Privacy Policy

• Account data — name, email address, password (stored hashed by Supabase Auth), and your role on the platform (learner and/or educator).
• Profile data — information you add to your profile, such as a photo, bio, or professional background (for educators).
• Learning activity — courses you enroll in, lesson progress, certificates you earn, reviews you write, and posts in course communities and live sessions.
• Transaction data — order history, amounts, currency, and refund status. Payments are processed by Stripe; we receive confirmation and receipt metadata but never your full card number.
• Educator payout data — if you sell courses, the identity and banking information Stripe Connect requires for payouts is collected and held by Stripe under its own privacy terms; we see payout status and account state.
• Usage data — product analytics collected through PostHog: pages viewed, features used, device and browser type, and approximate location derived from IP.
• Cookies — described in Section 4 and controlled through the cookie banner.
• Communications — messages you send to support and notification preferences.

Under the GDPR (EU/EEA/UK) and the LGPD (Brazil), each use of personal data needs a legal basis. Ours are:

• Performing our contract with you — creating and securing your account, delivering courses you enroll in, issuing certificates, routing purchases and refunds to the educator's Stripe account, and recording educator earnings.
• Legitimate interests — keeping the platform safe, preventing fraud and abuse, improving features based on aggregate usage, and sending service messages about your account and purchases.
• Consent — optional analytics cookies and marketing emails. You can withdraw consent at any time (cookie banner, unsubscribe link, or account settings) without affecting your use of the platform.
• Legal obligations — tax, accounting, and lawful requests from authorities.

When you enroll in a course, the educator who runs it can see your name, email, enrollment date, and progress in their course — this is how they support their students. Under our public creator commitments ("The Promise"), each educator's student list belongs to that educator. Educators must handle student data lawfully and may not sell it; their obligations are set out in the Teacher Terms. When you buy a course, the educator is the merchant of record and the payment is charged on their own Stripe account, so the transaction — your name, email, the amount, currency, country, and the card brand and last four digits — appears in that educator's Stripe dashboard, where the educator is the controller of that record and Stripe's terms and the educator's own privacy notice apply. SkillsetMind never discloses your full card number to an educator, and educators do not see your activity in other educators' courses.

We use strictly necessary cookies for sign-in sessions and language preference, and optional analytics cookies (PostHog) to understand how the product is used. The cookie banner lets you accept or reject the optional ones; strictly necessary cookies cannot be switched off because the platform does not work without them. Analytics data is used in aggregate and not to profile you for advertising.

We never sell your personal information. We use the following services to operate the platform. The data they receive depends on the feature you use and whether the integration is enabled:

• Supabase — authentication, database, and file storage (hosted in the United States), including the Studio advisor conversation history saved for your account.
• Stripe — payment processing and refunds (Stripe Connect). For educator subscriptions Stripe processes on our behalf; for a course purchase the charge is created on the educator's own connected account, where the educator is the merchant of record and Stripe acts for them. SkillsetMind does not receive or hold the purchase price.
• Vercel — application hosting, content delivery, website analytics and performance measurements.
• PostHog — product analytics.
• Moonshot AI — generates replies for the Studio advisor. It receives your current question, recent conversation messages, relevant platform help content, and a summary of your own educator account. This summary can include your display name, plan, payment and payout setup status, and details of up to 25 recent courses, including drafts: titles, status, prices and currencies, lesson and enrollment counts, ratings, course age, and whether a cover is missing. The automatic summary does not query individual learner records, card numbers, or bank account details. Text you enter, including messages and course titles, is sent without automatic removal of personal information.
• OpenAI — when knowledge search is configured, it receives the educator's current question to create a search vector (embedding), even if the advisor later fails to reply. It also receives the advisor's reference text when the knowledge base is synchronized, to make that content searchable.
• Bunny.net — where Bunny video hosting is used, it receives uploaded video files and titles to store and stream lessons. Loading its video player or uploading a video also sends connection and browser information, including your IP address and user agent.
• Cloudflare Turnstile — when enabled on sign-in, sign-up, password reset or account security forms, it processes connection and browser signals, including your IP address and user agent, to detect bots. Cloudflare also uses these signals to improve its bot detection.

We may also disclose data when required by law, to protect the rights and safety of users, or as part of a corporate transaction (merger, acquisition), in which case this policy continues to apply to your data.

Our service providers may process your data in the United States and in other countries where they operate. Using SkillsetMind may involve international transfers of your data.

We keep personal data only as long as needed for the purposes above:

• Account and learning data — while your account is active, and deleted or anonymized within 90 days after account deletion, except where retention is legally required.
• Certificates — the verification record persists so issued certificates remain verifiable, unless you ask us to remove it.
• Transaction records — kept for the period required by tax and accounting law (typically 5–10 years depending on jurisdiction).
• Analytics data — retained in identifiable form for no longer than 24 months.

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Access to production data is restricted, and database access is governed by row-level security policies so users can only read what belongs to them. No system is perfectly secure; if a breach affects your personal data we will notify you and the competent authority as required by law (including GDPR art. 33/34 and LGPD art. 48).

You can exercise any of these rights by emailing support@skillsetmind.com or from your account settings. We respond within the timeframe required by your law (30 days under GDPR, 15 days for confirmation and access requests under LGPD, 45 days under CCPA). We will never discriminate against you for exercising a privacy right.

SkillsetMind is for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact support@skillsetmind.com and we will delete it.

When we make material changes we will update the effective date above and notify you by email or in-product notice before they take effect. This policy is written in English; translations may be provided for convenience, and the English version controls except where local law requires otherwise.

Privacy questions and rights requests: support@skillsetmind.com or legal@skillsetmind.com. Data protection contact (including as "encarregado" under the Brazilian LGPD): SkillsetMind Legal, reachable at the same address.