Who is responsible for your data
[legal entity name to be supplied] (registration number [registration number to be supplied]), of [registered address to be supplied], operates Skywing Careers Academy and is the controller of the personal data described in this policy.
Privacy requests: hello@skywingcareers.com. Data Protection Officer or designated privacy contact: [data protection contact to be supplied].
Skywing is an independent career-preparation service. It is not an airline, recruitment agency or employer, and it is not affiliated with any airline.
The data we collect
Depending on how you use Skywing, we may collect the following.
- Account details.
- Target-airline and eligibility answers.
- Readiness and diagnostic responses.
- CVs and documents you choose to upload.
- Service intake information.
- Mentor messages and session details.
- Application-status information you share with us.
- Purchase records.
- Technical journey events used to operate and improve the platform, and basic device and browser information.
Why we use your data, and our lawful basis
We only use personal data for the purposes below and only where we have a lawful basis. Under the GDPR the bases are contract, legal obligation, legitimate interests and consent. Under the UAE and Saudi personal data protection laws, consent is the general basis, together with the permitted grounds those laws provide for contract performance, legal obligations and legitimate interests; we rely on those grounds in the same way as shown here.
| Purpose | Main data involved | Lawful basis |
|---|---|---|
| Check airline eligibility and generate a preparation recommendation. | Account, eligibility and diagnostic answers. | Contract: providing the service you ask for, including steps taken before you buy. |
| Deliver CV Only, Get Invited, Assessment Success, Full Support and legacy purchases. | Account, intake information, CVs and documents, purchase records. | Contract. |
| Assign mentors, provide human support, review candidate work and schedule included sessions. | Account, intake information, documents, messages, session details. | Contract. |
| Secure accounts, prevent abuse and maintain service records. | Account, log-in and technical data, service records. | Legitimate interests: keeping the service secure and preventing fraud and abuse. |
| Take payments, issue confirmations, keep transaction records, handle disputes and meet accounting and legal duties. | Purchase records, payment status, amount, currency, customer email. | Contract; legal obligation; legitimate interests in establishing and defending legal claims. |
| Send transactional and service-related emails. | Name, email address, service and session details. | Contract; legitimate interests in keeping you informed about the service you use. |
| Remind you about unfinished steps in your preparation journey. | Name, email address, journey progress. | Legitimate interests; you can object at any time and we will stop. |
| Understand first-party funnel and service usage and improve the platform. | Journey events with an account or anonymous journey identifier. | Legitimate interests in operating and improving the platform. |
| Optional browser analytics (for example PostHog) to understand how pages are used. | Pseudonymous usage and device data. | Consent, which you can withdraw at any time. |
| Optional AI-assisted CV analysis that you start yourself. | The CV text and details you submit for analysis. | Consent, given when you choose to run the analysis; you can withdraw it at any time. |
| AI-assisted answers to routine support questions in Mentor Chat. | Recent chat messages and limited service context. | Contract; legitimate interests in answering routine questions quickly. |
| Send marketing communications, if and when we offer them. | Name and email address. | Consent, which you can withdraw at any time. |
Consent and legitimate interests
Where we rely on consent you can withdraw it at any time, for example in the cookie settings or by contacting us. Withdrawing consent does not affect processing carried out before you withdrew it.
Where we rely on legitimate interests we weigh them against your rights and expectations, and you can object to that processing at any time.
Payments and service providers
Stripe processes payments. Skywing may receive identifiers, payment status, amount, currency, customer email and product or service references needed to confirm and fulfil a purchase. We do not receive or store your raw card number or CVV.
We use third-party infrastructure and service providers (processors) where necessary to operate Skywing. They may only use personal data on our instructions and under contract. The categories are:
- Payments: Stripe.
- Transactional email: Resend.
- Hosting, database, file storage and backups: Wasabi (S3-compatible object storage) and Oracle Cloud Infrastructure.
- Product analytics, only with your consent: PostHog.
- AI model provider for optional CV analysis and AI-assisted support: an AI model provider selected by Skywing.
No sale of data
We do not sell candidate personal data to advertisers.
Analytics
Skywing records first-party journey events such as diagnosis milestones, recommendation views, checkout and service events and fulfilment milestones. These records may include account or anonymous journey identifiers. Payment-related analytics may also be sent server-side to our configured analytics provider.
Browser-based analytics from PostHog run only if you accept analytics cookies and similar technologies, and stop if you withdraw that consent. See the Cookie Policy.
We do not use this data to make airline hiring decisions.
Mentor and document data
Mentors may access candidate information only as needed to deliver assigned services. Support messages and service records are restricted to the candidate and authorized Skywing personnel.
Only upload sensitive documents (for example identity, visa or medical documents) when they are genuinely required for the service. If you do, we process them only to deliver the service you requested, on the basis of your explicit consent or as otherwise permitted by law.
AI-assisted features
Skywing may use an AI assistant to answer routine support questions inside Mentor Chat. The assistant may process limited Skywing context needed for support, such as recent chat messages, the active service package, target airline and mentor-confirmed recruitment stage. It has no access to your Gmail, private inboxes, airline accounts, airline portals or device unless you separately provide information inside Skywing.
