FAASafety

Create your account

Already registered? Sign in.

By creating an account you agree to our Terms of Service and Privacy Policy.

19 sections · about 19 min read

Version 2026-09 · Effective 7 September 2026

These Terms govern your organization's use of the Skillfull platform. Section 12 limits our liability, sections 4 and 5 set out what you may not put into the Service, and section 13 says who defends and who pays a third-party claim.

1.1 These Terms of Service (the Terms) are an agreement between Skillfull Inc, a Delaware corporation operating from 114 Shadewell Dr, Danville, CA 94506 (Skillfull, we, us), and the organization that uses the Service (Customer, you). The Service is the Skillfull platform at www.skillfull.com and the workspace subdomains provided with it.

1.2 The agreement is formed the first time you accept these Terms on screen, accept a written order that refers to them, create an account, or use the Service. If you accept for an organization, you confirm that you can bind it. A signed order prevails where it says so.

2.1 We provision a workspace for you at a subdomain we assign or agree with you. Administrators can configure it, manage people and billing, and see the records in it, including learner records. Other roles see less. You decide who holds which role and remove access when it is no longer needed.

2.2 You are responsible for everything done under your account. Each person needs their own account, credentials must not be shared, and multi-factor authentication is available to every user. Email support@skillfull.com if an account may have been compromised. Our staff may sign in to your workspace, including as one of your users, to give support, investigate a security problem or comply with the law, and that access is logged.

3.1 We provide a hosted platform for building, delivering, scheduling and tracking training. We provide the platform. You provide the training. We are not a training provider, an accrediting body or an auditor, and we do not certify that anyone complies with anything. Duties you owe a regulator, an employer or an accrediting body stay yours, including the accuracy of the records here.

3.2 Some features generate drafts, summaries, transcripts, captions, images and audio from material you supply. That output can be wrong, so review it before you rely on it, and never make it the only basis for a decision about a person's credential, employment or pay. If we materially reduce the core functionality you pay for during a paid term, you may end the affected subscription within 30 days and we will refund the unused part of what you prepaid.

4.1 You and your users must not:

  • break the law, infringe anyone's rights, or upload unlawful or infringing content;
  • upload malicious code, reach into another customer's workspace, or test our security without written permission;
  • reverse engineer, resell or rent the Service, apart from the selling features in section 9, build a competing product from it, or train a model on its output;
  • scrape or bulk extract data from the Service other than through the features and application programming interfaces we provide;
  • exceed rate limits, or use automated means in a way that degrades the Service for others;
  • send unsolicited commercial messages through the Service, or use it in breach of any law governing commercial electronic messages or telemarketing;
  • misrepresent your identity or affiliation, or impersonate any person; or
  • record or transcribe a live session without the notices and consents the law requires.

4.2 We do not routinely monitor Customer Content and we have no obligation to do so. We may review it when we have a reason, such as a report of abuse, a suspected security problem, a legal demand or an investigation into a breach of these Terms, and we may remove or disable content we reasonably believe breaks section 4.1, 5.2 or 5.3. We will tell you what we removed and why, unless a law or a law enforcement request stops us. Your plan includes usage allowances; when you reach one, the Service may stop the action until it resets or you change plan.

5.1 You own your content. As between you and us, you own everything you or your users upload to or create in the Service, including courses, videos, assessments, recordings, transcripts and learner records (Customer Content). You are responsible for its accuracy and legality, for the rights and consents needed to upload it and have us process it, and for the sharing settings you choose. Keep copies of anything you cannot afford to lose.

5.2 Restricted data. Unless we have signed a separate agreement covering it, do not put into the Service: education records under the Family Educational Rights and Privacy Act, protected health information under the Health Insurance Portability and Accountability Act, information about a child under 13, or card or bank account numbers outside the payment features.

5.3 Two further categories are allowed only through the features we build for them, and only where you have given the notices and obtained the written consents the law requires. The first is a government issued identifier, such as the student identifier in our optional vocational training fields. The second is a biometric identifier such as a voiceprint: our voice feature builds a voice model from a sample a person supplies, records who consented and when, and sends the sample and the model to ElevenLabs in the United States. Do not put either category anywhere else in the Service.

5.4 If you put restricted data into the Service without our written agreement, or put a category in section 5.3 somewhere other than the feature built for it, you do so at your own risk, you remain responsible for it, and we may remove it and require you to stop.

