Privacy Policy
Version 1.1 · Effective 2026-07-24
Data we collect
| Category | Purpose | Storage |
|---|---|---|
| Email (optional) | Save and retrieve progress; newsletter if opted in | Supabase |
| PIN hash (optional) | Authenticate progress retrieval | Supabase |
| Exam sittings and scores | Grade practice, show history | Supabase / local device |
| Leaderboard entries | Public rankings of timed mocks | Supabase |
| Newsletter opt-in | Product updates you requested | Supabase / email provider |
| Operational telemetry | Reliability and abuse prevention | Hosting / logs |
| Analytics (optional) | Aggregate product usage — only if you accept | Analytics provider |
Sub-processors
| Processor | Role | Region notes |
|---|---|---|
| Supabase | Database and auth storage | US/EU (project config) |
| Vercel | Hosting and edge network | US / global edge |
| PostHog | Product analytics (only if you accept analytics cookies) | US cloud (configurable) |
| AI tutor provider | Processes optional tutor follow-up question text when live help is used (premium). Item stems and pre-generated explanations may be included in the model context. No email or account identifiers are sent to the model. | Configured per deploy (TUTOR_API_URL) |
| Transactional email provider | Delivers lifecycle messages you opted into (welcome, study nudges, multi-cert journey notes). Address + template metadata only; no open/click tracking pixels. | Configured per deploy (EMAIL_PROVIDER) |
| Paddle | Merchant of Record for paid products: checkout, invoicing, tax remittance, refunds/cancellations. Receives billing identity and payment details you provide at checkout; CyberSkill never stores card numbers. | Global (Paddle MoR) |
Retention
Progress and leaderboard data are retained while your account remains active or until you request deletion. Logs are retained for operational periods then deleted or aggregated. Consent choices persist for up to 12 months.
Legal frameworks
Depending on where you are, the following may apply: Vietnam Personal Data Protection Law and Decree 356/2025; GDPR for EU visitors; CCPA/CPRA for California visitors. Listing these frameworks does not imply that every corporate filing (for example cross-border transfer assessments) is complete — entity-level obligations sit on the corporate track.
Your rights
To access, correct, or delete personal data we hold about you, contact info@cyberskill.world. You can reject analytics via the cookie banner or by enabling Global Privacy Control in your browser.