Privacy Policy

Last updated: October 31, 2026 | Effective Date: October 31, 2026

Data Controller Information

Data controller: Skillsolutions (registered in the Kingdom of Bahrain as Skillsolutions for Management Consultancy, CR No. 119844-2)
Email: info@skillsolutions.io

For personal data about a customer's employees in the SkillHQ platform, the customer (the employer) is the data controller and Skillsolutions processes that data on its behalf under our agreement. For our website, sales enquiries and our own business contacts, Skillsolutions is the data controller.

1. Information We Collect

Personal Information

We collect information you provide directly to us, such as:

  • Name and contact information
  • Job title and department
  • Organization details
  • Account credentials
  • Profile information and preferences
  • Employee ID (when provided by your organization)
  • Manager and team information
  • Gender (female/male), only if your organization records it — used solely so that Arabic text written about you by AI features is grammatically correct (see section 7)

Learning Platform Integration Data

When your organization integrates third-party learning platforms:

  • xAPI statements from Udemy, Coursera, LinkedIn Learning
  • Course enrollment and completion data
  • External certifications and badges
  • Learning activity timestamps and duration

Usage Information

We automatically collect certain information about your use of our platform:

  • Learning progress and completion data
  • Test results and scores, and the answers you give inside courses and tests
  • Platform usage patterns and preferences
  • Device and browser information
  • IP address of the device you sign in from (kept in your sign-in history)
  • Electronic acknowledgements you give on training records and plans (your typed name, the date, time and device)

2. Why We May Process Your Data (Legal Basis)

Your organization is the controller of your data and chooses the legal basis under the data protection law that applies to it. For many of our customers that is the personal data protection law of Bahrain, Saudi Arabia, the United Arab Emirates, Oman or Qatar; for people based in the European Economic Area, the United Kingdom or Switzerland it is the GDPR or UK GDPR; elsewhere it is your own country's law. Across these laws, the bases relied on are:

  • Contract Performance: To provide learning platform services to your organization
  • Legitimate Interests: For platform security, fraud prevention, and service improvement, where the law that applies to you recognizes this basis (in Oman, for example, your organization relies on your consent or one of the law's exceptions instead)
  • Legal Obligations: To comply with applicable laws and regulations
  • Consent: For optional features like marketing communications and AI practice conversations (you can withdraw consent anytime). Where the law that applies to you makes consent the main basis, as in Oman, your organization obtains it from you, including for hosting your data outside your country (section 12)
  • Vital Interests: In rare cases involving health and safety

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our learning platform
  • Personalize your learning experience and content recommendations
  • Track progress and generate performance reports
  • Communicate with you about your account and platform updates
  • Provide customer support and respond to inquiries
  • Analyze usage patterns to improve our services
  • Ensure platform security and prevent fraud
  • Comply with legal obligations

4. Information Sharing and Sub-Processors

We do not sell, trade, or otherwise transfer your personal information to third parties except in the following circumstances:

With Your Organization

Your organization's administrators (the owner and admins) can see your learning progress, test results and scores, the answers you gave inside courses and tests, your training records and certificates, and the device and IP address of your sign-ins, for training and development purposes. Managers see this only for the people in their reporting line. Private 1:1, mentoring and coaching content is seen only by the people taking part.

Skillsolutions support

To investigate a problem you or your organization reports, our support staff may open your account in a read-only view and see what you see. Each view requires a stated reason and two-step sign-in, lasts at most 30 minutes, cannot change, send, download or export anything, does not show private 1:1, mentoring or coaching content or Awal chats, and is logged. Your organization can ask us for the log.

Service Providers

We use carefully selected sub-processors to help deliver our services:

  • Supabase (Database hosting and authentication) - India (AWS Mumbai region)
  • Vercel (Application hosting — our application servers run in India, Mumbai region) - India
  • Cloudflare (Turnstile bot check on sign-in and public forms only — our sites are not routed through Cloudflare) - Global network, company in the United States
  • Resend (Transactional email services — sent from the European Union, Ireland) - European Union
  • Sentry (Error monitoring and performance tracking) - United States
  • Google Gemini (AI model — see section 7) - United States
  • Anthropic Claude (AI model — see section 7) - United States
  • PostHog (product usage analytics, only with your consent) - European Union (Frankfurt)
  • Amazon Web Services (encrypted off-site database backups, encrypted before upload so Amazon cannot read them) - European Union (Ireland)

All sub-processors are bound by data processing agreements and appropriate safeguards. For tools resold by Skillsolutions and contracted by the customer directly, such as outside course libraries and AI course creation, the providers are the customer's own processors, not our sub-processors.