5.5 You grant us a non-exclusive, worldwide, royalty free license, while you hold a subscription and through the wind down in section 14, to host, store, copy, back up, transcode, transcribe, display and otherwise process Customer Content in order to provide the Service, and we may pass these rights to the providers in section 7.4. We will not sell Customer Content, use it for advertising, or use it to train models made available to anyone else.

5.6 We own the Service, its software, the templates we supply and the Skillfull name, and you get a limited, non-transferable right to use it during your subscription. All rights not expressly granted are reserved. If you send us feedback or suggestions about the Service, you grant us a perpetual, irrevocable, worldwide, royalty free license to use them without obligation to you, and we will not name you as the source without your consent.

6.1 You decide, we execute. For personal information in Customer Content you determine the purposes and means of processing. You are the business or controller and we are your service provider or processor, including under the California Consumer Privacy Act. You confirm that you have given the required privacy notices and hold a lawful basis, and any consent the law requires, for what you put in, including for anyone in a recording or attendance record.

6.2 We process personal information on your behalf only to run your workspace, deliver and record training, produce the transcripts, reports and exports you ask for, send the messages you configure, support and bill you, and keep the Service secure. We process it for no other purpose. We will not sell or share it; will not retain, use or disclose it for a commercial purpose of our own; will not retain, use or disclose it outside the direct business relationship between you and us; and will not combine it with information from another source or from our own dealings with an individual, except where the law allows a service provider to do so. We understand these restrictions and will comply with them.

6.3 We give personal information the same level of privacy protection that the California Consumer Privacy Act requires of you, and everyone on our side who handles it is under a duty of confidentiality. We will tell you if we decide we can no longer meet our obligations under this section, and you may then take reasonable and appropriate steps to stop and remediate any unauthorized use. You may take reasonable steps to check that we are handling personal information as this section says, and we will give you the information reasonably needed to show that we are.

6.4 We will help you answer requests from individuals to know, access, correct, delete or opt out, at your cost where the help goes beyond the routine, and we will send anyone who asks us about learner data back to you.

6.5 Our Privacy Policy at www.skillfull.com/legal/privacy covers the account, billing and support data for which we are responsible. Your own privacy notice covers learner data.

7.1 The Service can connect to services run by other companies. Your use of one is governed by your agreement with that provider, and we are not responsible for it, or for a destination you send data to.

7.2 Zoom. You need your own Zoom account, and some features need a particular Zoom license. Your use of Zoom is governed by your agreement with Zoom, and connecting it authorizes us to use the permissions you grant. If Zoom changes or withdraws its service the affected features may stop working. You can disconnect at any time inside the Service, which revokes our access at Zoom, or you can remove the application from your Zoom account, and Zoom then tells us. Either way we erase the stored Zoom credentials, the Zoom user identifier and the Zoom email address we held. Recordings, transcripts and courses already imported stay in your workspace.

7.3 Live sessions. A live session records attendance and captures a transcript into your workspace, and a host can delete that transcript. You must tell participants what is captured and obtain any consent the law requires before a session is recorded or transcribed. Some state laws require the consent of every participant.

7.4 Our providers. We use Amazon Web Services, Stripe, Zoom where you connect it, OpenAI and ElevenLabs, and providers for email delivery and monitoring, and we stay responsible for the work we engage them to do. The current list is available from support@skillfull.com, and we give 30 days notice before engaging a new one that would process learner data. The United States service is hosted in the United States.

8.1 You pay the fees for the plan you chose at checkout or in a written order, in United States dollars, in advance for each billing period. Card payments go through Stripe, and by giving us a payment method you authorize us to charge it as fees fall due, including renewals, until you cancel. Invoices, where we use them, are due 30 days from their date, and overdue amounts may carry interest at 1 percent per month or the highest rate the law allows if lower.

8.2 Fees do not include tax, and you are responsible for sales, use and similar transaction taxes. If a charge looks wrong, tell us in writing within 30 days, and we will not treat a disputed amount as overdue while we look at it.

8.3 Your subscription renews automatically for a further term of the same length, at the price then in force, unless you cancel first. We do not send a renewal reminder, so note your renewal date. It is shown as the period end date in the billing area of your account. We will not raise the price during a term you have already paid for, and we will give your billing contact at least 30 days written notice before a new price applies to a renewal.

8.4 You can cancel at any time, from the billing area of your account, which opens the Stripe billing portal, or by writing to support@skillfull.com. Canceling takes effect at the end of the current term, you keep access until then, and you are not charged again. We will not make you telephone us or explain why.

