Privacy Policy

1. Introduction

SkillCertify ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains exactly what personal data we collect, why we collect it, how long we keep it, and what rights you have over it when you use our platform at skillcertify.io.

The data controller responsible for your personal data is Global Digital Services, LLC, a Florida limited liability company trading as SkillCertify, c/o Registered Agents Inc., 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States. You can reach us at privacy@skillcertify.io. This policy explains how we handle personal data under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and other applicable data protection laws, and it states plainly where our practices are still being completed. We aim to collect only what we need and to keep it only as long as stated below.

2. Data We Collect

We collect the following categories of personal data:

• Account Data: Name, email address, password (hashed with bcrypt — we never store it in plain text), profile picture, role (talent or organization), and when you accepted our Terms of Service and Privacy Policy (date and version).
• Profile Data: Skills, experience, bio, location, availability status, GitHub username, and any other information you voluntarily add to your public profile.
• Assessment Data: Lab session results (scores, task completions, timestamps). During a hiring workflow an organization sends you (its knowledge-test, lab and interview stages, after you accept the webcam check at the start; labs, tests and interviews you take on your own never use the camera), periodic webcam snapshots are taken for anti-fraud verification and, in a lab stage, a screenshot of the lab desktop is taken about once a minute — we do not record continuous video. These snapshots and desktop screenshots are used to confirm presence and session integrity: an automated check counts the faces in each image for the session's integrity score. They are shown only to the hiring team of the organization that sent you that assessment, in your assessment report; SkillCertify staff access them only to investigate fraud or to answer a support request from you. They are never used to train AI or any model, never used for facial recognition or biometric profiling, never sold or shared with anyone else, never backed up, and are automatically deleted after 7 days.
• Interview Answers: In an AI interview stage your spoken answers are recorded in your browser and sent, answer by answer, to ElevenLabs to be turned into text. We store the text (the transcript) and the AI scores of your answers, never the audio. No video of you is stored: during a hiring workflow the camera is used only for the still snapshots described above.
• In-Lab AI Assistant: In labs that include an AI coding assistant, every prompt you send and every reply it gives is logged with your session. When an organization sent you that lab, its hiring team sees this log in your assessment report, so they can see how you worked with AI.
• Certificates: When you pass an approved lab or knowledge test, we issue a certificate: a code (for example SC-ABCDE-12345), the test name, level, skills, your score, the pass mark and the date. Completing every test in a certification track issues a track certificate.
• Payment Data: Credit purchase history and current balance. Payment card details are processed exclusively by Stripe, a PCI-DSS Level 1 certified payment processor, and are submitted directly to Stripe — they never pass through or rest on our servers.
• Usage Data: IP address, browser type, device information, and pages visited — used for security monitoring, and, with your cookie consent, for website analytics (Google Analytics 4) and session replay (Microsoft Clarity).
• Communication Data: Messages sent through the in-platform messaging system and support tickets.

What we do NOT collect: We do not collect continuous video recordings of lab sessions or interviews, recordings of your voice (interview audio is transcribed, then discarded), keystroke logs, or any biometric data (e.g., fingerprints, facial recognition templates). Webcam snapshots are used only to verify presence — no biometric identification is performed.

3. How We Use Your Data

We use your personal data strictly for these purposes:

• Providing the SkillCertify platform — authentication, session management, lab provisioning, scoring.
• Matching talent profiles with organization job requirements using AI — the AI provides recommendations, final decisions are always made by humans.
• Issuing certificates for tests you pass and letting anyone with a certificate code check that it is genuine.
• Processing credit purchases and managing balances.
• Sending service-related transactional emails (email verification, assessment results, purchase receipts). You can opt out of non-transactional emails in account settings.
• Detecting and preventing fraud during assessment sessions using webcam presence checks and behavioral signals processed in-session.
• Complying with legal obligations (e.g., tax records, fraud reporting).

We do not use your data for advertising. We do not sell your data to any third party.

4. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Contract (Article 6(1)(b)): Processing necessary to provide the services you signed up for — authentication, lab access, scoring, billing.
• Consent (Article 6(1)(a)): Processing that we ask you to agree to, such as the webcam check of a proctored assessment. It is asked once, before the assessment starts; an assessment that requires it does not run without it, and declining ends that assessment (an organization that paid for it is refunded). You may withdraw consent at any time by contacting privacy@skillcertify.io.
• Legitimate Interest (Article 6(1)(f)): Fraud prevention, platform security, aggregate service analytics, public talent profiles, public verification of certificate codes, and product and marketing emails to registered users. Marketing and engagement emails are on by default; you can switch them off at any time in the email preferences on your profile or settings page, or with the unsubscribe link in any email. Our interest does not override your privacy rights, and you may object at any time.
• Legal Obligation (Article 6(1)(c)): Keeping payment records for the period required by applicable tax law. These records are held by Stripe, our payment processor.

