Privacy policy
What personal data CoreSkill collects, why, on what legal basis, who it is shared with, how long it is kept, how it is protected, and the rights you have wherever you are.
Effective 22/9/2026
This policy explains how Core Skill, registered at coreskill.app, handles personal data in connection with the CoreSkill service. It applies to visitors, account holders and the members of customer organizations worldwide. It should be read with the Cookie policy and the Data processing addendum, which governs data that belongs to a customer organization.
1. Two roles, and why the difference matters
- Core Skill as controller
- For your account itself and for our own business records: name, email address, password hash, two-factor settings, language, sign-in and security events, consent records, billing records, correspondence with us, and the data collected by the analytics and advertising tools described in section 6. Core Skill decides why and how this data is processed, and this policy governs it.
- Core Skill as processor
- For everything inside a customer's business: members, departments, job titles, skills, attached files, keys and MCP logs. The customer organization is the controller and Core Skill processes this data only on its instructions, under the Data processing addendum. If you are a member asking about this data, contact your organization first: it decides, and Core Skill will help it respond.
2. What is collected
| Category | Examples | Source |
|---|---|---|
| Account | Name, email address, password (stored only as a bcrypt hash), language, system role. | You, at registration |
| Consent records | Which version of the Terms and this policy you accepted, when, and whether you opted in to marketing email. | You, at registration and in settings |
| Security | Two-factor secret (encrypted), hashes of recovery codes, one-time verification codes (hashes only), sign-in attempts, session revocation times. | You, and the system |
| Third-party sign-in | If you choose to sign in with Google or Facebook: your name, email address and account identifier with that provider. | The provider you choose |
| Membership | The businesses you belong to, your role, department, position, level and free-text job title, and whether the membership is active. | Your organization |
| Keys | The key prefix, a hash of the key, its name, who issued it, its expiry and revocation dates. Never the real key. | Generated by the system |
| MCP usage logs | IP address, client name and user agent, timestamps, tool called, status, duration, a short summary of the request, and the member and department at the time of the call. | Generated on each call |
| Customer content | Skills, attached files, server and department names. These may contain personal data if an organization puts it there. | Your organization |
| Billing | When a paid plan is purchased: the order, amount, currency, plan, payer name and email, and the payment provider's transaction reference. No full card numbers. | You, and the payment provider |
| Technical and correspondence | IP address and browser data in server and security logs, cookies described in the Cookie policy, and messages you send to support. | Your browser, and you |
| Analytics and advertising | Only when the relevant tool is switched on and your choices allow it: cookie identifiers (such as _ga, _fbp, _fbc, _ttp), device and browser information, IP address, the pages you view and the referring page, and ad click identifiers (gclid, fbclid, ttclid). For the sign-up event: a SHA-256 hash of your email address and of your account ID. | Your browser, through the Google, Meta and TikTok tags; and our server, for the sign-up event |
3. What is deliberately not collected
- No payment card data. Card and bank details are entered with the payment provider, not with CoreSkill.
- No session recording and no reading of your work. There is no session recorder. Where analytics and advertising tools are switched on, they never receive skill content, attached files, keys or MCP logs, and they are never loaded on administrative pages.
- No plain-text password and no plain-text key. Both are stored only as hashes, so a lost key can only be replaced, never recovered.
- No special categories of data are requested. CoreSkill never asks for health, biometric, political, religious or similar data. If an organization puts such data in a skill, it does so under its own responsibility and the Data processing addendum.
- No content of your AI conversations. CoreSkill sees which skill was requested, not what you and your assistant then discussed.