8.5 If a payment fails we email your billing contact that day and again 3, 7 and 14 days later, and if the amount is unpaid 30 days after the first notice we may suspend access until it is paid. We may suspend immediately to prevent serious harm. Suspension does not reduce what you owe, or delete your data.

8.6 Fees are not refundable except where these Terms say so. We refund prepaid, unused fees pro rata where we end your subscription for convenience, where you end it for our uncured material breach, or under section 3.2, 13.2 or 15.2. Beta features may change or be withdrawn without notice, and carry no commitment.

9.1 Optional features let you sell courses and memberships. You connect your own Stripe account, set your prices, and are the seller and merchant of record, responsible for describing what you sell accurately, for the disclosures and cancellation rights consumer law requires, for tax on those sales, and for refunds and chargebacks. We deduct a platform fee from each transaction. The Earnings page in your account shows the platform fee taken on course and bundle sales, by month and in total. Ask us at support@skillfull.com for the current rate, and we will give 30 days notice before changing it.

9.2 When an order is refunded the buyer's access is revoked automatically, and when a recurring membership lapses, access is revoked to content the learner has not completed. Tell your buyers that this is how it works.

10.1 Each party will use the other's non-public information only to perform this agreement, will protect it with at least reasonable care, and will share it only with people who need it and are under similar obligations. Customer Content is yours; our pricing and the non-public parts of the Service are ours. This does not cover information that is public through no fault of the recipient, was already known, or was independently developed, and either party may disclose where the law requires. These obligations last 3 years, and indefinitely for trade secrets.

11.1 We do not promise a level of availability. There is no uptime percentage, no service credits and no service level agreement unless we have signed one. The Service depends on providers we do not control, and we may take it offline for maintenance. We publish component status and recent incidents at www.skillfull.com/status, which is not an uptime record or a commitment.

11.2 Support is by email to support@skillfull.com and through the support area inside the Service. We aim to respond promptly. We do not offer a guaranteed response time. Support covers the Service, not your content, your compliance or a service you connected.

11.3 We maintain safeguards designed to protect Customer Content: encryption in transit, encryption of the database at rest under a customer managed key, encryption of stored third-party credentials using the Advanced Encryption Standard (AES-256-GCM), role-based access control, audit logging, automated database backups and multi-factor authentication. We will not make them materially less protective during your subscription. No system is perfectly secure, and the security decisions inside your workspace are yours.

11.4 If we become aware of a breach that destroys, alters, loses or exposes Customer Content, we will tell you without undue delay after confirming it, and immediately following discovery where the law imposes that standard on us, giving you what we know so you can meet your own notification duties. Report a vulnerability to support@skillfull.com.

11.5 You decide whether an incident requires you to notify individuals or a regulator, and you make that notification. We will not notify your learners for you unless we agree in writing or a law requires us to. Our notice to you is not an admission of fault or liability.

12.1 We warrant that we have the authority to enter into this agreement, that we will provide the Service with reasonable skill and care, and that we will not knowingly introduce malicious code into it.

12.2 EXCEPT AS STATED IN SECTION 12.1, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", AND WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, ACCURACY AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, SECURE OR ERROR FREE, THAT DATA WILL BE PRESERVED WITHOUT LOSS, THAT GENERATED OUTPUT WILL BE ACCURATE, OR THAT USING IT WILL MAKE YOU COMPLY WITH ANY LAW. An implied warranty a state will not let us exclude lasts 90 days.

12.3 NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL OR DATA. EACH PARTY'S TOTAL LIABILITY UNDER THIS AGREEMENT WILL NOT EXCEED THE FEES YOU PAID OR OWE US IN THE TWELVE MONTHS BEFORE THE EVENT THAT GAVE RISE TO THE CLAIM. That figure doubles for a claim arising from our breach of section 6 or 11.3 that exposes personal information, and is US$100 for anything provided free. These limits do not cover your obligation to pay fees, either party's indemnity under section 13, a breach of section 10, gross negligence, willful misconduct or fraud, death or personal injury caused by negligence, or liability that cannot be limited by law.

12.4 These limits apply even if a limited remedy fails of its essential purpose, and they survive termination. Where a state does not allow the exclusion or limitation of incidental or consequential damages, that exclusion does not apply to you and our liability is limited to the smallest amount that state permits. These limits are an agreed allocation of risk between two businesses and are a basis of the price of the Service. Neither party would enter into this agreement without them.