5. Data Sharing

We do not sell your data. We share data only in these limited circumstances:

• With Organizations (talent users only): Talent profiles are public: your name, headline, location, links, verified skill scores and projects can be seen by organizations and on public profile and leaderboard pages. You can take your profile off every public page at any time with Hide my profile on your profile page: your profile page, leaderboard and ranking entries and your place in organization search disappear (organizations that already sent you an assessment still see its results). When an organization sends you an assessment, it also sees your results for it and, for proctored assessments, its webcam snapshots (kept 7 days). Profile pages are not indexed by search engines, and sandbox (test) accounts never appear on public pages.
• Certificates: Anyone who has a public certificate's code or link can open its verification page, which shows your name (linked to your public profile) and headline, the test, your score, the pass mark, the date and the skills. If you hide your profile, your certificates still verify by code, but the page shows only your name, without the profile link or headline. Certificates you make public are also listed on your public profile; you can make each one public or private from My Certificates. A private certificate is not on your profile and its verification page shows "not found" to everyone but you. A certificate earned only in an assessment an organization sent you starts private until you make it public (or pass the same test on your own). Verification pages are not indexed by search engines. If you use the LinkedIn buttons, the certificate's name, code, date and link are sent to LinkedIn, only when you click.
• Organizations' own systems and AI assistants: An organization can connect its own software to SkillCertify with an API key or webhooks (for example its applicant-tracking system), or connect an AI assistant it uses (such as Claude or ChatGPT). Through these it can receive, for the assessments it sent you: your name and email, the status of your invitation, your stage scores and pass/fail, a link to your report and, through an AI assistant, the AI summary of your results (highlights, concerns and per-question interview scores). Webcam snapshots are never sent this way. Once that data is in the organization's systems, the organization controls it under its own privacy terms.
• Search engines and AI systems: Pages that are public — such as the community forum and the test marketplace — may be crawled and indexed by search engines and AI assistants (for example to answer questions about SkillCertify and cite it), and content you post publicly, such as community posts, may be read and used by those third-party systems, including to train or operate AI models. Your profile page and certificate verification pages are not indexed. You choose what you post publicly.
• Service Providers: Stripe (payments), Anthropic Claude, Google Gemini and OpenAI (AI features), ElevenLabs (interview voice and speech-to-text), Resend (transactional email), Hostinger (hosting infrastructure) and Amazon Web Services (file storage and encrypted backups). We are putting written data processing agreements in place with each of them. See our Data Policy for the full sub-processor list.
• Legal Requirements: When required by applicable law, court order, or to protect the rights and safety of our users.

6. Data Retention — What We Keep and For How Long

We are specific about retention. Here is exactly what we keep and when it is deleted:

• Account and profile data: Retained while your account is active. Permanently deleted when you delete your account (see below).
• Lab session scores and results: Retained while your account is active. Deleted with your account.
• Certificates: Kept while your account is active, so their codes keep verifying. Deleted with your account; after that their codes no longer verify.
• Interview transcripts and AI assistant logs: Kept with the assessment record while your account is active, so results can be reviewed or disputed. Deleted with your account. Interview audio is never stored.
• Webcam snapshots: Automatically and permanently deleted 7 days after the session they were captured in. An automated deletion job runs every hour to enforce this and removes every stored copy of the image. You may also request immediate deletion by contacting privacy@skillcertify.io.
• Account deletion: When you delete your account, your profile, skills, sessions, assessment results, certificates, interview transcripts, AI assistant logs, messages, snapshots and snapshot files are permanently deleted immediately. We keep only the record of your webcam proctoring consent (date, IP address and browser), as proof of consent, and AI usage counters used for billing, which contain no content. Copies in database backups expire as described below. Results an organization already copied into its own systems (see Section 5) are controlled by that organization. Deletion is irreversible.
• Organization integration records: Webhook delivery logs are deleted after 30 days. The record of an invitation an organization sent through its integration (email, name and its own reference) belongs to that organization's account.
• Payment records: Kept by Stripe, our payment processor, for the period required by tax law. Card details never reach our servers.
• Backup copies: Encrypted database backups are taken every 2 hours and kept for up to 90 days for disaster recovery. After account deletion, your data is absent from new backups within 2 hours, and older backup copies containing it expire 90 days after they were taken. Backups do not contain webcam images.

