Privacy policy
What personal data CoreSkill collects, why, on what legal basis, who else touches it, how long it is kept, how it is protected, and the rights you can exercise over it under Vietnamese law.
Effective 22/9/2026
No lawyer has reviewed this text
This policy describes what the software actually does, and the technical statements in it are accurate. The legal framing has not been reviewed by a lawyer or a data protection officer. Before Core Skill relies on it with real customers, a qualified person must check it against Decree 13/2023/ND-CP and the Law on Personal Data Protection.
This policy covers Core Skill, registered at coreskill.app, which operates the CoreSkill service. It explains how personal data is handled at CoreSkill. It sits alongside the Cookie policy, which covers what is stored in your browser, and the Data processing addendum, which is the binding contract for data that belongs to a customer organization.
Two roles, and why the difference matters
- Core Skill as controller
- For your account itself: name, email address, password, two-factor settings, sign-in history, language. Core Skill decides why and how this data is processed, and this policy governs it. Write to [email protected] to exercise your rights over it.
- Core Skill as processor
- For everything inside a business: members, departments, job titles, skills, keys and MCP logs. Here the customer organization decides, and Core Skill only follows its instructions. If you are an employee asking about this data, ask your own organization first: they control it, and they can answer faster than we can.
What is collected, and why
| Category | Examples | Why it is needed | Source |
|---|---|---|---|
| Account | Name, email address, password (stored only as a bcrypt hash), language, system role. | To create the account, sign you in, and address you correctly. | You, at registration |
| Security | Two-factor secret (encrypted), hashes of recovery codes, one-time verification codes (hashes only), the moment sessions were last revoked. | To protect the account, and to cut off stolen sessions when a password changes. | You, when you enable them |
| Membership | Which business you belong to, your role, your department, your free-text job title, and whether the membership is active or suspended. | To decide which skills your AI assistant is allowed to read. | Your organization |
| Keys | The key prefix, a hash of the key, the name it was issued under, the expiry and revocation dates. Never the real key. | To authenticate MCP calls and to let a key be revoked. | Generated by the system |
| MCP logs | IP address, client user agent, tool name, status, duration, a summary of the call, the member and the department name at the time of the call. | So an organization can see who used which skill, and so abuse and leaked keys can be detected. | Generated on each call |
| Content you upload | Skills, attached files, server and department names. These may contain personal data if you put it there. | This is the service itself: storing your instructions and delivering them to the right people. | Your organization |
| Correspondence | Emails you send to support, and invitations addressed to an email address. | To answer you, and to let a colleague join a business. | You, or the person inviting you |
What is deliberately not collected
- No payment data. The product has no payment features at all, so there are no card numbers anywhere in it.
- No advertising or behavioral profile. There is no analytics suite, no advertising pixel and no session recorder in the application.
- No plain-text password, and no plain-text key. Both are stored only as hashes. Nobody at Core Skill can read them back, which is also why a lost key can only be replaced, never recovered.
- No sensitive personal data is asked for. CoreSkill never requests health, biometric, political, religious or financial data. If an organization puts such data inside a skill, it does so on its own responsibility and under the Data processing addendum.
- No content of your AI conversations. CoreSkill sees which skill was requested, not what you and your assistant then discussed.
The legal basis for processing
Under Decree 13/2023/ND-CP on personal data protection, processing normally requires the consent of the data subject, with a limited set of cases where it may proceed without it. Core Skill relies on the following:
- Performance of a contract with you. Account data, membership, keys and the delivery of skills all exist because you asked for the service. Without them there is no service.
- Your consent. Optional items only: connecting a Google or Facebook account for sign-in, and enabling two-factor authentication. Consent can be withdrawn at any time, and withdrawing it removes the feature rather than the account.
- Legitimate interest in the security of the service. Rate-limit counters, MCP logs and audit logs exist to detect leaked keys, abuse and intrusion. This interest is balanced by keeping them short-lived and minimal.
- Legal obligation. Where a competent Vietnamese authority makes a lawful, written request, Core Skill must comply. The scope of any such disclosure is kept to what the request actually requires.
Who else touches the data
Core Skill does not sell personal data and does not share it for anyone else's marketing. The following providers process data because the service cannot run without them. Each is bound by its own contract and processes only what its function requires.
| Provider | Function | Location | What it can see |
|---|---|---|---|
| DigitalOcean | The virtual server and its disks, on which the application and the database run. | Singapore | Everything stored, at the infrastructure level. This is the provider closest to your data. |
| Cloudflare | DNS, TLS termination at the edge, protection against attack. | Global edge network | Traffic metadata: IP addresses, requested URLs, user agents. Not the contents of the database. |
| Optional: sign-in with a Google account, and sending system email through Gmail. | Global | Only if an administrator enables it: the email address used to sign in, and the content of messages the system sends. | |
| Email provider | Delivering verification codes, password resets and invitations, where an SMTP provider is configured instead of Gmail. | As configured by the administrator | Recipient addresses and the content of those messages. |
Data leaves Vietnam, and what that requires
The server is in Singapore and Cloudflare operates a global network, so personal data is transferred outside Vietnam. Decree 13/2023/ND-CP requires the party transferring it to prepare a cross-border transfer impact assessment dossier, keep it available, and notify the Ministry of Public Security. Core Skill is responsible for preparing that dossier for the transfers listed above. A customer whose own transfers go further must prepare its own.
