Privacy Policy

Last updated: October 16, 2026 | Effective Date: October 16, 2026

Data Controller Information

Company: Skillsolutions for Management Consultancy
Email: info@skillsolutions.io

For personal data about a customer's employees in the SkillHQ platform, the customer (the employer) is the data controller and Skillsolutions processes that data on its behalf under our agreement. For our website, sales enquiries and our own business contacts, Skillsolutions is the data controller.

1. Information We Collect

Personal Information

We collect information you provide directly to us, such as:

  • Name and contact information
  • Job title and department
  • Organization details
  • Account credentials
  • Profile information and preferences
  • Employee ID (when provided by your organization)
  • Manager and team information

Learning Platform Integration Data

When your organization integrates third-party learning platforms:

  • xAPI statements from Udemy, Coursera, LinkedIn Learning
  • Course enrollment and completion data
  • External certifications and badges
  • Learning activity timestamps and duration

Usage Information

We automatically collect certain information about your use of our platform:

  • Learning progress and completion data
  • Test results and scores, and the answers you give inside courses and tests
  • Platform usage patterns and preferences
  • Device and browser information
  • IP address of the device you sign in from (kept in your sign-in history)
  • Electronic acknowledgements you give on training records and plans (your typed name, the date, time and device)

2. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

  • Contract Performance: To provide learning platform services to your organization
  • Legitimate Interests: For platform security, fraud prevention, and service improvement
  • Legal Obligations: To comply with applicable laws and regulations
  • Consent: For optional features like marketing communications (you can withdraw consent anytime)
  • Vital Interests: In rare cases involving health and safety

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our learning platform
  • Personalize your learning experience and content recommendations
  • Track progress and generate performance reports
  • Communicate with you about your account and platform updates
  • Provide customer support and respond to inquiries
  • Analyze usage patterns to improve our services
  • Ensure platform security and prevent fraud
  • Comply with legal obligations

4. Information Sharing and Sub-Processors

We do not sell, trade, or otherwise transfer your personal information to third parties except in the following circumstances:

With Your Organization

Your organization's administrators (the owner and admins) can see your learning progress, test results and scores, the answers you gave inside courses and tests, your training records and certificates, and the device and IP address of your sign-ins, for training and development purposes. Managers see this only for the people in their reporting line. Private 1:1, mentoring and coaching content is seen only by the people taking part.

Skillsolutions support

To investigate a problem you or your organization reports, our support staff may open your account in a read-only view and see what you see. Each view requires a stated reason and two-step sign-in, lasts at most 30 minutes, cannot change, send, download or export anything, does not show private 1:1, mentoring or coaching content, and is logged. Your organization can ask us for the log.

Service Providers

We use carefully selected sub-processors to help deliver our services:

  • Supabase (Database hosting and authentication) - India (AWS Mumbai region)
  • Vercel (Application hosting — our application servers run in India, Mumbai region) - India
  • Cloudflare (Turnstile bot check on sign-in and public forms only — our sites are not routed through Cloudflare) - Global network, company in the United States
  • Resend (Transactional email services — sent from the European Union, Ireland) - European Union
  • Sentry (Error monitoring and performance tracking) - United States
  • Google Gemini (AI model — see section 7) - United States
  • Anthropic Claude (AI model — see section 7) - United States
  • PostHog (product usage analytics, only with your consent) - European Union (Frankfurt)

All sub-processors are bound by data processing agreements and appropriate safeguards.

Legal Requirements

We may disclose information if required by law or to protect our rights, property, or safety, or that of our users or the public.