4. Purposes and legal bases
Where the EU or UK General Data Protection Regulation (GDPR) applies, Core Skill relies on the legal bases in Article 6 shown below. Where other laws, such as Vietnam's personal data protection law, require consent for a purpose, that consent is obtained when you register or before the processing starts.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your account, signing you in, delivering skills to valid keys | Account, security, membership, keys, customer content | Contract (Art. 6(1)(b)), and your consent where local law requires it |
| Sending service email: verification codes, security alerts, invitations, keys, billing and legal notices | Name, email address, language | Contract (Art. 6(1)(b)); these emails are part of the service |
| Keeping the service secure: rate limits, usage logs, audit logs, abuse and fraud detection | MCP usage logs, security, technical data | Legitimate interests (Art. 6(1)(f)) in protecting the service and its users |
| Processing payments and keeping accounting records | Billing, account | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Optional features: third-party sign-in, marketing email | Third-party sign-in, name, email address | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Measuring visits and the effectiveness of our marketing and advertising, and showing our ads to people who may be interested, with Google, Meta and TikTok tools (section 6) | Analytics and advertising | Consent (Art. 6(1)(a)), asked before these tools run in the EEA, the UK and Switzerland. Where local law does not require prior consent, they run by default and you can refuse or withdraw at any time in Cookie settings |
| Responding to lawful requests and establishing or defending legal claims | Only what the request or claim requires | Legal obligation (Art. 6(1)(c)) or legitimate interests (Art. 6(1)(f)) |
| Understanding how the service performs, using aggregated statistics that identify nobody | MCP usage logs, technical data | Legitimate interests (Art. 6(1)(f)) in improving the service |
5. Your consent when you sign up
When you create an account you are asked to confirm, with separate boxes, what you agree to. Core Skill records the version of the documents you accepted and the time of acceptance.
- Terms and this policy. You accept the Terms of service and confirm you have read this Privacy policy. Without this, no account can be created.
- Your name and email address are stored so that CoreSkill can create your account, sign you in, identify you to your organization and contact you about your account.
- Service email is necessary for the service and does not depend on marketing consent: one-time codes, security notices, invitations, keys issued to you, billing messages and notices of changes to these documents. You cannot switch these off while the account exists.
- No marketing or promotional email is sent without your separate, opt-in consent. CoreSkill does not currently send marketing email at all. If that ever changes, you will be asked first, the choice will never be pre-selected for you, and saying no will not affect your use of CoreSkill.
- Analytics and advertising are a separate choice, made in the cookie banner and in Cookie settings, not in the sign-up form. Refusing them does not affect your use of CoreSkill.
- You can withdraw consent at any time: use the unsubscribe link that any marketing message would carry, or write to [email protected]. Withdrawal does not affect processing that took place before it, and withdrawing consent to the Terms means closing the account.
6. Analytics and advertising
Core Skill may use Google Tag Manager (with Google Analytics and Google Ads tags), the Meta Pixel with the Meta Conversions API, and the TikTok Pixel with the TikTok Events API to understand how people find and use CoreSkill and to measure and improve its marketing and advertising. Each tool is optional and is used only if it has been switched on for the service. The Cookie policy lists the cookies involved and their lifetimes.
- Your choice comes first. In the European Economic Area, the United Kingdom, Switzerland, and wherever your location cannot be determined, these tools stay off until you accept them in the cookie banner. Elsewhere they are on by default and you can refuse them. You can change your mind at any time in Cookie settings, linked at the foot of the public pages and, where these tools also run in the signed-in app, in your account settings.
- Where they run. On the public pages and, only if enabled, in the signed-in app. They are never loaded on administrative pages, on the API and MCP endpoints, or on invitation, password-reset and email-verification pages.
- What your browser sends. Cookie identifiers, device and browser information, IP address, the page viewed and the referring page, and ad click identifiers. In the signed-in app, page addresses are reduced to a generic pattern such as
/b/[slug]/servers/[id], so that no business, server or skill identifier is sent. Skill content, attached files, keys and MCP logs are never sent to these providers. - The sign-up event is also sent from our server. When you complete registration and advertising consent is in effect, our server sends a registration event directly to Meta and TikTok, if those integrations are on. It contains a SHA-256 hash of your email address, a hash of your account ID, your IP address and browser user agent, the relevant cookie and click identifiers, the time, the page address and a random event ID that lets the provider count the browser and server reports once. Without advertising consent nothing is sent this way, and page views are only ever sent from your browser.