13.1 We will defend you against a third-party claim that the Service, as we supply it and used as these Terms permit, infringes a United States patent, copyright, trademark or trade secret, and we will pay the damages and costs finally awarded against you, or agreed by us in settlement of the claim. This does not apply to a claim arising from Customer Content, from your instructions or configuration, from combining the Service with something we did not supply where the claim would have been avoided without the combination, from a change made by anyone other than us, or from use in breach of these Terms or of the law.

13.2 If a claim under 13.1 arises, or in our reasonable opinion is likely to, we may obtain the right for you to keep using the Service, change or replace it so that it does not infringe and does the same job, or, if neither is commercially reasonable, end the affected subscription and refund prepaid, unused fees pro rata. Sections 13.1 and 13.2 state our whole liability and your only remedy for a claim that the Service infringes.

13.3 You will defend us against a third-party claim arising from Customer Content, from your breach of section 4, 5.2, 5.3 or 6.1, from a notice or consent you failed to give or obtain, including for recording or transcribing a session, from your sales under section 9, or from the duties that stay yours under section 3.1. You will indemnify us and hold us harmless, and will pay the damages and costs finally awarded against us, or agreed by you in settlement of the claim.

13.4 The party seeking indemnity must give the other prompt written notice of the claim, must let the indemnifying party run the defense and settlement, and must cooperate reasonably at that party's cost. A delay in giving notice reduces the indemnity only to the extent the delay prejudices the defense. The indemnified party may take part at its own cost. Neither party may settle in a way that puts liability, an admission or a non-monetary obligation on the other without that party's written consent, which must not be unreasonably withheld.

14.1 This agreement runs for your subscription term and each renewal until it ends. Either party may end it by notice if the other commits a material breach and does not fix it within 30 days of written notice, or immediately if the other becomes insolvent and the proceeding is not dismissed within 60 days. We may end your subscription for convenience on 30 days notice, refunding prepaid, unused fees pro rata, or immediately if the law requires it or your use would expose us or another customer to serious legal or security risk. On termination or expiry your right to use the Service ends, subject to the export window, and all fees accrued to the effective date become due.

14.2 While your account is active, administrators can export workspace data from the data export area, and each person can export the data held about them from their own account area. Exports leave out passwords and other secrets.

14.3 Export window. For 30 days after your subscription ends we keep Customer Content and, on a written request from an administrator, make it available for export in the formats the Service supports, at no charge.

14.4 Nothing deletes your content on a schedule after that. We keep it until an authorized administrator asks us in writing to delete it, and we then carry that out by hand. Even after a deletion request we keep content we must hold for a law or a legal hold, copies in routine backups that are overwritten within 90 days, minimal records that a transaction or an acceptance happened, and aggregated data that cannot reasonably be re-identified.

14.5 If you must keep records to meet your own legal, accreditation or funding obligations, exporting them before the window closes is your responsibility. We are not your system of record for a statutory retention period, and deleting data here does not delete it from a connected service.

14.6 A person can ask to delete their own account from inside the Service. The request takes effect after a 30 day grace period and can be canceled during it. Deletion removes or redacts their personal details, but records that something happened, such as attendance at a session, are kept without them.

15.1 We may change these Terms. Every version carries a version label and an effective date, shown at the top of this page, and the current version is at www.skillfull.com/legal/terms. For a change that materially affects your rights we give at least 30 days notice, by email to your administrator and billing contact and by a notice inside the Service. Corrections take effect when published.

15.2 When a new version is published we ask you to accept it the next time you sign in with a password. Signing in through single sign on, and joining through an invitation link, do not show that prompt, so check this page for the current version. Continued use on or after the effective date is acceptance. If you do not accept a material change you may end your subscription before it takes effect, and we will refund prepaid, unused fees pro rata. We will not weaken how we handle personal information, or our safeguards, without your agreement.

16.1 Each party will comply with the laws that apply to it in performing this agreement.

16.2 You represent that you are not located in, organized under the laws of, or ordinarily resident in a country or region under comprehensive United States sanctions, and that neither you nor your users are on a United States government restricted-party list. You must not export, re-export or make the Service available in breach of United States export control or sanctions law.

16.3 Neither party will offer, promise or give anything of value to improperly influence an official act or decision, and each will comply with applicable anti-bribery and anti-corruption laws.

16.4 The Service is a commercial product. If you are a United States government entity, the rights you get are the rights given to commercial computer software and commercial computer software documentation under the applicable federal acquisition regulations, and no others. Use by a government entity may require a separate written agreement.