5. Multi-Tenant Data Isolation

As an enterprise B2B platform, we implement strict data isolation:

  • Complete tenant data separation using organization UUIDs
  • Every request is checked by our application against the user's organization and role before any data is returned
  • AES-256-GCM encryption for sensitive credentials (API keys, integration secrets)
  • Isolated subdomain access (e.g., yourcompany.skillhq.io)
  • No cross-tenant data access or sharing

6. Technical Security Controls

We implement technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

Encryption and Data Protection

  • AES-256-GCM encryption for sensitive credentials (API keys, integration secrets) using PBKDF2/scrypt key derivation
  • TLS encryption for all data in transit (provided by Vercel)
  • Database encryption at rest provided by Supabase (PostgreSQL transparent data encryption)
  • Encryption keys stored in environment variables with mandatory configuration enforcement

Access Controls and Authentication

  • Multi-factor authentication (MFA) available via email one-time passwords
  • Role-based access control (RBAC) with four roles: Owner, Admin, Manager, Learner
  • JWT-based session management with configurable expiration
  • Organization-scoped access enforcement via middleware
  • Password hashing using bcrypt with appropriate cost factors

Infrastructure Security

  • Bot protection on sign-in and public forms (Cloudflare Turnstile) and platform-level DDoS mitigation by Vercel
  • Rate limiting on API endpoints to prevent abuse
  • Vercel serverless deployment with automatic security patching
  • Security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
  • Automated dependency vulnerability scanning via npm audit

Multi-Tenant Security Architecture

  • Complete tenant data separation using UUID-based organization isolation
  • Organization-scoped access checks on every request, enforced by our application, to prevent cross-tenant access
  • Subdomain-based tenant isolation with middleware enforcement
  • Organization-scoped API queries validated on every request

Monitoring and Incident Response

  • Sentry error monitoring and performance tracking for application issues
  • Vercel deployment logs and analytics for infrastructure monitoring
  • Supabase database monitoring and automated backups
  • Incident response procedures for data breach notification (see Section 10)

7. AI and Machine Learning Privacy Protections

Our platform uses artificial intelligence to generate assessment quizzes, map courses to skills, recommend content, summarize reports, and prepare briefs for managers and mentors. We are transparent about how AI is used and what data is involved.

How We Use AI

  • AI-powered quiz generation based on course titles, descriptions, and curriculum data
  • Learning content recommendations based on enrollment history and progress
  • Analytics insights derived from aggregated learning activity data
  • Preparation briefs and coaching prompts for a manager or mentor about a person they support

What Data Is Sent to AI Providers

  • Course titles, descriptions, and curriculum structure (for quiz generation)
  • For manager 1:1 preparation, coaching prompts and mentoring briefs, the person's name, department, job title and learning activity are sent to the AI provider. Email addresses, employee IDs and passwords are never sent.
  • AI requests are made over HTTPS encrypted connections
  • Google and Anthropic each have their own privacy terms governing data handling

AI Providers and Data Protection

  • Anthropic Claude and Google Gemini — we use both. Each AI feature has a main model from one company and a backup from the other, so the feature keeps working if one is unavailable
  • Narration, smart search and live voice practice use Google only
  • We do not use AI providers that train on customer input data

Your Rights Regarding AI

  • AI-generated quizzes are reviewed and editable by administrators before assignment
  • Learning recommendations are suggestions only and do not restrict access to content
  • You may contact us to inquire about how AI features affect your learning experience

8. Data Retention

We retain data according to the following schedule:

  • Personal Identifiable Information: Your organization decides. If your organization deletes your account, your personal details (name, email, photo and other identifying information) are removed straight away. If your account is switched off (for example when you leave), your personal details are removed automatically at the end of the retention period your organization sets: 2 years (the default), 3 years or 5 years after the switch-off, or never. The period is never shorter than 2 years, and your organization's administrators are reminded three times before it ends. Your learning records are kept without your name, as described below.
  • Employee Training Records: Kept for as long as your organization uses SkillHQ, because they are your organization's training history. Once your personal details are removed, the records continue without your name (shown as "Former employee"), so your organization's history and statistics stay complete.
  • Certificates: Certificates keep your name, because they are your own proof of achievement. Each one has a verification page that shows your name, the course and the date to anyone who has its link, and that page keeps working even after your organization stops using SkillHQ. If you want your name removed from a certificate, ask your organization's administrators; the certificate itself stays on record.
  • Answers inside courses and tests: The answers you give are kept with your training record for as long as your organization's account exists. If your personal details are removed, your answers stay without your name.
  • Audit Logs: Sign-in and activity logs are kept for security and compliance; the IP address and device details in them are removed after 90 days. Expired security data (one-time codes, reset links and similar) is deleted after 30 days.
  • Aggregated Analytics: Indefinitely in anonymized form

