Privacy Policy

• Account data — name, email address, password (stored hashed by Supabase Auth), and your role on the platform (learner and/or educator).
• Profile data — information you add to your profile, such as a photo, bio, or professional background (for educators).
• Learning activity — courses you enroll in, lesson progress, certificates you earn, reviews you write, and posts in course communities and live sessions.
• Transaction data — order history, amounts, currency, and refund status. Payments are processed by Stripe; we receive confirmation and receipt metadata but never your full card number.
• Educator payout data — if you sell courses, the identity and banking information Stripe Connect requires for payouts is collected and held by Stripe under its own privacy terms; we see payout status and account state.
• Usage data — product analytics collected through PostHog: pages viewed, features used, device and browser type, and approximate location derived from IP.
• Cookies — described in Section 4 and controlled through the cookie banner.
• Communications — messages you send to support and notification preferences.

Under the GDPR (EU/EEA/UK) and the LGPD (Brazil), each use of personal data needs a legal basis. Ours are:

• Performing our contract with you — creating and securing your account, delivering courses you enroll in, issuing certificates, processing purchases and refunds, paying educators.
• Legitimate interests — keeping the platform safe, preventing fraud and abuse, improving features based on aggregate usage, and sending service messages about your account and purchases.
• Consent — optional analytics cookies and marketing emails. You can withdraw consent at any time (cookie banner, unsubscribe link, or account settings) without affecting your use of the platform.
• Legal obligations — tax, accounting, and lawful requests from authorities.

When you enroll in a course, the educator who runs it can see your name, email, enrollment date, and progress in their course — this is how they support their students. Under our public creator commitments ("The Promise"), each educator's student list belongs to that educator. Educators must handle student data lawfully and may not sell it; their obligations are set out in the Teacher Terms. Educators do not see your payment details or your activity in other educators' courses.

We use strictly necessary cookies for sign-in sessions and language preference, and optional analytics cookies (PostHog) to understand how the product is used. The cookie banner lets you accept or reject the optional ones; strictly necessary cookies cannot be switched off because the platform does not work without them. Analytics data is used in aggregate and not to profile you for advertising.

We never sell your personal information. We share it only with the service providers that run the platform, under contracts that limit what they can do with it:

• Supabase — authentication, database, and file storage (hosted in the United States).
• Stripe — payment processing, refunds, and educator payouts (Stripe Connect).
• Vercel — application hosting and content delivery.
• PostHog — product analytics.

We may also disclose data when required by law, to protect the rights and safety of users, or as part of a corporate transaction (merger, acquisition), in which case this policy continues to apply to your data.

Our infrastructure is hosted in the United States. If you access SkillsetMind from outside the US (including the EU/EEA, UK, or Brazil), your data is transferred to and processed in the US. For transfers from the EU/EEA and UK we rely on our providers' Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework; for Brazil, on the LGPD's international-transfer provisions (art. 33). Data processing agreements with our infrastructure providers (Supabase, Stripe, Vercel) are incorporated into their respective service terms.

We keep personal data only as long as needed for the purposes above:

• Account and learning data — while your account is active, and deleted or anonymized within 90 days after account deletion, except where retention is legally required.
• Certificates — the verification record persists so issued certificates remain verifiable, unless you ask us to remove it.
• Transaction records — kept for the period required by tax and accounting law (typically 5–10 years depending on jurisdiction).
• Analytics data — retained in identifiable form for no longer than 24 months.

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Access to production data is restricted, and database access is governed by row-level security policies so users can only read what belongs to them. No system is perfectly secure; if a breach affects your personal data we will notify you and the competent authority as required by law (including GDPR art. 33/34 and LGPD art. 48).

You can exercise any of these rights by emailing support@skillsetmind.com or from your account settings. We respond within the timeframe required by your law (30 days under GDPR, 15 days for confirmation and access requests under LGPD, 45 days under CCPA). We will never discriminate against you for exercising a privacy right.

SkillsetMind is for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact support@skillsetmind.com and we will delete it.

When we make material changes we will update the effective date above and notify you by email or in-product notice before they take effect. This policy is written in English; translations may be provided for convenience, and the English version controls except where local law requires otherwise.

Privacy questions and rights requests: support@skillsetmind.com or legal@skillsetmind.com. Data protection contact (including as "encarregado" under the Brazilian LGPD): SkillsetMind Legal, reachable at the same address.