Privacy notice
Version 2026-09-29
Draft for the prototype. The structure follows Art. 13 GDPR and is generated from the same rules the app uses. Company details and legal wording must be checked by a lawyer before launch. English only for now — the German version comes with the legal review.
Who is responsible
SkillSquid (company name TBD), Street, ZIP City, Germany (TBD). Email: privacy@skillsquid.example.
In short
- We use your data to run SkillSquid: your account, classes, bookings, payments, messages and the community.
- No advertising trackers, no selling of data, no automated decisions about you (Art. 22).
- News emails only if you opt in — and you can opt out any time.
- External videos only load after you click. Maps and some pictures come from other services (see below).
- You can download all your data, correct it, restrict it, object and delete your account yourself inSettings → Privacy & data.
What we process, why, and on which legal basis
Account and profile
Create and run your account, show your public profile.
- Data: Name, email and whether it is confirmed (the one-time code until then), password (only as a salted hash), security activity (password and email changes, login locks), photo, bio, location (optional, can be hidden), interests, settings, login times, accepted Terms version, age confirmation
- Legal basis: To provide the service you signed up for (Art. 6(1)(b) GDPR)
- Recipients: Hosting provider (processor, Art. 28). Public profile: other members and visitors.
- How long: see “Account, profile, listings, messages, posts” below
Classes, teacher pages and schools
Publish classes and teacher pages, run schools and classrooms.
- Data: Listing texts and photos, schedule, venue, prices, certificates claimed, teacher page content, school membership, classroom posts
- Legal basis: To provide the service you signed up for (Art. 6(1)(b) GDPR)
- Recipients: Everyone (public listings); the exact venue only to confirmed students.
- How long: see “Account, profile, listings, messages, posts” below
Teacher verification
Verify every teacher once before they can list a class (ADR 0016): who they are and what they teach — students meet them in person.
- Data: Legal name, kind of ID document, the result of the ID check, what they want to teach, experience, link, the team’s decision and note. No copy of the document is kept.
- Legal basis: To provide the service you signed up for (Art. 6(1)(b) GDPR); Our legitimate interest (Art. 6(1)(f) GDPR) — Contract: teaching on SkillSquid requires verification (Terms). Legitimate interest: safety of members.
- Recipients: The SkillSquid team. Later an ID check provider (processor, Art. 28).
- How long: see “Account, profile, listings, messages, posts” below
Bookings and requests
Book spots and lessons, negotiate offers, confirm and cancel.
- Data: Who booked what and when, messages sent with a request, counter-offers, status history
- Legal basis: To provide the service you signed up for (Art. 6(1)(b) GDPR)
- Recipients: The other party of the booking.
- How long: see “Account, profile, listings, messages, posts” below
Payments and payouts
Take payments, hold them until the first session, pay instructors out, refund.
- Data: Amounts, commission, payment status and dates; for payouts the account holder and the last four IBAN digits
- Legal basis: To provide the service you signed up for (Art. 6(1)(b) GDPR); A legal obligation (Art. 6(1)(c) GDPR) — Keeping the records: § 147 AO, § 257 HGB
- Recipients: Payment provider (TBD, processor or own controller), tax advisor, tax authorities on request.
- How long: see “Payment ledger (bookings, amounts, payouts)” below
Messages and friendships
Direct messages between friends and class chats.
- Data: Message texts, reactions, read times, friend requests
- Legal basis: To provide the service you signed up for (Art. 6(1)(b) GDPR)
- Recipients: The people in the conversation.
- How long: see “Account, profile, listings, messages, posts” below
Community (The Reef)
Forum threads, replies, reactions and the team’s news.
- Data: Posts, replies, reactions, linked classes, pictures
- Legal basis: To provide the service you signed up for (Art. 6(1)(b) GDPR)
- Recipients: Everyone (public).
- How long: see “Account, profile, listings, messages, posts” below
Reviews and ratings
Let students rate classes they went to, show instructors’ ratings, and let instructors answer — so the next student can choose well.
- Data: Stars, optional text and highlights, the class, when it was written or changed; the instructor’s answer
- Legal basis: To provide the service you signed up for (Art. 6(1)(b) GDPR) — Only people who went to a class can rate it. Reviews show first name and initial. The rating is an average shown to people — it decides nothing on its own (Art. 22).
- Recipients: Everyone (public on class and teacher pages).
- How long: see “Account, profile, listings, messages, posts” below
Class analytics
Show instructors how their classes are found: how often a class card was seen and clicked, its page opened and the class saved, per day and by where visitors came from.
- Data: Per class and day: impressions, clicks, page views by source, saves
- Legal basis: Our legitimate interest (Art. 6(1)(f) GDPR) — Counts only — no visitor ids, no cookies, no profiles. Instructors can’t see who looked at their class, and their own visits are not counted.
- Recipients: The instructor of the class.
- How long: see “Account, profile, listings, messages, posts” below
Ink, levels and badges
Show ink, levels, badges and weekly missions for what you do on SkillSquid — to make taking part more fun.
- Data: Which badges, levels and weekly missions you reached and when, bonus ink from missions, whether you saw them, the badges you pinned. Ink and level are computed from your activity. Can be hidden from others in Settings.
- Legal basis: To provide the service you signed up for (Art. 6(1)(b) GDPR) — No automated decision with legal or similar effect (Art. 22): ink unlocks nothing and costs nothing.
- Recipients: Other members and visitors, unless you hide them in Settings.
- How long: see “Account, profile, listings, messages, posts” below
Notifications
Tell you about requests, answers, messages and changes.