17.1 This agreement, and any dispute about it or about the Service, is governed by the law of the State of Delaware, without regard to its conflict of laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply. Before starting a proceeding the party raising a dispute will describe it in writing, and senior people from both sides will confer within 30 days. After that, the courts in New Castle County, Delaware have exclusive jurisdiction, although either party may still ask any court to protect its intellectual property.

18.1 Notices. We may give you notice by email to your administrator or billing contact, or inside the Service, so keep those accurate. Send us legal notices by email to support@skillfull.com and by mail to Skillfull Inc, Attention: Legal, 114 Shadewell Dr, Danville, CA 94506, not by support ticket.

18.2 Neither party may assign this agreement without the other's written consent, except in full, on notice, to an affiliate or on a sale of the business, and neither is liable for a failure beyond its reasonable control, which does not excuse paying.

18.3 These Terms, with any written order and policy they refer to, are the whole agreement about the Service. Neither party relies on any statement that is not set out in them, and terms in a purchase order, vendor portal or other business form have no effect. This agreement is between you and us, and no other person has a right to enforce it. The parties are independent contractors, and nothing here creates a partnership, joint venture, agency or employment relationship. In these Terms, "including" means including without limitation.

18.4 An unenforceable provision is modified to the least extent needed, or severed, and a delay in enforcing a right is not a waiver. Neither party may use the other's name or logo publicly without consent. Sections 5.1, 5.6, 10, 12, 13, 14.3 to 14.6, 16, 17 and 18 survive termination.

18.5 Electronic acceptance. Accepting on screen has the same effect as a handwritten signature. We record each acceptance, with the version, the date and time, and the internet protocol address and browser used, and you agree that record is evidence of it.

Skillfull Inc, 114 Shadewell Dr, Danville, CA 94506, United States. Employer Identification Number 87-1902205.

Support, privacy, security and legal notices: support@skillfull.com. Our Privacy Policy is at www.skillfull.com/legal/privacy and service status is at www.skillfull.com/status.

11 sections · about 15 min read

Version 2026-09 · Effective 7 September 2026

Skillfull Inc runs the Skillfull learning platform at www.skillfull.com. This policy says what personal information we collect, why, who we share it with, where it goes, how we protect it, how long we keep it and what you can do about it. It describes what the software does today.

1.1 Skillfull Inc is incorporated in Delaware and operates from 114 Shadewell Dr, Danville, CA 94506. Our Employer Identification Number is 87-1902205.

1.2 This covers www.skillfull.com and its subdomains, our marketing website and the email we send. "Personal information" means information about an identified or reasonably identifiable individual. "Customer" means the organization or creator holding a subscription.

1.3 Two groups are covered. For customer staff who hold accounts, we decide what we collect and why, and answer to you directly. For learners a customer enrolls, we act on that customer's instructions under its privacy notice, not ours: it decides who is enrolled, what is recorded and who sees it. Ask it first to change a learner record.

2.1 Account details: name, email address, alias, hashed password, profile settings, billing and organization details. What you create: courses, lessons, forms, files, videos, images, tickets and messages. Learning records: enrollments, progress, completion, due dates, cohorts, quiz and assessment attempts, results, certificates and, where assessment features are used, observation records, signed declarations, decisions and appeals. Live sessions: attendance, recordings, transcripts, speaker-attributed captions and chat. Technical records: an Internet Protocol (IP) address and browser user agent per sign-in, multi-factor secrets, your recorded acceptance of this policy, and analytics events.

2.2 Card numbers go straight to our payment processor; we never see or store one. Live session attendance is captured whether or not a person is signed in, and turning recording off stops neither attendance nor the transcript.

2.3 We get this from you, from the customer that enrolled you, from your use of the platform, from services a customer connects, and, for business development only, from business contacts published on company websites. Connecting Zoom brings meeting details, participant names and email addresses, recordings and transcripts, and stores that person's Zoom identifier, login email address, scopes and encrypted tokens. Where we send a named business contact a link to a preview page built for them, we measure how that page is read, including that it was opened, the time and the referring share address, a scrambled form of the browser user agent, how many seconds the page was open, how far down it was scrolled, how many sections were seen, and whether a video was played or a button clicked. Our sales team is alerted when that happens.

