Privacy Policy (GDPR)
Last updated: 28 September 2025
1) Who we are
Controller: [SkillTier e.U. or your legal name], [street, city, country].
Contact: team@skill-tier.com (support).
If you appoint a DPO: [DPO name + email].
2) What we collect
Account data: name, email, password hash (if accounts are enabled).
Purchase data: payment status, amount, currency. Card details are processed by Stripe; we do not store full card numbers.
Test data: your answers, timings, and generated report. The engine records per-question response time and aggregates them into report metrics.
Open-answer grading logs: item id, backend type, JSON grader output or heuristic score, response-time in ms, timestamp. Logged to llm_open_log.jsonl.
Reports: an HTML and a JSON file are generated for each session.
Technical logs: server/hosting logs (IP address, user agent, timestamps).
Cookies/Local Storage: for session, checkout, and analytics (see Cookie Policy).
3) How we use data + legal bases (Art. 6 GDPR)
Provide the test, scoring, and report: contract performance (6(1)(b)).
Payments and receipts: contract and legal duties (6(1)(b),(c)).
Emailing receipts and account messages: contract and legitimate interests (6(1)(b),(f)).
Improve test quality and security, prevent abuse: legitimate interests (6(1)(f)).
Optional analytics/marketing: consent (6(1)(a)).
Compliance with law and requests: legal obligation (6(1)(c)).
4) Sharing and processors
We use vetted processors to run the service:
Hosting/CDN/app platform: [Vercel/Render].
Payments: Stripe (controller for card data).
Email delivery: [Resend] if enabled.
AI grading for open answers: Azure OpenAI if you toggle the Azure backend; your open-text answers may be sent to your Azure deployment for rubric scoring.
Contracts (DPAs + SCCs) are in place with processors when required.
5) International transfers
If processors store or access data outside the EEA, we use adequacy decisions or the EU Standard Contractual Clauses.
6) Retention
Test reports and grading logs: kept to provide your history and audit. Default: [12 months] unless you delete earlier. llm_open_log.jsonl is for debugging and quality control.
Payments: as required by tax law (typically 7–10 years).
Support emails: [24 months].
We delete or anonymize after expiry.
7) Your rights
Access, rectification, erasure, restriction, portability, and objection. Withdraw consent any time. File a complaint with the Austrian Data Protection Authority. Contact us to exercise rights.
8) Automated scoring and profiling
The service produces domain scores from your answers and timings using an adaptive algorithm; open answers can be graded by an LLM when enabled. You may request an explanation and human review of a result.
9) Children
Minimum age 16 for consent to data processing in the EU. Under 18 may require a parent/guardian to contract depending on jurisdiction.
10) Security
We use access controls, encrypted transport, and least-privilege practices. You must keep your account secure.
11) Changes
We will update this policy as needed. Material changes will be notified in-app or by email.