Important for Employees: Training data belongs to your organization. You cannot delete your own account or training records: your organization can delete your account, and training records are kept for compliance and organizational reporting. To ask your organization to correct or delete your data, use My account › Your data › Ask my company.

9. Your Rights

GDPR Rights (European Economic Area)

  • Access: Request a copy of your personal information
  • Rectification: Request correction of inaccurate information
  • Erasure: Ask your organization to delete your personal data (training records are kept as described in section 8)
  • Portability: Receive your data in a machine-readable format
  • Restriction: Request limitation of processing
  • Objection: Object to processing based on legitimate interests
  • Withdraw Consent: Withdraw consent where processing is consent-based
  • Automated Decision-Making: Right not to be subject to automated decisions
  • Lodge a Complaint: File a complaint with your supervisory authority

If you are in the Gulf, you may have similar rights under your country's data protection law — for example the Personal Data Protection Laws of the Kingdom of Bahrain, the Kingdom of Saudi Arabia, the United Arab Emirates and the Sultanate of Oman. The exact rights and response times depend on that law. Your organization, as the controller of your data, is your first point of contact, and we help it respond.

Your organization controls your account, and we help it answer your requests. You can download your data yourself at My account › Your data (Download my data). To correct, restrict or delete your data, ask your organization's administrators: use My account › Your data › Ask my company, or contact them directly. You cannot delete your own account. You can also email dpo@skillsolutions.io and we will pass your request to your organization and help it respond within 30 days, or sooner where your local law requires.

10. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms:

  • We will tell your organization's administrators without undue delay, and in any case within 72 hours of becoming aware of the breach, so your organization can notify its data protection authority where its law requires
  • We will notify affected individuals without undue delay if the breach poses high risk
  • Where we are the controller ourselves (for example for website visitors and sales contacts), we will notify the Personal Data Protection Authority of the Kingdom of Bahrain, and any other authority the law requires, within the time the law sets
  • We maintain incident response procedures and breach documentation

11. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience on our platform. These technologies help us:

  • Remember your preferences and settings
  • Analyze platform usage and performance
  • Provide personalized content and recommendations
  • Ensure platform security and functionality

You can control cookie settings through your browser preferences, though disabling certain cookies may affect platform functionality.

12. International Data Transfers

SkillHQ is hosted outside most customers' countries: our database and application servers are in India (Mumbai region, Amazon Web Services and Vercel), our transactional email is sent from the European Union (Ireland), and our error monitoring and AI providers are in the United States (see section 4). Your organization accepts these locations when it subscribes, and is responsible for telling you about them and for obtaining any consent the law of your country requires. We protect transferred data through our contracts with each provider and the safeguards in our Data Processing Agreement.

For users in the European Economic Area (EEA), UK, and Switzerland:

  • Our sub-processors (Supabase, Vercel) maintain Standard Contractual Clauses (SCCs) in their terms of service
  • We implement supplementary technical measures for data protection
  • Data Processing Agreements are available for enterprise clients upon request

13. Children's Privacy

SkillHQ is a workplace platform for adults employed or engaged by our customers. It is not intended for children, and we do not knowingly collect children's personal data. If you believe a child's data has been added, contact us and we will work with the organization to remove it.

14. Data Processing Agreements

For enterprise clients, we offer:

  • Standard Data Processing Agreements (DPA) compliant with GDPR Article 28
  • Custom DPAs for specific regulatory requirements
  • Security addendums and audit rights

Contact info@skillsolutions.io to request a DPA.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: info@skillsolutions.io