1) Who we are (Data Controller)
Controller: CARDUME ESBELTO UNIP. LDA (trading as SkillVault)
Address: Rua Filipe Folque 2, 2º andar, 1050-113 Lisbon, Portugal
Email: support@skillvault.dev
2) What data we collect
Depending on how you use the Service, we may collect:
- Account data: email address and password hash. Username is derived from the email's local part and may be edited from the dashboard.
- Vault content: the skill names, descriptions, tags, and bodies you register.
- Billing data: Stripe-managed payment details (card numbers are not stored on SkillVault's servers). Subscription tier, billing email, invoice history.
- Support data: messages and attachments you send via the contact form or email.
- Technical data: IP address, request timestamps, browser user agent. Used for security (rate-limiting, abuse prevention) and for diagnostics.
3) How we use your data
- Provide and deliver the Service — serve vault URLs, the JSON API, and the CLI wrapper.
- Process subscriptions and manage refunds through Stripe.
- Send transactional email: account confirmation, password reset, billing receipts, security alerts.
- Respond to inquiries and provide customer support.
- Maintain security, prevent fraud and abuse, troubleshoot issues.
- Comply with legal obligations (tax, accounting, law enforcement requests where required).
We do not use your vault content, account email, or any other personal data to train any AI model. We do not profile users for advertising. There is no advertising on SkillVault.
4) Cookies and analytics
SkillVault uses a minimal set of cookies for essential functionality only:
sv_session— your authenticated session (httpOnly, SameSite=Lax, 30 days).sv_csrf— CSRF token (SameSite=Strict, session lifetime).sv_contact_sent— flash after a successful contact form submission.
The Service does not use Google Analytics, Meta Pixel, Plausible, Fathom, or any other third-party analytics service. No advertising trackers, session-replay tools, or behavioural analytics run inside the app or follow you across the web. Your skill content, search queries, and API calls are not profiled, sold, or used for advertising.
Our public marketing website (skillvault.dev) may use privacy-respecting analytics (such as Plausible or a self-hosted instance) to count page views and diagnose problems. That analytics layer is separate from the Service, does not see your vault content, and does not identify you beyond a coarse country code.
5) Sharing and third parties
We share personal data only with trusted processors that help us run the Service, and only to the extent required for their function:
- Stripe Payments Europe Ltd. — subscription billing. Stripe's privacy policy applies to billing data: stripe.com/privacy.
- MailerSend (or Postmark / Resend) — transactional email delivery. The email provider receives the email address and message body but is contractually prohibited from using them for any other purpose.
- Railway / managed Postgres / S3-compatible object storage — infrastructure hosting, all in the EU.
- InvoiceXpress — Portuguese fiscal receipt generation, used when required by tax law.
We do not sell personal data. We do not share personal data with advertisers, data brokers, or social networks.
6) Data protection
We protect personal data using industry-standard security measures, including:
- TLS/HTTPS for all data transmitted between your browser, our servers, and third-party APIs.
- Encryption at rest for vault content (stored in S3-compatible object storage with server-side encryption) and database snapshots.
- Password hashing with argon2id; no plaintext passwords are ever stored.
- Vault tokens are stored hashed; the plaintext is shown to the user exactly once at issuance and never again.
- Access controls limiting data access to authorized personnel only, with audit logging.
7) Data retention
Account data is retained while the account is active. If you cancel your subscription, the following happens:
- You keep your paid tier until the end of the period you've already paid for. Nothing changes while that period is still running.
- When the paid period ends, your subscription is downgraded to the free tier. At that point the 30-day grace clock starts.
- For those 30 days, your vault stays readable so you can export, re-subscribe, or delete your account. The free-tier caps apply (3 skills, 100 MB): you can delete skills during this period, but you cannot add new ones or upload data that exceeds the cap.
- If you re-subscribe within those 30 days, the grace clock is cancelled and your vault returns to your paid tier.
- If you take no action, your vault data (skills, secrets, S3 files) is permanently hard-deleted at the end of the 30-day grace period. Your account row is kept for billing records but is no longer associated with any vault content.
You can also delete your account at any time from the dashboard without cancelling first. Account deletion is immediate and irreversible: your stored skills, secrets, sessions, OAuth tokens, and Stripe linkage are wiped, and your email is replaced with a random string so the row can no longer be used to authenticate. Only the row itself (with a deletion timestamp) and any associated billing records are retained.
Billing records are retained for 7 years as required by Portuguese tax law.
8) Your rights
Under the GDPR (and equivalent laws), you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Request deletion of your data.
- Object to processing or request restriction of processing.
- Data portability — export your vault content at any time from the dashboard.
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with the Portuguese supervisory authority (CNPD) or your local data protection authority.
To exercise any of these rights, email support@skillvault.dev. We respond within 30 days.
9) International transfers
Primary data storage is in the European Union. Some processors (notably Stripe) may transfer data outside the EU under Standard Contractual Clauses or equivalent safeguards. We prefer EU-resident processors and revisit this list on every material change.
10) Children
The Service is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact support@skillvault.dev and we will delete the account.
11) Changes to this policy
We will post any changes on this page and bump the "Last updated" date. For material changes, we will additionally email all active account holders at least 14 days before the change takes effect.