Legal Requirements

We may disclose information if required by law or to protect our rights, property, or safety, or that of our users or the public.

5. Multi-Tenant Data Isolation

As an enterprise B2B platform, we implement strict data isolation:

  • Complete tenant data separation using organization UUIDs
  • Every request is checked by our application against the user's organization and role before any data is returned
  • AES-256-GCM encryption for sensitive credentials (API keys, integration secrets)
  • Isolated subdomain access (e.g., yourcompany.skillhq.io)
  • No cross-tenant data access or sharing

6. Technical Security Controls

We implement technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

Encryption and Data Protection

  • AES-256-GCM encryption for sensitive credentials (API keys, integration secrets) using PBKDF2/scrypt key derivation
  • TLS encryption for all data in transit (provided by Vercel)
  • Database encryption at rest provided by Supabase (PostgreSQL transparent data encryption)
  • Encryption keys stored in environment variables with mandatory configuration enforcement

Access Controls and Authentication

  • Multi-factor authentication (MFA) available via email one-time passwords
  • Role-based access control (RBAC) with four roles: Owner, Admin, Manager, Learner
  • JWT-based session management with configurable expiration
  • Organization-scoped access enforcement via middleware
  • Password hashing using bcrypt with appropriate cost factors

Infrastructure Security

  • Bot protection on sign-in and public forms (Cloudflare Turnstile) and platform-level DDoS mitigation by Vercel
  • Rate limiting on API endpoints to prevent abuse
  • Vercel serverless deployment with automatic security patching
  • Security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
  • Automated dependency vulnerability scanning via npm audit

Multi-Tenant Security Architecture

  • Complete tenant data separation using UUID-based organization isolation
  • Organization-scoped access checks on every request, enforced by our application, to prevent cross-tenant access
  • Subdomain-based tenant isolation with middleware enforcement
  • Organization-scoped API queries validated on every request

Monitoring and Incident Response

  • Sentry error monitoring and performance tracking for application issues
  • Vercel deployment logs and analytics for infrastructure monitoring
  • Supabase database monitoring and automated backups
  • Incident response procedures for data breach notification (see Section 10)

7. AI and Machine Learning Privacy Protections

Our platform uses artificial intelligence to generate assessment quizzes, map courses to skills, recommend content, answer learners' questions in Awal and owners', administrators' and managers' questions about reports, and prepare briefs for managers and mentors. Before any text is sent to an AI provider, SkillHQ minimizes personal data on its own servers, as described below. We are transparent about how AI is used and what data is involved.

How We Use AI

  • AI-powered quiz generation based on course titles, descriptions, and curriculum data
  • Learning content recommendations based on enrollment history and progress
  • Analytics insights derived from aggregated learning activity data
  • Preparation briefs and coaching prompts for a manager or mentor about a person they support. Every number and course title in a brief is checked against that person's record, and anything that cannot be confirmed is dropped.
  • Awal for owners, administrators and managers (the card on Home and "Ask about this report" on the Reports page) answers only from the report you are already allowed to see (a manager sees only their own reporting line). It works from statuses only: passed, failed, finished, overdue. Never scores, money, e-mail addresses or ID numbers. People's names are replaced by codes before the question leaves SkillHQ and put back in the answer. Every number and title is checked against the report, a question about a person who is not in your report gets a fixed message with no AI request, and the answer is shown on screen, labeled as written by AI, and not saved.
  • Awal, your AI assistant on the learner pages, answers your questions from your own learning record, your job role, team and manager as recorded by your organization, the skills your role needs, what is assigned to you, the courses and paths your organization offers you, and your organization's description of itself (background only). Each chat is kept until 90 days after its last message; you can see your saved chats and delete any of them, or all, at any time. They are never shown to your manager or administrators, and every answer Awal gives is clearly marked as written by AI, so you know to check anything important.

