Privacy Policy

At Skillsail, we take the protection of your personal data very seriously. We process personal data in accordance with the principles of the EU General Data Protection Regulation (GDPR). In this privacy policy, we explain how Skillsail (hereinafter also "we", "us" or "our") collects, uses and protects personal data when you use the Skillsail platform (our AI-powered eLearning content creation, hosting, sharing, and export service), our website or related services. We also describe your rights regarding your personal data under the GDPR and how you can exercise these rights.

This Privacy Policy is a notice describing our processing activities. It is not itself a request for consent and does not make a User, parent, or legal guardian a party to the Customer's agreement. Where we rely on consent for a particular activity, that consent is requested separately and may be withdrawn as described below.

Who we are and how you can contact us

Skillsail GmbH is responsible for processing your personal data in connection with our services. Within the meaning of applicable data protection laws, Skillsail GmbH acts as the controller for the data processing activities described in this statement (except in cases where we process data on behalf of a customer, as explained below).

Note: If you use Skillsail as part of an organization's account (e.g., your employer or educational institution), that organization generally determines why and how Customer Personal Data is processed and acts as controller, while we act as processor under our agreement with the organization. Skillsail may separately act as controller for processing connected with our direct Customer relationship, service and account security, billing, fraud prevention, legal compliance, and support. The applicable role depends on the particular processing activity, and your organization's privacy notices may also apply.

When we act as a processor for our customers (organizations using Skillsail to create or deliver eLearning content), data processing is governed by our Data Processing Agreement (DPA) in accordance with Art. 28 GDPR.

Contact information: If you have questions or concerns regarding your personal data or this privacy policy, you can reach us at any time at hello@skillsail.com.

Company Details:
Skillsail GmbH
Elektrastraße 11
81925 Munich
Germany

Registered with the Commercial Register of the Local Court Munich (Amtsgericht München) under HRB 303017.

Data Protection Officer: We have not appointed a Data Protection Officer (DPO). Please direct privacy inquiries to the contact email address above. If our contact arrangements change, we will update this Policy.

General Audience and Younger Users

Skillsail is a general-audience business and professional service that may be used by eligible Users aged 13–17 subject to the conditions below; it is not directed to children under 13. A person under 13, or below any higher minimum age required by applicable law for the person's location or the relevant feature, may not use Skillsail. A person aged 13–17 may use Skillsail only as a Younger Authorized User invited or added to an Organization Account by a Customer and only while the Customer's authorization and prior and continuing permission from a parent, legal guardian, or other holder of parental responsibility who has legal authority under applicable law ("Guardian Permission") remain in effect. Younger Authorized Users cannot use account-free public experiences, create or administer an Organization Account, accept the Terms or Data Processing Agreement, purchase or manage a Subscription, or act as Account Owner, administrator, or billing contact. Those acts require a Customer representative who is at least 18 years old, has reached the age of majority and has full legal capacity under applicable law, and has authority to bind the Customer.

Guardian Permission is an eligibility condition for access. It does not accept the Customer's agreement, make the person giving permission a Customer, transfer the User's data-protection rights, or constitute consent to unrelated processing or marketing. Where Skillsail relies on consent under Article 6(1)(a) GDPR for an information-society service offered directly to a child, Article 8 GDPR applies separately. In Germany, a child may give that consent independently from age 16; below 16, consent must be given or authorized by the holder of parental responsibility, and the controller must make reasonable efforts to verify that authorization. Other countries may apply a different threshold or additional rules. Where an organization is controller, it is responsible for its lawful basis and child-specific obligations and Skillsail acts on its lawful documented instructions. Skillsail remains responsible for processing for which it is controller.

Our ordinary registration flow does not ask for a date of birth, a copy of an identity document, guardian contact details, or proof of Guardian Permission, and Skillsail does not ordinarily store an age band or permission status. We do not claim to verify a User's age or Guardian Permission merely because the User accesses Skillsail through ChatGPT or an identity provider. We rely on the Customer's contractual representation for account eligibility and use a notice-and-response process. This does not remove any consent-verification, age-assurance, or other duty that applies to a particular processing activity. Customer Data may nevertheless contain age-related information if a Customer or User chooses to submit it.

If you believe that a person is using Skillsail below the applicable minimum age, or that a Younger Authorized User is using it without Customer authorization, Guardian Permission, or another authorization required by applicable law, contact us at hello@skillsail.com so that we can investigate. If we become aware of such use or processing, after obtaining reasonably sufficient information, we will restrict further unauthorized access and take the steps required by applicable law. Those steps may include deletion, unless retention or other handling is required or permitted by law. Where an organization is the controller, we may notify it and act on its lawful documented instructions. We may need to verify the requester's identity and authority, and we will not disclose a User's data solely because a requester claims to be a parent or guardian.

In simple terms for younger Users: If you are under 13, or below a higher minimum age that applies where you live or to the feature you want to use, do not use Skillsail. If you are 13–17, use Skillsail only through an organization that invited you and only with permission from your parent or legal guardian. Skillsail needs basic account, content, and usage data to provide the service. Your organization's administrators may manage your access and see data associated with its workspace. If you use an AI feature or connect another AI client, the information needed for that request goes to the providers described below. Content or links you or your organization make public may be seen by other people. Do not include secrets or sensitive personal information in prompts or course content. Ask a parent, guardian, teacher, or organization administrator if you need help, and contact us if you want to understand or exercise your privacy rights.