7. Your Rights

Under GDPR and applicable data protection laws, you have the following rights. All of these can be exercised directly in your account or by emailing privacy@skillcertify.io:

• Access (Article 15): Request a copy of all personal data we hold about you.
• Portability (Article 20): Request a machine-readable (JSON) copy of the personal data you provided by emailing privacy@skillcertify.io. We respond within the time required by applicable law — generally within 30 days, which may be extended for complex or numerous requests to the extent the law permits. A self-service export button is not yet available.
• Rectification (Article 16): Correct inaccurate data directly in your profile settings.
• Erasure / Right to be Forgotten (Article 17): Delete your account immediately from your profile page (Delete Account). Your profile, results, certificates, transcripts, AI assistant logs, messages and webcam snapshot files are permanently removed. We keep only your proctoring consent record (as proof of consent) and content-free AI usage counters; payment records are kept by Stripe as tax law requires; backup copies expire as described in Section 6.
• Restriction (Article 18): Request that we restrict processing of your data in certain circumstances. Contact us by email.
• Objection (Article 21): Object to processing based on legitimate interests. Contact us by email.
• Withdraw Consent: Switch off marketing and engagement emails at any time in the email preferences on your profile or settings page, or with the unsubscribe link. To take your profile off public pages, use Hide my profile on your profile page. To withdraw other consent, email privacy@skillcertify.io.
• Lodge a Complaint: You have the right to lodge a complaint with your national data protection authority (e.g., the ICO in the UK, the AEPD in Spain, the CNIL in France).

8. Data Security

We implement technical and organizational security measures proportionate to the risk:

• All data in transit is encrypted with TLS 1.2+.
• Passwords are hashed with bcrypt — we cannot recover your password.
• Webcam snapshots are stored in private object storage — they are not publicly accessible and require authenticated API access to retrieve.
• Assessment sessions run in isolated, single-use environments that are destroyed after completion — no session data persists in the compute environment.
• Access to production data is restricted to authorized personnel only.

9. International Transfers

Our primary infrastructure is hosted in the United States (Hostinger, Boston, Massachusetts). Anthropic Claude, Google Gemini and OpenAI (AI processing), ElevenLabs (interview voice and speech-to-text), Amazon Web Services (object storage for snapshots and encrypted backups), Stripe (payments), Resend (transactional email), and — with your cookie consent — Google Analytics and Microsoft Clarity all process data in the United States. For users in the EU/EEA and the UK, we rely on the EU-US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses (SCCs) as part of the data processing agreements we are putting in place with each provider.

10. Cookies

We use essential cookies — authentication tokens (JWT) and session cookies required for the platform to function — which are always active. With your consent we also use analytics cookies: Google Analytics 4 (traffic measurement) and Microsoft Clarity (heatmaps and session replay of how pages are used). These load only after you choose "Accept All" in the cookie banner; if you choose "Essential Only", or make no choice, they are not loaded. We also store first-party attribution data in your browser (referral source and landing page) so we can tell how you found us; this is linked to your account if you register. We also count visits ourselves, without cookies: a random visit id kept only for the open browser tab (it is deleted when you close it) links the pages of one visit, and we record which pages were viewed, which playgrounds were used and for how long, which buttons were clicked and the referring website. No IP address, browser details or account are stored with these events, they are used only in aggregate to improve the platform, and they are deleted after 13 months. We do not use advertising cookies and we do not sell any of this data. You can change your choice at any time by clearing the skillcertify_cookie_consent value in your browser storage.

11. Children

SkillCertify is only for people aged 18 or older, as our Terms of Service require. We do not knowingly collect personal data from children. If you believe a child has registered, please contact us immediately at privacy@skillcertify.io.

12. Changes to This Policy

We will notify you by email and via a notice on the platform of any material changes to this policy, and will give reasonable advance notice (where practicable, at least 30 days) before they take effect. The "Last updated" date at the top of this page reflects the most recent revision. Archived versions are available upon request.

13. Contact Us

For any questions about this Privacy Policy or to exercise your data rights:

• General privacy enquiries: privacy@skillcertify.io
• Data Protection Officer: dpo@skillcertify.io

We aim to respond to all requests within 30 days. For complex requests we will keep you informed of progress.