2.4 Sensitive information. Voice models, created only after we record who consented, when, from what address and browser, and when consent expires. Live session content, which can reveal almost anything unintentionally. And, where a customer uses our optional vocational training fields, date of birth, home address, disability and ethnicity indicators and a government-issued student identifier. That identifier is never our own identifier for a person, never printed on a certificate, and disclosed only to the customer that recorded it.

2.5 The same list, in the words California law uses. In the preceding 12 months we have collected the categories below. For each one, the sources are those in clause 2.3, the business purposes are those in clause 3.1, and the categories of recipients are those in clause 4. We have not sold or shared any of them, as clause 3.2 says.

  • Identifiers. Name, alias, email address, account identifier and Internet Protocol address.
  • The personal records category in California Civil Code section 1798.80(e). Name, postal address, telephone number, education and employment information.
  • Protected classification characteristics. Date of birth, disability information and racial or ethnic origin, and only where a customer fills in the optional fields described in clause 2.4.
  • Commercial information. Subscriptions, invoices, course purchases and refunds.
  • Biometric information. Voice samples and the voice models built from them, and only where the speaker has consented.
  • Internet or other electronic network activity. Pages viewed, analytics events, browser user agent, and the preview page measures in clause 2.3.
  • Audio, electronic and visual information. Live session recordings, transcripts, captions, chat and images.
  • Professional or employment-related information. Job role, employer, cohort and training completed.
  • Education information. Enrollments, progress, results, certificates and assessment evidence.
  • Inferences. Limited ones drawn from progress and completion records.

2.6 Of those, the ones California treats as sensitive personal information are racial or ethnic origin, biometric information in the form of voice models, and the contents of a live session. We handle the government-issued student identifier in clause 2.4 to the same standard.

3.1 To run and secure the platform; to deliver what the customer asked for, including enrollment, reporting and export; to draft course material, images, transcripts and narration from what a customer supplies; to take payment; to support you; to see in aggregate which parts are used; to send service and marketing messages; and to meet legal obligations.

3.2 We do not sell personal information, share it for cross-context behavioral or targeted advertising, or profile learners for advertising, and have not in the preceding 12 months, so we have no actual knowledge of doing so for anyone under 16. Sensitive personal information is used only to run and secure the service and comply with the law.

3.3 We do not use one customer's content to train models for another customer or for ourselves, though provider terms are theirs to set.

3.4 Marking, and what a machine decides. Quizzes are marked against the answer key the course author wrote. One optional feature marks a written answer automatically: the answer and the author's rubric go to a text generation model, and the learner is shown a score and written feedback straight away, with no person looking at it first. An assessment decision, the formal kind that becomes evidence, records the person who made it by name. Where a customer has turned the practitioner register check on, the platform refuses a decision from someone the register does not back. In the setting we ship, the platform records the decision and flags it for review instead.

4.1 The customer that enrolled you sees a learner's records, through the administrators, trainers and assessors it permits. These providers each receive only what their job needs:

  • Amazon Web Services, Inc. Hosting, database, storage, email, speech to text, video processing, and text and image generation through Amazon Bedrock, using models from Anthropic, Amazon, Meta and Stability AI.
  • Stripe, Inc. Payments, subscriptions, invoicing, refunds, payouts and tax calculation.
  • Zoom Communications, Inc. Live meetings, recordings and transcripts. Provisioning a host seat sends Zoom that person's name and email address.
  • OpenAI, L.L.C. and ElevenLabs Inc. Narration turned into audio; ElevenLabs also holds voice models built from consented samples.
  • Cloudflare, Inc. The automated abuse check on our sign-in, registration and contact forms.
  • Google LLC and Vimeo, Inc. Outbound email on some routes, and video metadata lookups. Migadu, a Swiss company, hosts our own mailboxes on servers in Europe.
  • Slack Technologies, LLC and GitHub, Inc. Internal operational and error alerts, which can name an organization. Slack also receives a person's name and email address when they create an account or send us a message through a form on our website, so that a real person picks it up.

4.2 Where a course carries continuing education credit we send the awarding body the learner's account email address, the credited activity number and the completion date. Today that is the Federal Aviation Administration WINGS Pilot Proficiency Program, and no other registry is enabled unless a customer asks.

4.3 We also share to a destination a customer nominates, which is then its responsibility; with our lawyers, accountants and insurers; with an acquirer, subject to this policy continuing to apply; and on valid legal process.