Data we collect

We collect various types of information – including personal data – when you interact with Skillsail. This includes, among others:

• Account data: When a person creates or administers an Organization Account, is invited or added to one, or signs in, we collect information such as name, email address, organization name or membership, authentication-provider identifiers, and session information needed for login. We may also collect profile details the User voluntarily adds. If Google authentication is selected, we receive the profile information described in the Google User Data section. Organization admins can delete an Organization Account from the platform settings, and Users can contact us about privacy-rights requests.
• Learning content and user-generated data: Content you upload or create is stored through the platform, such as course materials, modules, resources, messages, or feedback. This content is private and not publicly accessible by default. It may be processed or disclosed when an authorized user shares, publishes, exports, or requests provider processing, and in the other circumstances described in this Policy, including lawful requests and business transfers. Skillsail does not itself use customer content to train or fine-tune shared, general-purpose AI models.
• Review comment data: When an authorized user shares a module for review with comments enabled, we store the information needed to display the review conversation. For a visitor who is not signed in, that is a reviewer display name of up to 80 characters that the visitor types and the text of each comment, up to 2,000 characters per comment. A display name is free text chosen by the person writing it, so it may itself contain personal data. We do not store an email address, IP address, browser user agent, or device fingerprint on a review record, and commenting does not create a Skillsail account. A signed-in member of the module's own organization is attributed under the first and last name from that member's Skillsail profile; we never fall back to the member's email address for attribution.
• Usage data: We collect information about how you use the platform – such as which features or pages you access, your content-generation, editing, sharing, export, and credit-usage operations, and similar service metrics. This may also include technically automatically collected data, such as your IP address, browser type, device information, provider-derived country or region where available, and timestamps of your activities recorded in log files. Vercel Web Analytics and Speed Insights load across our website and platform to collect page-view, approved custom-event, and real-user performance data. A Web Analytics data point may include its timestamp, requested URL or path and dynamic route, filtered query parameters, referrer, approximate country or region, browser, operating system, device type, and analytics-script version. A Speed Insights data point may include its route and URL, network class, browser, operating system, device type, country, Web Vital measurement and element attribution, SDK version, and server receipt time. Vercel states that Web Analytics does not use third-party cookies and uses a request-derived visitor hash whose session lifespan is discarded after 24 hours. Because Web Analytics and Speed Insights receive URLs or routes, we treat those records as potentially pseudonymous Personal Data where a URL contains a module, organization, or other identifier; we do not describe them as unconditionally anonymous. Custom-event payloads are limited to predefined operational fields, including fixed allowlisted categories derived locally, and must not contain Customer Content or directly identifying Personal Data. Sentry receives application errors from the client, server, and edge. The application also enables production client traces and structured logs; the marketing website does not enable client tracing or client structured logs. Depending on the event, diagnostics may include an error message and stack trace, URL or route, request and network metadata, timestamp, browser and device data, IP address or derived location, internal User or Organization identifier, and contact details deliberately attached to a selected failure report. Production application client traces are currently sampled at 100%. Browser console breadcrumbs are excluded, and bearer tokens are removed from module-media request breadcrumbs and spans. Session Replay is not enabled in the current browser configuration. An AI agent observability provider identified on our Subprocessors page receives production authoring-agent trace metadata, such as span structure, errors, model, token, cost, and timing information, tool names, and technical run and feature context. Context may include session, chat, module, internal User or Organization, and connected-channel identifiers. Full model-input and model-output capture is disabled in that trace pipeline. Separately, where our incoming-text observation feature is enabled, bounded incoming text and related technical context are sent to the observability provider for AI-assisted misuse classification and human review. That feature is described in the AI Processing section below.
• Cookies and similar technologies: When you use our platform or website, we use cookies and similar technologies for security, usability, audience measurement, performance monitoring, and fault diagnosis (details can be found in the Cookies and Tracking section below). These measurement and diagnostic services are not used for advertising or cross-site marketing tracking.
• Communication data: When you contact us directly (e.g., for support requests) or subscribe to our newsletter, we collect information such as your name, email address, the content of your messages, your IP address, and submission metadata such as the time and source of the request. We also store communication preferences such as subscription, unsubscribe, complaint, and suppression status. A provider subscription status is not itself evidence of consent. Where consent is required, we must separately retain sufficient evidence of the consent event, including its wording, time, and source. Contact form IP addresses and submission metadata may be sent to our disclosed email and customer-relationship providers for contact handling, security, and abuse prevention.
• Lifecycle audience and communication data: When a person creates or administers an Organization Account, completes onboarding, or updates relevant account settings, we create or update a contact with the email communications provider identified on our Subprocessors page using the email address, first and last name, internal User and Organization identifiers, and app language. For Organization Account creators, we also synchronize the number of modules created, most recent module or chat activity, whether the account has been inactive for 21 days, whether credits are low, and the current plan and Subscription status. We do not send Customer Content, prompts, module titles, chat text, or uploaded files to the provider for these workflows. The provider may create a contact if none exists and maintain audience membership and a provider-level subscription status. Our routine contact and lifecycle updates preserve an existing unsubscribe. Audience membership and provider-level subscription status are technical delivery settings; neither is consent or other legal authorization to send optional marketing. We also process send, delivery, bounce, complaint, unsubscribe, preference, and suppression records. Campaign or workflow open and link-click measurement, if enabled, may be used only under an applicable lawful basis and the disclosed provider configuration. We do not use open or link-click measurement for necessary transactional emails.
• Billing, subscription, and transaction data: When a Customer purchases or manages a Subscription, we and the applicable payment provider may process the organization name, billing email, plan, checkout, subscription, invoice, transaction, refund, dispute, tax, and payment-status information. Depending on the payment method and Link settings, the Stripe and Link services may also process Link account and authentication data, name, email, phone number, billing or shipping address, payment-method details, IP address or derived location, device identifiers, tax identifiers, and order and transaction details. Skillsail stores provider customer, subscription, and price identifiers; plan and subscription status and periods; cancellation or scheduled-plan metadata; credits; and entitlement status. The applicable Stripe entities and Sold through Link handle payment instruments, hosted checkout, billing and tax details, invoices and receipts, refunds, disputes, transaction support, and order or Subscription management in their services. They may provide Skillsail with order, Customer, transaction, tax, and status records needed to deliver the Platform and administer the relationship. Skillsail does not store full payment-card details and may access or receive only the provider records, identifiers, and status information needed for Subscription administration, support, accounting, fraud prevention, and legal obligations.
• Guardian and rights-request data: If a parent, legal guardian, representative, or organization contacts us about a younger User or a privacy-rights request, we may collect contact information, the claimed relationship to the User, correspondence, and information reasonably necessary to evaluate identity, authority, and the request. Permission to use Skillsail does not by itself provide us with guardian contact information or make the guardian a Customer.
• Authentication data: Login to the Skillsail platform uses secure authentication methods including Google OAuth. WorkOS AuthKit uses session and access-token cookies for authenticated web access. MCP bearer tokens are presented and verified for each request and are not stored in a general-purpose product database field. Authentication and authorization data are used for identity verification, session management, organization access control, integration operation and revocation, and protection of the Platform.