How long data is kept
| Data | Kept for | Then what |
|---|---|---|
| Account | As long as the account exists. | Deleted when you delete the account. |
| Business content: skills, files, members, departments | As long as the business exists. | Deleting a business deletes all of it, and cannot be undone. |
| MCP logs | The retention period set by the system administrator, 90 days by default. | Purged automatically by a scheduled job; an administrator can also purge them on demand. |
| One-time email codes | 10 minutes. | Deleted on use, and expired ones are removed by the same scheduled job. |
| Invitations | 7 days, single use. | Expire on their own; can be revoked earlier. |
| Revoked or expired keys | The row is kept so that past log entries still have a name to point at. | Removed when the business is deleted. The key itself was never stored. |
| Backups | 14 days on a rolling basis. | Overwritten automatically as they age out. |
How the data is protected
- Passwords are stored with bcrypt at cost 12. Keys are stored as SHA-256 hashes with a secret pepper and compared in constant time, so a stolen database yields no usable key.
- Two-factor secrets are encrypted with AES-256-GCM using a key held separately from the session signing key.
- Skill content can be encrypted at rest with AES-256-GCM. This protects against a leaked backup, a stolen disk or a database read, and it does not protect against the operator of the server, who necessarily holds the key.
- All traffic runs over HTTPS, and the origin server accepts connections only from Cloudflare's network. Direct connections to the server's IP address are refused.
- The database is not reachable from the internet. It speaks only to the application over a private network, and no port is published to the host.
- Rate limits apply to sign-in, to password reset and to both MCP endpoints, which blunts password guessing and key guessing.
- Changing a password revokes every existing session, so somebody already inside the account is thrown out rather than left there.
No system is perfectly secure
The measures above reduce risk; they do not eliminate it. If a breach occurs that is likely to affect your rights, Core Skill will notify the affected customers and the Ministry of Public Security within 72 hours of becoming aware of it, as Decree 13/2023/ND-CP requires, and will say what happened and what to do about it.
Your rights
Decree 13/2023/ND-CP gives you the following rights over your personal data. Exercise them by writing to [email protected]. Core Skill will respond within 72 hours of receiving a request, as the Decree requires, and will verify your identity first so that nobody can use these rights to reach somebody else's data.
- To be informed about how your data is processed, which is what this page is for.
- To consent, and to know what you are consenting to, before optional processing begins.
- To access your data and obtain a copy of it.
- To correct data that is wrong or out of date. Most of it you can edit yourself in Settings.
- To withdraw consent for any processing that rests on consent, without that affecting what was lawful before.
- To have your data deleted, subject to what the law requires Core Skill to keep.
- To restrict processing while a dispute about accuracy or lawfulness is being resolved.
- To object to processing that rests on legitimate interest, giving your reasons.
- To complain, to denounce and to sue under the law.
- To claim compensation for damage caused by unlawful processing.
- To defend yourself, including by asking a competent authority to protect your rights.
If your request concerns data inside a business, meaning your membership, your job title, your keys or your MCP log entries, then the customer organization is the controller and Core Skill will pass the request to it and assist it in answering. This is not a way of avoiding the question: it is who actually holds the decision.
Children
CoreSkill is a tool for work and is not directed at anyone under 18. Core Skill does not knowingly collect data about children. Under Vietnamese law, processing the data of a child under 16 requires the consent of a parent or guardian. If you believe a child has created an account, write to [email protected] and it will be deleted.
Marketing
Core Skill sends only service email: verification codes, password resets, invitations and notices about the service. There is no marketing list, and your address is never passed to anyone for their own marketing. If commercial email is introduced later, it will be opt-in, and every message will carry a way to unsubscribe.
Changes to this policy
When this policy changes, the new version is published here with a new effective date. Changes that materially affect your rights will be notified by email at least 15 days in advance where that is practicable, so that you have time to object or to stop using the service.
Complaints and contact
For anything about personal data, write to [email protected], or by post to Core Skill, coreskill.app. For everything else, [email protected]. If you are not satisfied with the answer, you may complain to the competent authority, which in Vietnam is the Department of Cybersecurity and High-tech Crime Prevention (A05) of the Ministry of Public Security. This policy is governed by the law of Core Skill and takes effect on 22/9/2026.