- A hash is not anonymous. The providers can match a hashed email address with accounts they hold; that is the purpose of sending it. CoreSkill does not pass your email address, hashed or not, to the Meta and TikTok pixels in your browser; it is sent only in the server event above.
- The providers' role. Depending on the tool and on the provider's business terms, a provider may act as a processor for Core Skill, as a joint controller with Core Skill for collecting and transmitting the data, or as an independent controller for its own processing, such as improving its advertising systems. For data collected through the Meta Pixel and the Conversions API, Meta's business terms treat Core Skill and Meta as joint controllers for that collection and transmission, and Meta as responsible for its own processing afterwards. Each provider's use of the data is also governed by its own privacy policy.
7. Who receives the data
Core Skill does not sell personal data for money. Where the advertising tools in section 6 are active, disclosing identifiers to advertising providers may count as "sharing" for cross-context behavioral advertising, or as a "sale", under some US state laws; section 11 explains how to opt out. Otherwise, personal data is disclosed only to the following categories of recipient. Service providers are bound by contract to process it only for the stated function and to protect it; analytics and advertising providers use it as described in section 6.
| Recipient | Function | Data involved |
|---|---|---|
| Cloud hosting infrastructure | Hosting the application, the database and backups on reputable cloud infrastructure. | All stored data, at the infrastructure level, encrypted in transit. |
| Network and security services | Domain name service, content delivery, TLS and protection against attacks. | Traffic metadata such as IP address, requested URL and user agent. |
| Email delivery | Sending service email such as codes, invitations, keys and notices. | Recipient address, name and message content. |
| Sign-in providers | Google or Facebook, only if you choose to sign in with them. | The data exchanged during that sign-in. |
| Payment providers | SePay (VND) and PayPal (USD), only when a paid plan is purchased. | Order reference, amount and payer details needed to complete the payment. |
| Analytics and advertising providers | Google (Tag Manager, Analytics, Ads), Meta Platforms (Pixel, Conversions API) and TikTok (Pixel, Events API), only if the tool is switched on and your choices allow it. | The data described in section 6. |
| Advisers, authorities and successors | Lawyers and auditors under confidentiality; authorities making a lawful request; a successor in a merger or acquisition. | Only what is necessary for that purpose. |
The current list of sub-processors, with the country where each processes data, is kept up to date and is available on request from [email protected]. Customers are notified of changes as described in the Data processing addendum.
8. International transfers
CoreSkill serves customers worldwide, so personal data may be processed in countries other than the one where you live, including countries whose data protection laws differ from yours. Where the law requires it, Core Skill puts appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or reliance on an adequacy decision, and completes any transfer assessment or filing that the applicable law requires. Google, Meta and TikTok process the data they receive through the tools in section 6 in several countries, including the United States; those transfers rely on the safeguards each provider offers under its own terms, such as Standard Contractual Clauses or an adequacy mechanism. You can ask for a copy of the relevant safeguards at [email protected].
9. How long data is kept
| Data | Kept for | Then |
|---|---|---|
| Account | As long as the account exists. | Deleted when you delete the account, subject to the backup cycle below. |
| Business content: skills, files, members, departments | As long as the business exists. | Deleting a business deletes all of it immediately, and cannot be undone. |
| MCP usage logs | The retention period set by the system administrator, 90 days by default. | Purged automatically by a scheduled job. |
| One-time email codes | 10 minutes. | Deleted on use or expiry. |
| Invitations | 7 days, single use. | Expire on their own and can be revoked earlier. |
| Consent records | As long as the account exists, and afterwards for as long as needed to prove consent was given. | Deleted when no longer needed as evidence. |
| Billing records | As long as accounting and tax law requires, even after the business is deleted. | Deleted at the end of the statutory period. |
| Backups | Up to 14 days on a rolling basis. | Overwritten automatically as they age out. |
| Analytics and advertising | Cookies for the lifetimes in the Cookie policy (for example _ga up to 2 years, _fbp typically 90 days, _ttp 13 months), and your cookie choice for 12 months. Data received by Google, Meta and TikTok is kept under their own retention policies and settings. | Cookies expire or can be deleted in your browser; withdrawing consent stops new data from being sent. |
10. How the data is protected
- All traffic is encrypted in transit with HTTPS (TLS).