5.1 We keep the database, files, videos, transcripts and backups in Amazon data centers in the United States, in the US East (Northern Virginia) region. Image generation runs in Amazon's US West (Oregon) region. Text generation goes through Amazon's global routing, which Amazon may serve from outside the United States, and that text can include course content, a transcript or a learner's typed question.

5.2 Skillfull Inc operates from the United States and stores this deployment's data there. If you use the platform from another country, your information is transferred to and processed in the United States, where privacy laws differ from the laws of your own country. Live session audio does not leave our network: the platform refuses to start unless the speech recognition service is at an internal address in our own infrastructure. Our providers are United States companies except Migadu, and for learners in Europe or the United Kingdom we agree a separate written transfer arrangement with the customer.

6.1 We run no advertising tags, no pixels and no cross-site tracking, which is why you see no cookie banner. The cookies we set are these: one that keeps you signed in for eight hours after your last activity; one that protects forms against cross-site request forgery; one that authorizes private video playback; one that admits an invited guest; and, on a personalized preview page we send to a named business contact, one that ties that reader's visit to the page so we can record how it was read, as clause 2.3 describes. That last cookie is our own, is readable only by our server, and lasts six hours. Our abuse check provider may set one of its own. Your browser also stores an appearance preference and an analytics session identifier.

6.2 Do Not Track and Global Privacy Control. Since we do not sell or share personal information or do behavioral advertising, an opt-out preference signal has nothing to switch off, and we do not currently act on one. If that changes, we will honor those signals and say so here first.

6.3 Service email about security, billing, enrollment and this policy cannot be turned off while you hold an account. Marketing email can be, through the unsubscribe link every message carries. Our marketing email is meant to carry our name and postal address beside that link as well. That text comes from a configuration setting the software does not check at startup, so the only thing we can promise in every message is the unsubscribe link itself.

6.4 When you unsubscribe we add your address to a do-not-contact list and stop emailing you. That list holds your address in plain text, because matching it against the next send is what makes the opt-out work. Only a scrambled form of the address passes between our regions, so an opt-out in one region is honored in the others without the plain address leaving the region you dealt with.

7.1 This clause states what our systems do. We hold no security certification and claim none. Traffic uses Transport Layer Security. A password set or changed on our current scheme uses PBKDF2 (Password-Based Key Derivation Function 2) with SHA-256, 600,000 iterations and a unique salt, so we cannot read yours; a password still stored under our older scheme is upgraded to the current one the next time its owner signs in. Tokens for connected services use AES-256-GCM (Advanced Encryption Standard, 256 bit key, Galois/Counter Mode), and the platform refuses to store a secret if the key is missing.

7.2 The database is encrypted at rest with a customer-managed key in Amazon Key Management Service with rotation on, has no direct route from the internet, and keeps automated backups for 35 days. Multi-factor authentication is available but off by default. Sessions can be revoked, and changing a password ends every session. A web application firewall with managed rules and rate limiting sits in front of the platform, access is by role, and sign-ins, administrative actions and billing events are written to audit records.

7.3 Three limits worth stating. Files, videos and transcripts rely on the encryption Amazon applies by default, with no separate customer-managed key, and material meant to be public, such as cover images, is readable by anyone with the link. Names, email addresses, learning records, transcripts and captions sit in plain text in the database, because the application must read them. Support and system administration staff can view the platform as one of your users to investigate a fault; that is written to our audit records. An administrator can read their own organization's audit log inside the platform, but a support sign-in is recorded against us rather than against your organization, so it is not yet shown to you there.

8.1 Courses, videos, transcripts, learning records, assessment evidence, attendance and certificates do not expire, and nothing deletes them on a schedule. Training records often fall under a customer's own record-keeping obligations, which can run for years, so we keep them until the customer says otherwise. Canceling a subscription stops billing but deletes nothing. An administrator can export the organization's data for 30 days after a subscription ends. After that we keep it until an authorized administrator asks us in writing to delete it, which we do by hand. We run no job that deletes a former customer's content after a fixed period, and we do not want to publish a period we have not built.

8.2 An account holder can request deletion from their profile. It waits 30 days, can be canceled in that time, then runs automatically. Deletion makes the record anonymous rather than erasing it: the email address becomes a non-deliverable placeholder, the name becomes "Deleted User", credentials, sessions and settings are cleared, and your name and email address are redacted from tickets, messages, attendance records and live session invitations. In a session transcript the words stay while the link to you goes.

