1) Who we are (Data Controller)
Controller: CARDUME ESBELTO UNIP. LDA (trading as SkillVault)
Address: Rua Filipe Folque 2, 2º andar, 1050-113 Lisbon, Portugal
Email: support@skillvault.dev
2) What data we collect
Depending on how you use the Service, we may collect:
- Account data: email address and password hash. Username is derived from the email's local part and may be edited from the dashboard.
- Vault content: the skill names, descriptions, tags, and bodies you register.
- Billing data: Stripe-managed payment details (card numbers are not stored on SkillVault's servers). Subscription tier, billing email, invoice history.
- Support data: messages and attachments you send via the contact form or email.
- Technical data: IP address, request timestamps, browser user agent. Used for security (rate-limiting, abuse prevention) and for diagnostics.
3) How we use your data
- Provide and deliver the Service — serve vault URLs, the JSON API, and the CLI wrapper.
- Process subscriptions and manage refunds through Stripe.
- Send transactional email: account confirmation, password reset, billing receipts, security alerts.
- Respond to inquiries and provide customer support.
- Maintain security, prevent fraud and abuse, troubleshoot issues.
- Comply with legal obligations (tax, accounting, law enforcement requests where required).
We do not use your vault content, account email, or any other personal data to train any AI model. We do not profile users for advertising. There is no advertising on SkillVault.
4) Cookies and analytics
SkillVault uses a minimal set of cookies for essential functionality only:
sv_session— your authenticated session (httpOnly, SameSite=Lax, 30 days).sv_csrf— CSRF token (SameSite=Strict, session lifetime).sv_contact_sent— flash after a successful contact form submission.
The Service does not use Google Analytics, Meta Pixel, Plausible, Fathom, or any other third-party analytics service. No advertising trackers, session-replay tools, or behavioural analytics run inside the app or follow you across the web. Your skill content, search queries, and API calls are not profiled, sold, or used for advertising.
Our public marketing website (skillvault.dev) may use privacy-respecting analytics (such as Plausible or a self-hosted instance) to count page views and diagnose problems. That analytics layer is separate from the Service, does not see your vault content, and does not identify you beyond a coarse country code.
5) Sharing and third parties
We share personal data only with trusted processors that help us run the Service, and only to the extent required for their function:
- Stripe Payments Europe Ltd. — subscription billing. Stripe's privacy policy applies to billing data: stripe.com/privacy.
- MailerSend (or Postmark / Resend) — transactional email delivery. The email provider receives the email address and message body but is contractually prohibited from using them for any other purpose.
- Railway / managed Postgres / S3-compatible object storage — infrastructure hosting, all in the EU.
- InvoiceXpress — Portuguese fiscal receipt generation, used when required by tax law.
We do not sell personal data. We do not share personal data with advertisers, data brokers, or social networks.
6) Data protection
We protect personal data using industry-standard security measures, including:
- TLS/HTTPS for all data transmitted between your browser, our servers, and third-party APIs.
- Encryption at rest for vault content (stored in S3-compatible object storage with server-side encryption) and database snapshots.
- Password hashing with argon2id; no plaintext passwords are ever stored.
- Vault tokens are stored hashed; the plaintext is shown to the user exactly once at issuance and never again.
- Access controls limiting data access to authorized personnel only, with audit logging.
7) Data retention
Account data is retained while the account is active. If you cancel your subscription, the following happens:
- You keep your paid tier until the end of the period you've already paid for. Nothing changes while that period is still running.
- When the paid period ends, your subscription is downgraded to the free tier. Your vault stays live under the free-tier caps (3 skills, 100 MB): you can read everything, delete skills to stay within the cap, and re-subscribe at any time to restore your paid tier.
- We do not delete your data on cancellation. Your vault, secrets, and stored skills remain accessible indefinitely at the free-tier level.
The 30-day hard-delete grace clock applies only to accounts where the user explicitly initiated account deletion via the dashboard's "Delete Account" action. In that case:
- The vault is marked with a deletion timestamp immediately.
- The account row's email is replaced with a random opaque string so the row can no longer be used to authenticate.
- Stored skills, secrets, sessions, OAuth tokens, and Stripe linkage are wiped.
- S3 objects under the user's skill prefix are bulk-deleted as part of the account-delete handler (not deferred to a later cron run).
- After 30 days, the account row itself is anonymized in line with billing-record retention requirements.
You can also delete your account at any time from the dashboard without cancelling first. Account deletion is immediate and irreversible: your stored skills, secrets, sessions, OAuth tokens, and Stripe linkage are wiped, and your email is replaced with a random string so the row can no longer be used to authenticate. Only the row itself (with a deletion timestamp) and any associated billing records are retained.
Billing records are retained for 7 years as required by Portuguese tax law.
8) Your rights
Under the GDPR (and equivalent laws), you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Request deletion of your data.
- Object to processing or request restriction of processing.
- Data portability — export your vault content at any time from the dashboard.
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with the Portuguese supervisory authority (CNPD) or your local data protection authority.
To exercise any of these rights, email support@skillvault.dev. We respond within 30 days.
9) International transfers
Primary data storage is in the European Union. Some processors (notably Stripe) may transfer data outside the EU under Standard Contractual Clauses or equivalent safeguards. We prefer EU-resident processors and revisit this list on every material change.
10) Children
The Service is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact support@skillvault.dev and we will delete the account.
11) Changes to this policy
We will post any changes on this page and bump the "Last updated" date. For material changes, we will additionally email all active account holders at least 14 days before the change takes effect.