What Data Is Sent to AI Providers

  • Course titles, descriptions, and curriculum structure (for quiz generation)
  • Before any text is sent to an AI provider, the names of the people involved are replaced with placeholders — carrying only a female/male marker, where your organization has recorded one and the text is in Arabic, so that Arabic reads correctly — and put back only in the answer you see. E-mail addresses, phone numbers, GCC national-ID numbers, bank account and card numbers, employee numbers and access keys are detected and removed. If this step cannot run, no AI request is made. Our records of AI requests keep counts only, never the text.
  • AI requests are made over HTTPS encrypted connections
  • Google and Anthropic each have their own privacy terms governing data handling
  • Where a feature only needs totals, no names are sent at all. Course and skills content is not personal and is sent as-is. Pattern-based detection reduces, but cannot guarantee removal of, every personal detail typed into free text. Live voice practice is spoken audio and is not filtered; it is optional and needs the person's consent. Awal's microphone button uses your browser's own speech-to-text; depending on the browser, the audio may go to the browser maker's speech service (Google for Chrome, Microsoft for Edge, Apple for Safari). SkillHQ never receives the audio, only the text you send. Reading answers aloud uses voices stored on your device only.

AI Providers and Data Protection

  • Anthropic Claude and Google Gemini — we use both. Each AI feature has a main model from one company and a backup from the other, so the feature keeps working if one is unavailable
  • Narration, smart search and live voice practice use Google only
  • Our AI providers do not train on your data under their commercial terms, which we use.

Your Rights Regarding AI

  • AI-generated quizzes are reviewed and editable by administrators before assignment
  • Learning recommendations are suggestions only and do not restrict access to content
  • You may contact us to inquire about how AI features affect your learning experience
  • If your organization has recorded your gender (female/male), you can see it on your profile and ask your administrator to correct it. It is never guessed by SkillHQ, never shown to your manager, and is removed when your record is anonymized.

8. Data Retention

We retain data according to the following schedule:

  • Personal Identifiable Information: Your organization decides. If your organization deletes your account, your personal details (name, email, photo and other identifying information) are removed straight away. If your account is switched off (for example when you leave), your personal details are removed automatically at the end of the retention period your organization sets: 2 years (the default), 3 years or 5 years after the switch-off, or never. The period is never shorter than 2 years, and your organization's administrators are reminded three times before it ends. Your learning records are kept without your name, as described below.
  • Employee Training Records: Kept for as long as your organization uses SkillHQ, because they are your organization's training history. Once your personal details are removed, the records continue without your name (shown as "Former employee"), so your organization's history and statistics stay complete.
  • Certificates: Certificates keep your name, because they are your own proof of achievement. Each one has a verification page that shows your name, the course and the date to anyone who has its link, and that page keeps working even after your organization stops using SkillHQ. If you want your name removed from a certificate, ask your organization's administrators; the certificate itself stays on record.
  • Answers inside courses and tests: The answers you give are kept with your training record for as long as your organization's account exists. If your personal details are removed, your answers stay without your name.
  • Awal chat (your AI assistant on the learner pages): Your questions and the answers are kept for 90 days so you can continue the conversation, then deleted. You can clear them at any time from the chat window, they are deleted when your account is deleted or anonymized, and they are included in your own data download. Awal's answers to owners, administrators and managers about a report are not saved.
  • Audit Logs: Sign-in, security and activity logs are kept so your organization and we can investigate security incidents; the IP address and device details in them are removed 90 days after the event, and the logs themselves keep only an anonymized reference once your account is anonymized. Device details recorded during a proctored test are removed 90 days after the test or when your account is anonymized, whichever comes first. Expired security data (one-time codes, reset links and similar) is deleted after 30 days.
  • Aggregated Analytics: Indefinitely in anonymized form

Important for Employees: Training data belongs to your organization. You cannot delete your own account or training records: your organization can delete your account, and training records are kept for compliance and organizational reporting. To ask your organization to correct or delete your data, use My account › Your data › Ask my company.

