Privacy Policy

1. Information We Collect

When you register an account, publish content, or use the Skillhalla platform, we may collect the following information:

• Account information: username, email address, password (encrypted)
• Profile information: avatar, bio, creator status
• Usage data: browsing history, search history, download history, purchase history
• Content data: skill packages, reviews, and ratings you publish
• Payment information: transaction records, account balance (we do not store credit card or payment card details directly; payments are securely processed by third-party service providers)
• Technical data: IP address, browser type, device information, cookies

2. How We Use Your Information

We use the collected information for the following purposes:

• To provide, maintain, and improve the Skillhalla platform
• To process transactions and payments, and manage your account balance
• To send important notifications (service updates, security alerts)
• To provide customer support and respond to your inquiries
• To detect and prevent fraud, abuse, and illegal activities
• To comply with legal obligations and legitimate law enforcement requests

Our legal bases for processing your personal information include: your consent, necessity for the performance of a contract, compliance with legal obligations, and our legitimate business interests (provided these do not override your data protection rights).

3. Cookies & Tracking

We use essential cookies to maintain your session with Skillhalla (e.g., login state, language preferences). We may use analytics cookies to understand how users interact with the Platform (e.g., page visits, traffic sources). You can manage or disable cookies in your browser settings, though this may affect some functionality. For more details, please see our Cookie Notice.

4. Third-Party Services

We use the following third-party services to process certain platform functions:

• Creem (creem.io) — Merchant of Record for global payment processing, tax calculation, and compliance. Creem independently collects and processes your payment card information; see creem.io for their privacy policy.
• Paddle (paddle.com) — Backup Merchant of Record, providing payment processing in certain regions or circumstances. See paddle.com for Paddle's privacy policy.
• PostgreSQL / Redis / MinIO — Data storage and caching infrastructure (self-hosted; data does not leave our servers)

We do not sell your personal information to third parties.

5. Data Security

We employ industry-standard security measures to protect your data, including:

• All passwords are hashed and stored using bcrypt
• API communication uses JWT token authentication with 15-minute access token expiry
• HTTPS encryption enforced in production
• Parameterized database queries to prevent SQL injection

Please note that no online service can guarantee 100% security.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy. When you delete your account, we will delete or anonymize your personal data within 30 days, unless a longer retention period is required by law. Public content you have published (such as skill packages) may remain on the platform after account deletion.

7. Your Data Protection Rights

Under applicable data protection laws (including GDPR), you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete personal data
• Right to erasure ("right to be forgotten") — request deletion of your personal data, subject to legal retention requirements
• Right to restrict processing — request restriction of processing of your data under certain circumstances
• Right to data portability — request export of your data in a structured, commonly used, machine-readable format
• Right to object — object to our processing of your data under certain circumstances, including for direct marketing
• Right to withdraw consent — where we process data based on your consent, you may withdraw that consent at any time; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal
• Right to lodge a complaint — you have the right to lodge a complaint with a data protection supervisory authority in your place of residence or work

To exercise any of these rights, please contact us using the information below. We will respond to your request within 30 days.

8. Children's Privacy

Skillhalla is not intended for children under the age of 16 (or the equivalent digital age of consent in your jurisdiction, such as 13 in the United States). We do not knowingly collect personal information from children below this age threshold. If we discover such information has been collected inadvertently, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

9. International Data Transfers

Your information may be processed and stored on servers located outside your country of residence. We will take appropriate safeguards to ensure such transfers comply with applicable data protection laws.

10. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated to you via email or platform notification. Continued use of Skillhalla constitutes acceptance of the updated policy.

11. Contact & Data Protection

If you have any questions or concerns about this privacy policy, or wish to exercise your data protection rights, please contact us at:

Email: support@skillhalla.com

Website: https://skillhalla.com

For data protection inquiries, please contact our privacy team at: support@skillhalla.com

If you are an EU resident: we will designate a data protection representative in the EU as required under GDPR Art. 27, and will publish their contact details on this page when appointed. Until then, you may contact our privacy team via the email above for data protection matters. You always have the right to lodge a complaint with the data protection supervisory authority in your country.