8.3 Deletion has known gaps. It does not reach files, videos and transcripts in file storage. It does not reach the copies our providers hold: we send no automatic deletion instruction to a provider, but will help you ask. It does not reach a platform invitation sent to you, which keeps the name and email address it was addressed to. And it does not reach our sign-in records or our analytics events, which keep an Internet Protocol address and a browser user agent against your account; deletion revokes the sessions but leaves those rows, and we clear them by hand.

8.4 We refuse deletion where a person is recorded as having made assessment decisions about other learners and no separate practitioner record explains them.

8.5 Fixed periods we apply: backups 35 days, previous versions of stored files 90 days, application logs one week. Anything deleted from the live database stays in backups until they roll off. Analytics events have no automatic deletion today; we will publish a fixed period here once that is automated. Disconnecting Zoom revokes our access at Zoom and erases the stored tokens, Zoom user identifier, login email address and scopes. Removing our app from inside your Zoom account does the same: Zoom tells us, and we erase them. Either way, recordings, transcripts and courses already imported are left alone.

9.1 Which state privacy statute applies to us turns on our revenue and on how many residents of that state we handle data about, and those figures change. Rather than make you work it out, we give these rights to any United States resident we can identify. You may ask us to tell you what we hold about you, its categories, sources, purposes and categories of recipients; give you a copy in a portable format; correct what is wrong; delete it, subject to clause 8; opt out of any sale or sharing and of targeted advertising, none of which we do; limit the use of sensitive personal information; and appeal our decision. Nevada residents may direct us not to sell covered information, which we do not do.

9.2 Write to support@skillfull.com or to the postal address in clause 11. There is no form and no required wording. Your account settings also let you see, export and request deletion of your own data, and an administrator with the export permission can export the organization's records, with passwords, tokens, keys and stored credentials permanently excluded. If an organization enrolled you, ask it first; if you come to us, we pass the request on and act on its instruction unless the law requires otherwise.

9.3 Authorized agents. You may use an authorized agent to make a request for you. We will ask the agent for written proof of its authority, such as a permission signed by you or a power of attorney, and we may ask you to confirm the authorization with us directly. We may also verify you yourself, as clause 9.4 describes.

9.4 Before acting we take reasonable steps to confirm you are that person or are authorized to act for them, usually by your replying from the address on the account. We ask for no more than we need to verify you, and we use what you give us for that and nothing else. We acknowledge within 10 business days and answer within 45 days, telling you beforehand if we need longer. We may decline where the law allows, where we cannot verify you, where the record is the assessment evidence in clause 8.4, where acting would reveal another person's information, or where a request is manifestly unfounded.

9.5 Appeal by replying to our answer: a different person reviews it, gives written reasons, and tells you how to complain to your state attorney general if we uphold the refusal. We will not deny you the service, charge you a different price, give you a worse standard of service, or treat you differently as an applicant, a student or an employee because you exercised a privacy right.

10.1 Skillfull is a workplace and professional training platform, not directed to children under 13, and we do not knowingly collect personal information from one. If we learn we hold it without the consent federal law requires, we delete it and tell the customer that uploaded it. Customers must not enroll learners under 13 without a separate written agreement covering verifiable parental consent or school authorization.

10.2 We record, triage and alert on operational incidents, but we have no automated breach assessment or notification workflow: handling a breach is a manual process. Where we hold personal information for a customer we will notify that customer without undue delay once we know of a breach affecting their data, as California law separately requires of anyone holding personal information it does not own. Where the law requires notice to individuals or a regulator we give it in the period and form that law requires. We publish no fixed number of hours, because a deadline published and then missed is both a broken promise and a separate legal problem.

10.3 For a complaint, tell us first at support@skillfull.com. We acknowledge it, investigate, and answer in writing within 30 days. If that does not satisfy you, escalate to your state attorney general, to the Federal Trade Commission at reportfraud.ftc.gov, or, if you are a California resident, to the California Privacy Protection Agency at cppa.ca.gov.

10.4 We review this policy at least once every 12 months and update it whenever our practices change. The version and effective date at the top tell you which version you are reading. We give at least 30 days notice by email before a material change takes effect, including when we add or replace a service provider handling personal information, and ask you to accept a new version at your next sign-in.

11.1 By email: support@skillfull.com, which is also where to report a suspected security vulnerability, marked as such in the subject line so it reaches our engineers quickly. By post: Privacy Contact, Skillfull Inc, 114 Shadewell Dr, Danville, CA 94506. We do not run a telephone line for privacy requests, so we have not published a number nobody would answer. We aim to respond promptly.