google and permanently deletes the refresh token from our licence server. You can also revoke access at any time from your Google Account (myaccount.google.com/permissions), after which the stored token stops working and is marked revoked. To ask us to delete any remaining record, email [email protected].
How we protect your data
These safeguards apply to all Google user data handled by Sky360 Mail and Sky Connect:
- Encryption at rest: Google refresh tokens are never stored in plain text. Gmail tokens are encrypted with AES-256-GCM and Calendar tokens with XSalsa20-Poly1305 (libsodium), each with a unique random nonce. The encryption keys are kept in the server’s configuration, separate from the database, so a copy of the database alone cannot reveal any token.
- Encryption in transit: all traffic between your website, our server and Google uses HTTPS (TLS). Our domain enforces HTTPS with HSTS.
- Minimal data and short-lived access: we request only the narrowest Google permissions the feature needs. Your website only ever receives access tokens that expire within one hour. Email content and calendar events never pass through or get stored on our servers.
- Access control: each connection is tied to the website domain that created it and to a secret that we store only as a SHA-256 hash, checked with constant-time comparison. Gmail connections also need an active Sky360 licence on every token request.
- Restricted staff access: only authorised Sky Web Design administrators can reach the server. No one reads Google user data except as set out under Limited Use above.
- Deletion and incidents: tokens are deleted when you disconnect or ask us to delete them. If a breach ever affected Google user data, we would notify the affected users and authorities as the law requires.
Sky Connect — Google Calendar
Sky Connect lets websites that use our Sky Training Bookings plugin keep their training dates in the website owner’s Google Calendar. It uses the same Google app as Sky360 and is covered by this notice.
- What we access: only Google calendars that the website itself creates in your account (Google permission
calendar.app.created), and the events in them — training dates, times, venue, trainer and the names and email addresses of customers who booked through your website, added as guests. We cannot see, change or delete any other calendar or event in your Google account. We also read your Google account email address to show which account is connected. - How it is used: only to keep that calendar in step with the training dates on your website, in both directions. If you move a training event in that calendar, the website updates the date to match.
- Where it is stored: the refresh token for your connection is stored encrypted on skywebdesign.co.uk, which issues short-lived access tokens only to the website that made the connection. Your website then talks to Google Calendar directly; calendar events are not copied to or stored on our servers.
- Limited Use: Sky Connect’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, use it for advertising, share it with anyone other than the website you connected, or use it to train AI or machine-learning models, and our staff do not read it except with your permission for support, for security, or to comply with the law.
- Disconnecting and deletion: when you click Disconnect in your website’s Google Calendar settings, we delete the stored token immediately, so it can never be used again. You can also remove access at any time at myaccount.google.com/connections. The calendar the website created stays in your Google account under your control. To have all Sky Connect data about you deleted, email [email protected] and we will do so within 30 days.
Contact
Questions about this notice: [email protected].