How we use your data (purposes and legal bases)

We process personal data for the following purposes. We rely on a legal basis under the GDPR for each:

Where Skillsail relies on legitimate interests under Article 6(1)(f) GDPR, we identify the specific interest, assess whether the processing is necessary, and document a balancing assessment before relying on that basis. We do not rely on that basis where the data subject's interests, rights, or freedoms override the identified interest, and we give particular weight to those rights where the data subject is a child. You may contact us for information about the balancing considerations applicable to you. Where Skillsail acts only as a processor, the Customer determines the legal basis and Skillsail acts on lawful documented instructions.

Note on AI use: We use AI technologies to assist in generating eLearning content. For details on AI processing and data usage, please see the AI Processing section below.

• Providing our services: We use your personal data to set up and manage your account, authorize organization access, create, host, edit, share, translate, and export eLearning content, administer usage allowances, and generally operate the Skillsail content-creation service for you and your organization.
  Legal basis when Skillsail acts as controller: where the data subject is an individual Customer and the processing is necessary to perform that person's contract, Art. 6 para. 1 lit. b GDPR. For Authorized Users and representatives who are not parties to the Customer's contract, Skillsail relies on Art. 6 para. 1 lit. f GDPR only after the documented assessment described above for the specific interests in securely authenticating Users, administering organization-authorized access, protecting the Service against misuse, and responding to service and support requests. Where the organization is controller and Skillsail acts as processor, the organization determines and communicates the applicable legal basis.
• Module review and feedback: Where an authorized user has enabled comments on a shared module, we process the reviewer display name and the comment text to show the review conversation to the people who can open that module, to attribute each comment to the person who wrote it, and to let a reviewer delete their own comment.
  Legal basis when Skillsail acts as controller: Art. 6 para. 1 lit. f GDPR, after the documented assessment described above, for the specific interest in operating a review and feedback function that the module's author has deliberately enabled. Where the organization is controller and Skillsail acts as processor, the organization determines and communicates the applicable legal basis.
• Personalization and platform improvement: We use data such as your usage habits and feedback to improve our services, fix problems, and develop new features (e.g., to optimize our AI-powered learning tools for your organization).
  Legal basis when Skillsail acts as controller: Art. 6 para. 1 lit. f GDPR, after the documented assessment described above, for the specific interests in diagnosing faults, understanding feature performance, and improving the security and usability of the Service. Customer Personal Data that Skillsail processes solely as a processor is used for improvement only on lawful documented instructions, as otherwise permitted by the DPA and applicable law, or after it has been rendered anonymous so that it is no longer personal data.
• Subscription administration and billing: We use the billing contact, provider identifiers and status, subscription, plan, credit, and entitlement data available to Skillsail to activate and manage plans, reconcile provider records and credits, support refunds and disputes handled through the provider, maintain required accounting and tax records, prevent fraud, and establish, exercise, or defend legal claims.
  Legal basis when Skillsail acts as controller: Art. 6 para. 1 lit. b GDPR where objectively necessary to perform a contract with an individual Customer; Art. 6 para. 1 lit. c GDPR for applicable accounting, tax, and other legal obligations; and Art. 6 para. 1 lit. f GDPR, after the documented assessment described above, for the specific interests in administering the B2B subscription and billing relationship with organizational Customers through their representatives, preventing fraud, handling disputes, and establishing, exercising, or defending legal claims. The exact role and legal basis of each payment or Merchant-of-Record provider are governed by the specific processing activity, its agreement, and its notice. Stripe's published DPA describes Stripe as a processor for instructed payment-platform processing and as a controller for specified Stripe purposes, including selection of financial providers, fraud and loss prevention, security, legal and regulatory compliance, internal relationship management and billing, analytics, and product improvement. Sold through Link acts as merchant of record for Managed Payments transactions and determines processing needed for its transaction, tax, fraud, dispute, support, legal, and order-management responsibilities.
• Service, lifecycle, and marketing communications: We use your contact details to send service-related communications, including account verification, password reset, important platform announcements, billing or plan information, and responses to support requests. We also use audience and lifecycle fields maintained with our disclosed email communications provider to operate onboarding and activation, plan or credit, inactivity and win-back, and similar customer-relationship workflows. We classify each active message as either a necessary service communication or optional direct marketing based on its content, recipient, and context. A technical subscribed or audience status maintained by a communications provider, account creation, Customer authorization, or permission from a parent or guardian is not marketing consent. We send optional advertising by electronic mail only where we can demonstrate either prior express consent or every condition of an applicable existing-customer exception: we obtained the address in connection with the sale of a good or service; the message promotes only our own similar goods or services; the recipient has not objected; and we gave a clear, simple, and free opportunity to object both when collecting the address and in every marketing message. Every optional marketing message includes a free unsubscribe mechanism, and a recipient may also object by contacting hello@skillsail.com. An unsubscribe, withdrawal, or objection stops future optional marketing. Necessary transactional and service communications may continue.
  Legal basis when Skillsail acts as controller: Art. 6 para. 1 lit. b GDPR only where the communication is necessary to perform a contract with the data subject; otherwise legitimate interests in proportionate B2B service administration, support, and customer-relationship communication under Art. 6 para. 1 lit. f GDPR, subject to the balancing and right to object described above; or separate valid consent under Art. 6 para. 1 lit. a GDPR where required. The lawfulness of sending electronic direct marketing is assessed separately under the applicable ePrivacy and national marketing rules, including Section 7 of the German Act Against Unfair Competition (UWG). An existing-customer exception is used only where every legal condition is satisfied. Where the organization is controller and Skillsail acts as processor, the organization determines and communicates the applicable legal basis.
• Security and performance: We process certain data (such as IP addresses, device information, and log data) to monitor suspicious activities, maintain the security and integrity of our platform, diagnose operational failures, and maintain reliable performance. This includes ordinary necessary infrastructure, authentication, firewall, provider, and application logs, as well as Sentry error monitoring, application structured logs and production client traces, together with production trace metadata from our AI authoring agent service. These diagnostic services are used for security, reliability, and fault diagnosis, not for advertising, cross-site marketing tracking, or individual learning or employee-performance scoring.
  Legal basis when Skillsail acts as controller: Art. 6 para. 1 lit. f GDPR, after the documented assessment described above, for the specific interests in preventing misuse, protecting accounts and systems, investigating incidents, and maintaining reliable service performance. Processor activities remain subject to the Customer's lawful documented instructions and the DPA.
• AI agent diagnostics and misuse review: We process the authoring-agent trace metadata described above to investigate failures, detect regressions, and evaluate and improve the performance and reliability of agent runs. Where incoming-text observation is enabled, we separately process bounded incoming text and related context to classify potential misuse and support human review. A classification does not itself block a request or suspend an account. We do not use these activities for advertising, cross-site marketing tracking, individual learning or employee-performance scoring, or to train or fine-tune shared, general-purpose AI models. The applicable providers are identified on our Subprocessors page.
  Legal basis when Skillsail acts as controller: Art. 6 para. 1 lit. f GDPR, after the documented assessment described above, for the specific interests in detecting misuse, investigating operational failures, and maintaining the security and reliability of the Service. Processor activities remain subject to the Customer's lawful documented instructions and the DPA.
• Audience and performance measurement: We use Vercel Web Analytics to understand aggregated page views and approved interactions and Speed Insights to measure real-user web performance across our website and platform. We do not use these services for advertising, cross-site marketing tracking, behavioral profiles, or individual learning or employee-performance scoring. Custom events must not include Customer Content or Personal Data.
  Legal basis when Skillsail acts as controller: Art. 6 para. 1 lit. f GDPR, after the documented assessment described above, for the specific interests in understanding aggregate service use, identifying performance problems, and maintaining an accessible, reliable service. Vercel Web Analytics and Speed Insights provide aggregate audience and performance measurements; they are not Sentry-style event diagnostics. Processor activities remain subject to the Customer's lawful documented instructions and the DPA.
• Fulfillment of legal obligations: We may process or retain personal data when we are legally required to do so – such as to maintain proper business records, fulfill tax requirements, or respond to lawful government requests.
  Legal basis: Legal obligation (Art. 6 para. 1 lit. c GDPR)