- Passwords are hashed with bcrypt. Keys are stored as SHA-256 hashes with a secret pepper and compared in constant time, so a copy of the database yields no usable password or key.
- Two-factor authentication is available to every account, and two-factor secrets are encrypted with AES-256-GCM.
- Skill content can be encrypted at rest with AES-256-GCM. This protects against a leaked backup, a stolen disk or a database read.
- Access controls based on role and department are evaluated on every request, and the database is not exposed to the public internet.
- Audit logs record administrative actions, and rate limits protect sign-in, password reset and the MCP endpoints.
- Changing a password or a role revokes existing sessions, and staff access to production data is limited to what their work requires.
If a personal data breach occurs that is likely to affect your rights, Core Skill will notify the affected customers and, where the law requires it, the competent supervisory authority, within the time the applicable law sets (for example, within 72 hours under the GDPR), and will explain what happened and what you can do.
11. Your rights
| Where you are | Your rights |
|---|---|
| Everywhere | To access and obtain a copy of your data, to correct it, to have it deleted, and to withdraw consent, including consent to analytics and advertising at any time in Cookie settings. Most account data can be edited directly in Settings. |
| European Economic Area, United Kingdom, Switzerland | Under the GDPR: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, withdrawal of consent, and the right to lodge a complaint with your supervisory authority. |
| California and other US states with privacy laws | Under the CCPA/CPRA and similar laws: to know what is collected and how it is used, to delete, to correct, and to opt out of the sale or sharing of personal information, including for cross-context behavioral advertising. Core Skill does not sell personal information for money, but where the advertising tools in section 6 are active, disclosing identifiers to advertising providers may count as a sale or sharing under these laws. Your privacy choices: you can opt out at any time by switching off advertising in Cookie settings, at the foot of the public pages and, where these tools also run in the signed-in app, in your account settings. Core Skill will not discriminate against you for exercising any right. |
| Vietnam | Under Vietnam's personal data protection law: to be informed, to consent and withdraw consent, to access, correct and delete, to restrict and object to processing, to complain, denounce and sue, to claim compensation, and to self-protection. |
| Other countries | The rights your local law grants. Core Skill will honor them to the extent that law applies. |
12. How to exercise your rights
- Write to [email protected] from the email address on your account, saying which right you want to exercise.
- Core Skill will verify your identity before acting, so that nobody can use these rights to reach somebody else's data. You may use an authorized agent where your law allows it.
- Core Skill will respond within one month (extendable by two further months for complex requests, with notice) under the GDPR, within 45 days under the CCPA, and within any shorter period your local law requires.
- Requests are handled free of charge, unless they are manifestly unfounded or excessive.
- If your request concerns data inside a business, such as your membership, keys or MCP log entries, Core Skill will pass it to the customer organization that controls that data and help it respond.
13. Children
CoreSkill is a business tool and is not directed at children under 16. Core Skill does not knowingly collect data about them. If you believe a child has provided personal data, write to [email protected] and it will be deleted.
14. Automated decision-making
Core Skill does not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects. Automatic security controls, such as rate limits and blocking a revoked key, apply the rules your organization or the service has set and can be reviewed by a person on request.
15. Changes to this policy
When this policy changes, the new version is published here with a new effective date. Material changes are notified by email or in the product at least 30 days in advance where practicable, and where the law requires it you will be asked for fresh consent.
16. Contact
For anything about personal data, write to [email protected], or by post to Core Skill, coreskill.app. For everything else, [email protected]. If you are not satisfied with the answer, you may complain to the data protection authority where you live or work. This policy takes effect on 22/9/2026.