9. Your Rights

Your Rights Under the Law That Applies to You

  • Access: Request a copy of your personal information
  • Rectification: Request correction of inaccurate information
  • Erasure: Ask your organization to delete your personal data (training records are kept as described in section 8)
  • Portability: Receive your data in a machine-readable format
  • Restriction: Request limitation of processing
  • Objection: Object to processing based on legitimate interests
  • Withdraw Consent: Withdraw consent where processing is consent-based
  • Automated Decision-Making: Not to be subject to a decision made only by automated means, or to object to such a decision and have a person review it, as the law that applies to you provides (in Oman, for example, the right is to object and get a human review)
  • Lodge a Complaint: Complain to the data protection authority of your country, for example the Personal Data Protection Authority (Bahrain), the Saudi Data and AI Authority (SDAIA), the UAE's federal data protection authority (the UAE Data Office, being succeeded by the Federal Authority for Artificial Intelligence and Data), the Ministry of Transport, Communications and Information Technology (Oman), the National Cyber Security Agency (Qatar), or your supervisory authority in the EEA, the UK or Switzerland

These rights come from the data protection law that applies to you, wherever you are. For many of our users that is the personal data protection law of Bahrain, Saudi Arabia, the United Arab Emirates, Oman or Qatar; the exact rights and response times depend on that law (for example 30 days in Saudi Arabia and 45 days in Oman). If you are based in the European Economic Area, the United Kingdom or Switzerland, you have these rights under the GDPR or UK GDPR, including data portability and a complaint to your supervisory authority. In any other country, the rights your own law gives you apply, and the tools described below are available to everyone. Your organization, as the controller of your data, is your first point of contact, and we help it respond.

Your organization controls your account, and we help it answer your requests. You can download your data yourself at My account › Your data (Download my data). To correct, restrict or delete your data, ask your organization's administrators: use My account › Your data › Ask my company, or contact them directly. You cannot delete your own account. You can also email dpo@skillsolutions.io and we will pass your request to your organization and help it respond within 30 days, or sooner where your local law requires (in the Kingdom of Bahrain, for example, within 15 working days for access requests and 10 working days for correction, blocking, erasure or objection).

10. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms:

  • We will tell your organization's administrators without undue delay, and in any case within 72 hours of becoming aware of the breach, so your organization can notify its data protection authority where its law requires
  • We will notify affected individuals without undue delay if the breach poses high risk
  • Where we are the controller ourselves (for example for website visitors and sales contacts), we will notify the Personal Data Protection Authority of the Kingdom of Bahrain, and any other authority the law requires, within the time the law sets
  • We maintain incident response procedures and breach documentation

11. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience on our platform. These technologies help us:

  • Remember your preferences and settings
  • Analyze platform usage and performance
  • Provide personalized content and recommendations
  • Ensure platform security and functionality

You can control cookie settings through your browser preferences, though disabling certain cookies may affect platform functionality.

12. International Data Transfers

SkillHQ is hosted outside most customers' countries: our database and application servers are in India (Mumbai region, Amazon Web Services and Vercel), our transactional email is sent from the European Union (Ireland, Resend), encrypted backup copies are kept in the European Union (Ireland, Amazon Web Services), and our error monitoring and AI providers are in the United States (see section 4). Your organization accepts these locations when it subscribes, and is responsible for telling you about them and for obtaining any consent the law of your country requires. We protect transferred data through our contracts with each provider and the safeguards in our Data Processing Agreement.

For users in the European Economic Area (EEA), UK, and Switzerland:

  • Our sub-processors (Supabase, Vercel) maintain Standard Contractual Clauses (SCCs) in their terms of service
  • We implement supplementary technical measures for data protection
  • Data Processing Agreements are available for enterprise clients upon request

13. Children's Privacy

SkillHQ is a workplace platform for adults employed or engaged by our customers. It is not intended for children, and we do not knowingly collect children's personal data. If you believe a child's data has been added, contact us and we will work with the organization to remove it.

14. Data Processing Agreements

For enterprise clients, we offer:

  • A standard Data Processing Agreement (DPA) meeting the processor requirements of the data protection law that applies to your organization, including the Bahrain, Saudi and Oman personal data protection laws and, where it applies, GDPR Article 28
  • Custom DPAs for specific regulatory requirements
  • Security addendums and audit rights

Contact info@skillsolutions.io to request a DPA.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: info@skillsolutions.io