AI Processing

We use artificial intelligence (AI) technologies to assist in generating and improving eLearning content. When an authorized user invokes an AI feature, the prompts, instructions, selected course content or files, relevant metadata, and generated output needed for that request may be sent through the Vercel AI Gateway to a model or inference provider. The provider depends on the model chosen by the user or feature and the active routing and fallback configuration. Technical trace metadata may also be sent to the AI agent observability provider identified on our Subprocessors page. Full model-input and model-output capture is disabled in our authoring trace pipeline. This does not prevent the selected AI provider from receiving the inputs needed to carry out the request.

If an authorized user dictates a message in Skillsail web chat, the browser streams the microphone audio through the Vercel AI Gateway to the speech-to-text provider listed on our Subprocessors page, which returns the transcribed text. Skillsail does not store the audio. Once sent, the text is processed like any other prompt.

Skillsail does not itself use customer content to train or fine-tune shared, general-purpose AI models. A provider's handling, retention, and use of request data are governed by its actual role, the written business, API, and data-processing terms, and the configuration applicable to the selected route. A provider processing Customer Personal Data for a Skillsail-operated route is treated as a subprocessor or authorized further subprocessor where applicable. The current providers that may receive data are listed on our Subprocessors page. Users must submit only content they are authorized to disclose for the requested processing. Users must not submit health information, financial account details, government-issued identifiers, account credentials, authentication secrets, or other sensitive or highly regulated data through AI or MCP features.

Where incoming-text observation is enabled for an authenticated authoring session, we send incoming text, including answered free-text questions, to our AI observability provider for automated misuse classification and human review. Each observation is limited to 16,000 text characters and includes technical identifiers that connect it to the session, organization, acting User, and channel. Channel messages may include quoted or thread context from other people. The observation feature does not intentionally include attachment files or their metadata, full conversation history, system prompts, tool results, or assistant output. Text pasted into a message can still contain personal or sensitive information. Classification may use a further AI provider identified on our Subprocessors page. Direct MCP tool calls and public voice and avatar learning experiences are outside this observation feature. Classification supports human review; it does not itself block requests, suspend accounts, or create a User risk score.

Skillsail web chat may retain chat messages, session cursor and continuation state, event snapshots, approval records and tool inputs, and serialized stream events needed to provide and resume that feature. Direct MCP transport does not use a general product table to archive every raw JSON-RPC request and response. An MCP input may nevertheless become persistent Customer Data or an operational record when the User asks a tool to create or change a module, component, resource, media prompt, or other product record. Usage records may include provider, model, tool, token-count, timing, prompt-length or prompt-hash metadata, and error or reservation information without necessarily storing the raw prompt in that usage record.

The Customer must not authorize a Younger Authorized User to use an AI or MCP feature unless the selected processing route and provider configuration have been approved for under-18 use, including any required safety measure or Zero Data Retention arrangement, and the Customer's authorization, Guardian Permission, and every additional legal requirement remain satisfied. Use of a connected AI client is also subject to that client's own eligibility terms. The Customer is responsible for its intended audience, content choices, permissions, and instructions. Skillsail remains responsible for its own processing, provider arrangements, disclosures, and safeguards and may disable a route that does not satisfy those conditions.

AI output may be inaccurate, incomplete, or unsuitable. Younger Users should ask a parent, guardian, teacher, or organization administrator for help before relying on or publishing AI output and should report harmful or unsafe results to the organization or Skillsail.

Skillsail does not use the AI content-generation and MCP processing described in this Policy to make decisions based solely on automated processing that produce legal or similarly significant effects about a User. If that changes, we will update this notice and provide any safeguards required by applicable law before beginning that processing.

Voice and Avatar Learning Experiences

If a public voice or avatar learning experience is available and you choose to start it, we process the microphone audio you send, typed answers, transcripts, generated responses, selected curriculum and language, session identifiers, connection information, and temporary learning progress or feedback needed to provide the conversation. The browser asks for microphone access before capturing audio. That browser permission is separate from consent under data-protection law and does not authorize unrelated processing. Do not include sensitive information in these conversations.

