1. Overview
The General Data Protection Regulation (GDPR) gives people in the European Economic Area (EEA) and the United Kingdom specific rights over their personal data. This page summarizes those rights, the legal bases on which SkillSaber processes personal data, and how to exercise your rights. It supplements our Privacy Policy, which describes in detail what we collect and why.
2. Legal Bases for Processing
We process personal data under the following legal bases:
- Contract: to create and operate your account, deliver courses and AI study tools you use, and process payments you make.
- Legitimate interests: to keep the Services secure, prevent fraud and abuse, and understand aggregate usage so we can improve the product.
- Consent: for optional communications such as engagement and marketing emails. You can withdraw consent at any time from your email preferences or the unsubscribe link in any such email.
- Legal obligation: to keep records we are required to retain, such as billing and tax records.
3. Your Rights
If you are in the EEA or UK, you have the right to:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — ask us to delete your data ("right to be forgotten").
- Restriction — limit how we process your data in certain circumstances.
- Portability — receive your data in a structured, commonly used, machine-readable format.
- Objection — object to processing based on legitimate interests or to direct marketing.
- No automated decision-making — not to be subject to decisions with legal or similarly significant effects made solely by automated means. Our AI features personalize learning content; they do not make such decisions about you.
4. How to Exercise Your Rights
- Self-service: you can update your profile in Settings, manage email preferences from Settings → Email Notifications, and delete your account (and its data) directly from the app.
- By email: send requests to privacy@skillsaber.org. We may need to verify your identity before acting on a request. We respond within one month, as the GDPR requires; complex requests may take up to two additional months, in which case we will tell you.
5. International Data Transfers
Our infrastructure providers may store and process data outside the EEA/UK, including in the United States. Where data leaves the EEA/UK, we rely on safeguards recognized by the GDPR, such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework certifications of our providers.
6. Complaints
If you believe we have not handled your personal data properly, please contact us first at privacy@skillsaber.org so we can try to resolve it. You also have the right to lodge a complaint with your local data protection supervisory authority.