You may ask for a human mentor at any time during an active support window. Certain messages may also be flagged for human review, including possible recruitment-stage changes, urgent deadlines, payment or refund matters, account-access issues, complaints, personalized document review and other sensitive matters. AI suggestions do not themselves change a confirmed recruitment stage.
CV analysis is optional. If you ask for an AI-assisted CV analysis, the CV text and details you submit are sent to our AI model provider (an AI model provider selected by Skywing), which acts as our processor and may process them only to return the analysis to us. The analysis is a preparation aid. It does not reproduce any airline's screening system or predict an airline's decision, and we do not use it to take decisions about you that have legal or similarly significant effects.
Retention and security
We retain information while an account is active and as reasonably necessary for fulfilment, transaction records, security, dispute handling and legal obligations. After that, data is kept as follows and then deleted or anonymized.
- Account and profile data: kept while your account is active and afterwards for as long as needed for the purposes described in this policy, then deleted or anonymized.
- Order and payment records: kept for as long as needed for the purposes described in this policy, then deleted or anonymized; the law may require us to keep some records longer.
- Uploaded CVs and documents: kept while the service is active and afterwards for as long as needed for the purposes described in this policy, then deleted or anonymized.
- Support messages and mentor records: kept for as long as needed for the purposes described in this policy, then deleted or anonymized.
Security
Access rules restrict candidate files, service records and mentor communications. No online service can be completely secure, so please keep your login private.
Your rights
Depending on the law that applies to you (including the GDPR, the UAE PDPL and the Saudi PDPL), you may have the following rights.
- Access: to know whether we process your data and to receive a copy.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to ask us to delete your data in the cases the law provides.
- Restriction: to ask us to limit how we use your data in the cases the law provides.
- Portability: to receive data you provided in a structured, commonly used format.
- Objection: to object to processing based on legitimate interests and to direct marketing.
- Withdraw consent: at any time, where processing is based on consent.
- Complain to a supervisory authority: see the section on complaints below.
How to use your rights and complain
To make a privacy request, contact hello@skywingcareers.com. We may need to verify your identity before acting on a request. We respond within the time the applicable law requires; under the GDPR that is one month, which may be extended where the law allows.
You also have the right to complain to a supervisory authority. If you are in the EU or UK this can be the data protection authority in the country where you live or work; in the UAE, the UAE Data Office; in Saudi Arabia, the Saudi Data and AI Authority (SDAIA). We would appreciate the chance to resolve your concern first.
International transfers
Skywing serves candidates internationally, so data may be processed in countries different from your own through our service providers.
Where personal data from the EEA or UK is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses.
For personal data subject to the UAE or Saudi personal data protection laws, we transfer data outside those countries only in the ways those laws and their implementing rules permit, such as to jurisdictions or recipients that offer the protection the law requires, under appropriate contractual safeguards, or with your consent where required.
You can ask hello@skywingcareers.com for information about the safeguards that apply to your data.
Additional information for the EEA and UK
Where the EU General Data Protection Regulation or the UK GDPR applies to our processing, [legal entity name to be supplied] acts as controller, we process personal data on the lawful bases in this policy, and the rights in this policy apply to you.
Additional information for the United Arab Emirates
Where UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL) applies, we process personal data lawfully, fairly and transparently, for specified purposes, limited to what is needed, kept accurate and secure, and not kept longer than needed. We process on the basis of your consent or another ground the UAE PDPL permits. You may withdraw consent at any time, and you have the rights described in this policy, including to access, correct, erase, restrict, port and object. Cross-border transfers follow the section on international transfers.
Additional information for Saudi Arabia
Where the Saudi Personal Data Protection Law (Royal Decree M/19 of 2021, as amended by Royal Decree M/148 of 2023) applies, we process personal data for defined, lawful purposes, based on your consent or another ground that law permits. You may withdraw consent at any time, and you have the rights described in this policy, including to be informed, to access and obtain a copy, to request correction and to request deletion of your data. Transfers of personal data outside the Kingdom follow the section on international transfers.
Personal data breaches
If a personal data breach occurs that is likely to harm your rights or interests, we will notify the competent supervisory authority and, where the law requires, the people affected, within the time the applicable law requires (including under the GDPR, the UAE PDPL and the Saudi PDPL).
Age requirement
Skywing is intended for people aged [minimum age to be supplied] or over. We do not knowingly collect personal data from anyone younger. If you believe a younger person has given us data, contact hello@skywingcareers.com and we will delete it.
Changes to this policy
We may update this notice as the platform or providers change and will update the date shown above. Where the law requires, we will tell you about material changes in advance.
Contact
[legal entity name to be supplied], [registered address to be supplied]. Privacy requests: hello@skywingcareers.com. Data Protection Officer or privacy contact: [data protection contact to be supplied].
Change log
Version 2.0.0, October 11, 2026
Full rewrite for the Skywing Careers Academy website and app, covering GDPR, UAE and KSA personal-data law and consumer rules. Replaces the legacy pages.