Depending on the experience, real-time media and conversation data pass through the communications, hosting, AI gateway, and inference providers identified on our Subprocessors page. Avatar mode also sends the generated spoken audio to an avatar-animation provider to produce the avatar's video. The current avatar flow does not request your camera or use your face to create an avatar. Voice-only mode does not create an avatar-provider session. A public experience does not require an Organization Account, and the application does not save its transcript or progress as a learner database or LMS record. Connection, security, error, usage, and provider records may still be retained.

Recording is disabled in our current communications-worker session configuration. This does not disable recording or retention at every other provider. In particular, an avatar provider may retain session recordings, reports, transcripts, or related records under its applicable agreement and configuration. Ending the session, closing the browser, or expiry of a connection token does not establish that those provider copies have been deleted. Provider retention and deletion controls remain subject to the Data Retention and Deletion section below; we do not represent public voice and avatar learning experiences as a zero-data-retention service.

For the processing of public voice and avatar learning experiences for which Skillsail acts as controller, the legal basis is Art. 6 para. 1 lit. f GDPR, subject to the documented assessment described above, for the specific interests in providing the interactive learning experience you request, securing the connection, and preventing abuse. These experiences do not provide formal certification or make an automated decision with legal or similarly significant effects about you.

Connected AI Clients and MCP Integrations

Skillsail provides a Model Context Protocol (MCP) endpoint that an authorized user can connect to a compatible AI client, including ChatGPT. At the user's direction, that client sends prompts, tool arguments, and relevant request context to Skillsail. Skillsail returns the result requested by the user, which may include course or module structure and content, operation status, resource metadata, generated media metadata, or short-lived upload, download, media, or export links.

The connected client and its operator process the prompts and tool results on their side under their own terms and privacy notice and may act as an independently selected service provider or controller for that connected-client relationship. If Skillsail engages the same company to process Customer Personal Data in a separate Skillsail-operated route, that separate processing is classified by its actual role, including as a subprocessor or authorized further subprocessor where applicable. OpenAI may therefore provide ChatGPT in a User- or Customer-selected relationship and separately process data for a Skillsail-operated AI feature.

A connected client may be used only when its age, account, and permission requirements are met. Authorization to use Skillsail does not override the connected client's terms. The Customer retains the eligibility, Customer-authorization, Guardian Permission, and additional legally required authorization responsibilities assigned to it under the Skillsail Terms.

OAuth access tokens authenticate MCP calls. Skillsail does not include access tokens, refresh tokens, client secrets, or other OAuth credentials in MCP tool results. A connected client may retain prompts and tool results according to its own settings and policies. Users can stop future access by disconnecting the integration or revoking its authorization.

Microsoft Teams

Skillsail's Microsoft Teams bot uses Microsoft Bot Framework, Microsoft's web services for connecting bots to conversation channels you authorize. Microsoft transmits content you send to the bot to provide this service. See the Microsoft Privacy Statement for information about Microsoft's privacy practices.

Your interactions are also subject to the applicable Microsoft Teams terms of use and privacy and data-collection policies. For bot-abuse reports to Microsoft, follow the reporting instructions in Microsoft's Bot Framework Code of Conduct. For Skillsail support or to report harmful content, use our support page.

Google User Data

When you choose to sign up or log in using Google authentication, we access and collect specific information from your Google account. This section details our practices regarding Google user data.

What Skillsail receives through WorkOS AuthKit after Google sign-in:

• Your WorkOS user identifier
• Your Google account email address
• Your first and last name, where available
• Your Google profile picture URL, where available
• Your locale, where available through WorkOS AuthKit

Skillsail delegates Google login to WorkOS AuthKit. Skillsail's application code does not request Google Drive, Gmail, Calendar, contacts, or their content through this sign-in flow. The exact identity scopes enabled for Google login are controlled in the WorkOS configuration and must be configured consistently with this notice.

How we use Google data:

• To create and manage your Skillsail account
• To authenticate you when you log in to our platform
• To display your name and profile picture in your account
• To communicate with you about your account and our services

Important: We use Google identity data for the account, authentication, authorization, profile-display, communication, and security purposes described above. We do not use it for purposes unrelated to those account and Service functions.

We do NOT sell Google user data: We never sell, rent, or trade your Google account information, and we do not disclose it to third parties for their marketing or advertising purposes.

Data Sharing and Disclosure

We take your privacy seriously and limit sharing of your personal data to the following circumstances:

With whom we share data:

• Service and downstream providers: We share data with third parties needed to operate the platform and fulfill requested features. A recipient's role depends on the actual processing route. A provider that Skillsail engages, directly or through another provider, to process Customer Personal Data on a Customer's behalf is treated as a subprocessor or further subprocessor for that route and is subject to the applicable authorization and contractual requirements. A service independently selected and connected by a User or Customer may instead process its copy under that separate relationship. Payment, Merchant-of-Record, and scheduling providers may act as processors, controllers, or independent providers according to the specific function and governing terms. These recipients support functions including hosting, object storage, authentication, AI content and media generation, translation, billing, email, customer relationship management, monitoring, and support. We share only the data needed for the applicable service. Connected-service infrastructure also handles authorization, credential storage, and webhook forwarding. A current list of disclosed recipients can be found on our Subprocessors page.
• User-directed sharing and publishing: When an authorized user makes a module public or shares a module, template, resource, or export link, the selected content and associated media may be accessible to the intended recipients or, depending on the chosen setting, anyone with the link. Temporary media and download links act as bearer links: anyone who receives one can use it until it expires. Media preview links normally expire after one hour, and resource and export download links normally expire after two hours. A link already issued may remain usable until that expiry even if the module's sharing setting is changed in the meantime.
• Review comments on a shared module: Where comments are enabled on a shared module, every reviewer display name and every comment in that module's review conversation can be read by anyone who is able to open the link under the applicable sharing settings, including the passphrase where one is set. Review comments are not restricted to the module's author. Once a signed-in member of the organization comments, the first and last name from that member's Skillsail profile is published to everyone holding that link. The module's author continues to see the full review history after the link is made private again or comments are switched off. We do not send reviewer display names or comment text to analytics or marketing providers. They are shared with a connected AI service when the module's author uses that service's review tools to read or answer feedback, as described under user-selected connected services below. They may also be included in incoming-text observation if an author includes them in an authoring message and that observation feature is enabled. We do not otherwise send them to an AI provider on our own initiative. Errors raised by the review feature reach our error-monitoring provider as technical diagnostics tagged with a feature area only, without comment text or reviewer names. Session Replay is not enabled in the current browser configuration, including for visitors who open a shared link without signing in.
• User-selected connected services: When a user authorizes an MCP or other integration, we exchange the prompts, tool arguments, and results needed to fulfill that user's requests with the selected service. That service processes its copy under its own terms and privacy policy, as described in the Connected AI Clients and MCP Integrations section above.
• Within your organization: If you use Skillsail through an organizational account, your data may be accessible to your organization's administrators as per your organization's policies. Organization administrators are responsible for managing the Organization Account and may instruct deletion of the organization and the user data associated with that organization.
• Legal requirements: We may disclose your data if required by law, court order, or governmental authority, or to protect our rights, property, or safety.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity subject to applicable law, contractual obligations, and any notice or choice that applicable law requires.

Third-party transfers: We transfer data to third parties only when necessary to provide our services, comply with law, carry out a User's authorized sharing, publishing, or connected service request, or complete a disclosed business transfer. Depending on the service and processing route, a recipient may act as a Skillsail processor, a subprocessor or further subprocessor for Customer Personal Data, an independent payment or scheduling provider, or a service selected by the User or Customer. We do not sell personal data or disclose it for unrelated cross-platform advertising.

Service Providers, AI Providers, and Connected Services

We work with service providers, AI and inference providers, independent providers, and User-selected connected services. A label such as "downstream" does not determine the provider's legal role. When Skillsail engages a provider, directly or through another provider, to process Customer Personal Data on a Customer's behalf, that provider is treated as a subprocessor or further subprocessor for that route. A service independently selected and connected by a User or Customer may process data under its separate terms and privacy notice. The same company may have different roles in different routes.

The current disclosed recipients, including their purpose, provider details, and address, are available on our Subprocessors page. We notify affected customers of material subprocessor changes when required by the applicable data processing agreement.

International Data Transfers

Some of our providers are located outside the European Economic Area (EEA) or the United Kingdom. The Customer-Skillsail DPA addresses only qualifying transfers within its stated scope. For a transfer from Skillsail to a provider for which Skillsail is responsible, Skillsail uses the provider-specific mechanism and safeguards required for that transfer, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission (e.g., EU-US Data Privacy Framework where applicable)
• Additional technical and organizational measures to ensure data protection

The applicable recipient, location, role, and transfer mechanism depend on the verified provider route. A User-directed transfer to an independently selected service is governed by the parties' actual roles and applicable law; this page does not represent that such a transfer is automatically outside Skillsail's responsibilities.

You can request more information about the specific safeguards we use for international data transfers by contacting us at hello@skillsail.com.

Data Retention and Deletion

We retain your personal data only for as long as necessary to provide our services and fulfill the purposes described in this privacy policy.

The periods and criteria below apply to copies controlled by Skillsail. Copies controlled by a Customer or an independently selected connected service are subject to that party's retention rules. Where a provider processes personal data on Skillsail's behalf, provider-specific retention and deletion controls apply in addition to the periods below. We do not describe a route as zero data retention unless that setting has been verified for the exact provider account, project, model route, and gateway configuration.

Retention periods:

• Account and workspace content: We retain account, organization, and Customer Data while the relevant account or workspace remains active and until an authorized deletion or termination process applies, subject to the specific temporary, legal, backup, provider, and deletion-queue rules below. Skillsail does not currently apply an automated inactivity-only deletion period.
• Audience and lifecycle communication records: We retain the contact, audience, lifecycle-segmentation, delivery, preference, unsubscribe, suppression, and communication records needed for the active customer relationship and the permitted communication purposes described above. Optional direct marketing stops when consent is withdrawn, the recipient objects to direct marketing, or the recipient unsubscribes; necessary transactional messages may continue. Routine Skillsail updates preserve an existing unsubscribe while the provider contact remains. Account deletion deletes the active contact from our email communications provider. Historical email-preference and one-way opt-out records may also be held in Skillsail while linked to an existing User; account deletion removes those account-linked records. Skillsail does not currently retain an independent post-deletion marketing suppression record. If that person later signs up again and the provider creates a new contact with a technical subscribed status, that status does not restore withdrawn consent, cancel an objection, or authorize optional marketing. Optional marketing may resume only if its legal eligibility is independently established. Exact provider retention and deletion settings must match our documented provider configuration.
• Review comments and reviewer records: A reviewer can delete their own comment for as long as that module's review comment cookie remains valid. The deletion takes effect immediately for readers, and the stored comment text is blanked by a daily cleanup process 30 days later. A placeholder for the deleted comment stays in the thread so that replies remain readable, and the name attributed to that comment is retained. Making a module private again, switching comments off, or changing the passphrase does not delete review data. Deleting the module, or deleting the Organization Account, removes the review threads, comments, and reviewer records that belong to it. When an individual user account is deleted, we anonymize that person's reviewer identity by replacing the stored name with "Former member" and clearing the link to the account; the text of comments written by that person is retained as content, because those comments sit inside review threads created and continued by other people, so anonymization does not guarantee that no name remains anywhere in a review conversation. A reviewer record created by a visitor who is not signed in is deleted automatically once its 30-day access window has passed without the visitor ever posting a comment; a record with comments is retained with them, and the only self-service removal available to such a visitor is deleting their own comments as described above. A request sent to hello@skillsail.com is handled against the reviewer record.
• Legal obligations: Some data may be retained longer if required by law (e.g., financial records for tax purposes).
• Billing and payment records: We may retain billing, subscription, plan, credit, entitlement, and provider-identifier or status records available to Skillsail where required or permitted for Subscription administration, legal obligations, accounting, fraud prevention, dispute handling, or the establishment, exercise, or defense of legal claims. The applicable Stripe entities and Sold through Link retain the payment-instrument, hosted checkout, invoice, receipt, order, refund, dispute, support, and tax records they control under their own retention rules and legal obligations. A deletion request made through Link for Managed Payments data may also cancel affected Subscriptions and delete associated Stripe objects; we reconcile provider notices and status changes with the Skillsail-controlled records described above.
• Credit-ledger records after deletion: When an Organization or User deletion applies to a credit-ledger record, the record is marked for scheduled deletion after the applicable retention period, normally 180 days from the deletion date under the current default configuration. The daily cleanup process removes records once that period has expired; actual deletion is asynchronous. This limited post-deletion period supports allowance reconciliation, accounting integrity, fraud and dispute review, and the establishment, exercise, or defense of legal claims, subject to any longer period required by law.
• Temporary exports: Export download links normally expire after two hours. The corresponding export package is queued for deletion after the link expires; scheduled cleanup may occur later than the link expiry.
• Temporary direct uploads: A signed direct-upload link normally expires after ten minutes. Uploaded bytes first land in private staging storage and are promoted to a separate sealed key only after server-side validation. Rejected uploads are deleted, and abandoned staging uploads older than 24 hours are eligible for scheduled cleanup. Unverified uploads from the previous upload flow that remain attached to a chat are eligible for scheduled cleanup after 30 days. Actual deletion is asynchronous and may occur later.
• AI and MCP request data: Prompts, tool arguments, selected files or content, generated results, and operation metadata are retained where they become Customer Data or are needed to provide the requested feature, maintain security, diagnose an error, evaluate or improve AI agent reliability and quality as described above, or handle support. The applicable account/content, log, deletion, and legal-retention criteria in this section apply. Transient direct MCP transport data does not receive a separate retention period merely because it passed through the MCP endpoint; any retained copy falls into one of the disclosed content, usage, approval, provider, support, or log categories. Gateway and model-provider copies follow the verified contract and configuration for the selected route.
• Application, authentication, security, and error logs: Vercel Function runtime logs for the current Pro project are available for one day under the current provider plan. Other necessary authentication, firewall, storage, database, AI-provider, and security records follow the documented schedule for the system that creates them. They are retained only for the period justified to operate and secure the Service, investigate incidents, prevent abuse, diagnose faults, or meet applicable legal obligations, then deleted or rendered anonymous under that schedule. Sentry errors, structured logs and client traces follow the retention configured for our Sentry project and account. AI agent observability traces and evaluation records follow the retention configured for the applicable provider project and account. The applicable periods are determined by the current provider-account controls, data type, product, and plan. We review and update the documented retention criteria after a material configuration or plan change; this Policy does not claim a fixed provider period.
• Audience and performance measurement: Vercel Web Analytics page views and approved custom events, and Speed Insights real-user performance measurements, follow the retention configured for our Vercel project, account, product, and plan. Because those settings and plan terms may change, we review and update the documented retention criteria after a material configuration or plan change rather than state a fixed period here.
• Support, guardian, authority-verification, and rights-request correspondence: We retain these records while the matter is open and afterward for the period reasonably necessary to document the response, meet legal obligations, resolve disputes, and establish, exercise, or defend legal claims.
• Backups and deletion queues: Deletion from active systems may not immediately remove data from encrypted backups, provider recovery copies, or asynchronous deletion queues. Such copies are isolated from ordinary use and are overwritten or deleted under the applicable recovery or cleanup schedule unless law requires or permits longer retention.

Organization deletion: Organization admins can delete an Organization Account from the Skillsail settings page once all paid Subscriptions have ended. When an Organization Account is deleted, we initiate asynchronous removal of the organization workspace and associated active platform data, including training content, uploaded files, generated media, usage records, organization settings, and user records associated with that organization, and cleanup of associated billing customer profiles. Backup, provider, legal-retention, and processor-data exceptions remain subject to the criteria above, the DPA, and applicable law.

If a user belongs only to the deleted organization, their Skillsail user identity may also be deleted. If a user belongs to another Skillsail organization, we retain the identity and data needed for that other organization and remove only the deleted organization's data and membership.

Individual deletion requests: You can request deletion of your account and associated data at any time by:

• Contacting us at hello@skillsail.com
• Providing your account email and verification of identity
• We will respond without undue delay and within the period required by applicable law. Where legally permitted due to complexity or request volume, that period may be extended after notice. If Skillsail acts as processor, we may refer the request to the relevant Customer or act on its documented instructions.

Upon account deletion, we will remove your personal data from our active systems, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, resolving disputes).

A parent, legal guardian, or legally authorized representative may contact us to notify us that Guardian Permission or another authorization has been withdrawn or to make a data-rights request when that person is legally entitled to do so. The Customer may separately contact us to withdraw its own authorization or request an access restriction. We may verify the requester's identity and authority. A guardian's ability to act for a User depends on applicable law and reasonably verified authority; Guardian Permission does not automatically transfer the User's data-protection rights to the guardian. Where the organization is controller, we may refer the request to it or act on its documented instructions. Once Guardian Permission, another required authorization, or the Customer's authorization ends, the Customer must revoke the affected User's access, and Skillsail may restrict access following reasonably verified notice. Withdrawal does not automatically erase data already processed; that data remains subject to applicable retention, deletion, legal-obligation, and controller-processor rules.

Younger User content-removal requests: A younger User or a person legally authorized to act for that User may ask us to remove content the User posted or made public through Skillsail. After reasonably verifying the request and the content concerned, we will remove or restrict the content where required by applicable law and where we control the relevant copy. Removal does not guarantee erasure of copies already shared with, saved by, or independently published by other people or services, and limited records may remain where retention is required or permitted by law. Where the Customer is the controller, we may coordinate the request with that Customer.

Data Protection and Security

We implement reasonable and appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction.

Security measures include:

• Encryption: Customer-facing transmissions are protected using HTTPS/TLS, and provider-to-provider transmissions use the safeguards applicable to those services.
• Access controls: We limit access to personal data by our employees and contractors to people who need it to perform their duties and are bound by confidentiality obligations. Access by providers is limited to the applicable service and governed by the role and safeguards described in the provider sections above.
• Secure infrastructure: Our platform is hosted on secure, professionally maintained servers with regular security updates and monitoring.
• Authentication security: Our authentication provider uses secure authentication mechanisms, including OAuth 2.0 for Google sign-in, to securely manage user access.
• Security review: We conduct security reviews, monitoring, and maintenance appropriate to the Service. No independent third-party audit report is incorporated into the DPA unless expressly stated there.
• Data minimization: We only collect and process the data reasonably necessary for the disclosed purposes and design our systems to limit unnecessary collection and disclosure.

Cookies, Browser Storage, and Tracking

We use cookies and similar browser technologies, including local storage, session storage, and IndexedDB, on our website and platform for security, usability, and requested feature handoffs. Cookies are small text files stored on your device. The other browser-storage mechanisms can retain preferences or, where you choose the pre-signup creation flow, the prompt and attachment needed to continue that flow after authentication.

Types of cookies and browser storage we use:

• Language and user preferences: When you change your preferred language on our website, we set a cookie to remember your choice. The platform also uses a cookie for the sidebar preference and local storage for interface preferences such as the theme and preview-panel layout.
• Pre-signup prompt and attachment storage: If you start creating from the public landing page before signing in, we store the pending prompt in both session storage and local storage so it can survive the authentication redirect. If you select a file, we store its name, type, bytes, and save time in IndexedDB on your device for the same handoff. The file is not uploaded to Skillsail until after authentication. These records are usable for no more than one hour. While Skillsail remains open, we schedule physical removal at that boundary. We also remove them when the handoff is read and check for stale records whenever Skillsail next opens. Browser suspension, closure, timer throttling, or a browser-storage error can delay physical removal until a later successful cleanup opportunity or until you clear the site's browser data.
• Review comment cookies: If you comment on a module that has been shared for review, we set one signed cookie for that module, named with the prefix __Host-rv_ followed by the module identifier, so that the review conversation can recognize you as the author of your own comments and allow you to delete them. The cookie is HMAC-signed and set as httpOnly, Secure, SameSite=Lax, with the path "/" and a lifetime of 30 days. Its contents are opaque identifiers and timestamps only: a reviewer identifier, the module identifier, a marker of the cookie's purpose, and the times at which it was issued and expires. It contains neither your display name nor any comment text. This cookie is necessary for the commenting function you use and is not a measurement or advertising technology. All review comment cookies are deleted when you sign out.
• Appointment booking cookies: On our appointment booking forms, we use Cal.com as our booking service provider. Cal.com may set cookies to manage your booking session and ensure the booking process works properly.
• Authentication cookies: We use WorkOS as our authentication provider for secure login to the Skillsail platform. WorkOS may set cookies to maintain your login session and ensure secure authentication across the platform.
• Audience and performance measurement: Vercel Web Analytics and Speed Insights load across our website and platform. Web Analytics measures page views and approved custom events without third-party cookies, while Speed Insights measures real-user web performance metrics. Custom-event payloads must not contain Customer Content or Personal Data. We do not use either service for advertising or cross-site marketing tracking.
• Error monitoring and diagnostics: The Sentry client reports errors across the website and application. Production application pages also enable client traces and structured logs; marketing pages do not enable client tracing or client structured logs. Production application client traces are currently sampled at 100%. Browser console breadcrumbs are excluded, and module-media bearer tokens are removed from the relevant request breadcrumbs and spans. Session Replay is not enabled in the current browser configuration. Error and trace events may contain the diagnostic data categories listed in the Usage data section above. Sentry is not used for advertising or cross-site marketing tracking.

Important notes about cookie and browser-storage usage:

• No marketing purposes: We do not use the preference or pre-signup browser-storage entries, Vercel Web Analytics, Speed Insights, or Sentry described above for marketing or advertising. They support security, usability, aggregate audience and performance measurement, fault diagnosis, and the feature handoff you request, without cross-site marketing tracking.
• Function-specific storage: Authentication, security, language or preference, review comment, and requested handoff storage are used where necessary for those functions. Vercel Web Analytics, Speed Insights, and Sentry are separate measurement and diagnostic technologies and are not all classified as strictly necessary cookies. Their GDPR legal basis and any separate consent requirement under applicable ePrivacy law are assessed for each technology and configuration.
• Third-party services: WorkOS and Cal.com may set cookies for the authentication and booking functions described above. Vercel and Sentry provide the measurement and diagnostic technologies described above; this statement does not claim that those services set advertising cookies. Their processing is governed by the applicable service relationship, terms, and privacy information for the stated purposes. Cloudflare provides object storage and file delivery; this notice does not claim that our ordinary Cloudflare storage or delivery route sets a browser cookie.

Your Rights Under GDPR

Where the GDPR applies, and subject to the conditions and exceptions in the GDPR, you have rights regarding your personal data. You can exercise these rights by contacting us at hello@skillsail.com.

Your data subject rights include:

• Right to access (Art. 15 GDPR): You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and to access such data.
• Right to rectification (Art. 16 GDPR): You have the right to obtain the rectification of inaccurate personal data and to have incomplete personal data completed.
• Right to erasure (Art. 17 GDPR): You have the right to obtain the erasure of your personal data under certain circumstances.
• Right to restriction of processing (Art. 18 GDPR): You have the right to obtain restriction of processing under certain circumstances.
• Right to data portability (Art. 20 GDPR): You have the right, where the statutory conditions are met, to receive personal data you provided in a structured, commonly used, and machine-readable format and to transmit it to another controller.
• Right to object (Art. 21 GDPR): You have the right to object to processing of your personal data based on legitimate interests. If you object to processing for direct marketing, we stop processing your personal data for that purpose; this is not subject to a legitimate-interest balancing test.
• Right to withdraw consent (Art. 7 GDPR): Where processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR.

The competent supervisory authority for Skillsail GmbH is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach
Germany

Website: www.lda.bayern.de

Contact

If you have questions, concerns, or issues regarding this privacy policy or our privacy practices, please do not hesitate to contact us:

Email: hello@skillsail.com

Postal address:
Skillsail GmbH
Elektrastraße 11
81925 Munich, Germany

We are happy to help and will strive to answer your concerns or questions about privacy as quickly as possible.