- Data: Notification texts, read status
- Legal basis: To provide the service you signed up for (Art. 6(1)(b) GDPR)
- Recipients: —
- How long: see “Notifications” below
Trust & safety
Handle reports, block people, take classes offline, warn and suspend accounts — to protect members who meet in person.
- Data: Reports (reason, details, copy of the content), blocks, warnings, suspensions, review notes
- Legal basis: Our legitimate interest (Art. 6(1)(f) GDPR); A legal obligation (Art. 6(1)(c) GDPR) — Legitimate interest: safety of members. Legal: notice-and-action and statement of reasons (DSA Art. 16, 17).
- Recipients: The SkillSquid team. Reporters stay anonymous to the reported person.
- How long: see “Closed reports (trust & safety)” below
Feedback
Read and answer your feedback, improve SkillSquid.
- Data: Message, kind, rating, page, email (visitors, optional)
- Legal basis: Our legitimate interest (Art. 6(1)(f) GDPR)
- Recipients: The SkillSquid team.
- How long: see “Feedback” below
News by email
Send news, tips and offers.
- Data: Email, name, consent record
- Legal basis: Your consent (Art. 6(1)(a) GDPR) — Also § 7 UWG for advertising emails.
- Recipients: Email provider (processor, TBD).
- How long: see “Consent records (superseded or of deleted accounts)” below
Data protection compliance
Prove consent, answer data requests, document breaches, keep an audit log of admin access.
- Data: Consent records, requests and answers, breach records, admin actions
- Legal basis: A legal obligation (Art. 6(1)(c) GDPR); Our legitimate interest (Art. 6(1)(f) GDPR) — Art. 5(2), 7(1), 12, 30, 33(5) GDPR
- Recipients: Supervisory authority on request.
- How long: see “Data subject requests” below
Maps and address search
Show where a class takes place, find addresses when listing a class.
- Data: IP address, map area viewed, typed address
- Legal basis: Our legitimate interest (Art. 6(1)(f) GDPR) — Your browser loads map tiles and address suggestions directly from these services, which see your IP address.
- Recipients: OpenStreetMap Foundation (map tiles), komoot GmbH — Photon (address search)
- Outside the EU: United Kingdom (OSMF) — adequacy decision
- How long: Not stored by SkillSquid
Pictures from image services
Show example pictures on classes and pages.
- Data: IP address, browser details
- Legal basis: Our legitimate interest (Art. 6(1)(f) GDPR) — Loaded directly by your browser.
- Recipients: Unsplash (Unsplash Inc.), Pixabay (Pixabay GmbH)
- Outside the EU: USA (Unsplash) — check EU-US Data Privacy Framework certification
- How long: Not stored by SkillSquid
Embedded videos
Play videos instructors add to their pages and classrooms.
- Data: IP address, browser details, cookies set by the video service
- Legal basis: Your consent (Art. 6(1)(a) GDPR) — Only after you click “Load video” (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).
- Recipients: YouTube (Google Ireland Ltd. / Google LLC), Vimeo (Vimeo.com Inc.)
- Outside the EU: USA — EU-US Data Privacy Framework
- How long: Set by the video service
Storage on your device
Keep you logged in and remember your choices (language, theme, sidebar, video consent).
- Data: See the list of stored items below
- Legal basis: Our legitimate interest (Art. 6(1)(f) GDPR) — Strictly necessary, so no consent needed (§ 25(2) no. 2 TDDDG). No tracking or advertising cookies.
- Recipients: — (stays on your device)
- How long: Until you log out or clear site data
Consent
Where we rely on your consent, it is voluntary, never pre-ticked, and you can withdraw it any time with effect for the future (Art. 7(3)) in Settings. We keep a record of when you gave or withdrew it.
- News and tips by email: SkillSquid may email me about new classes, features and offers. I can withdraw this any time in Settings — it doesn’t affect emails about my bookings.
You must be at least 16 to use SkillSquid.
How long we keep data
| Data | Kept for | Why |
|---|---|---|
| Account, profile, listings, messages, posts | While your account exists | Art. 17(1)(a) — no longer needed once you leave |
| Accounts without a login | 24 months after last login | Art. 5(1)(e) — we remind the person first, then delete. |
| Payment ledger (bookings, amounts, payouts) | 120 months after end of the calendar year of the booking (simplified: booking date) | § 147 AO, § 257 HGB — 10 years for books and records (8 years for vouchers since 2025). Kept pseudonymised after account deletion (Art. 17(3)(b)). |
| Notifications | 12 months after creation | Art. 5(1)(e) — only useful while recent |
| Instructor activity log | 24 months after creation | Art. 5(1)(e) |
| Closed reports (trust & safety) | 24 months after closing the report | Art. 6(1)(f) — recognising repeat offenders; DSA Art. 16/17 documentation |
| Feedback | 24 months after creation | Art. 5(1)(e) |
| Consent records (superseded or of deleted accounts) | 36 months after being superseded | Art. 7(1) proof, regular limitation period § 195 BGB (3 years) |
| Data subject requests | 36 months after completion | Art. 5(2) accountability, § 195 BGB |
| Admin audit log | 36 months after creation | Art. 5(2), Art. 32 — who accessed or changed what |
When you delete your account, everything else is deleted right away. Records we must keep by law are kept without your name and deleted when their period ends (Art. 17(3)).
Storage on your device
We only store what is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG) — no tracking cookies:
skillsquid_db(localStorage): Prototype only: the whole demo database. In production this lives on our servers.theme(localStorage): Light or dark modeskillsquid:lang(localStorage): Languageskillsquid:leftNavCollapsed(localStorage): Sidebar collapsed or openskillsquid:leftNavViewMode(localStorage): Student or teacher viewskillsquid:consent(localStorage): Your choice about loading external videosskillsquid:geoLocationDismissed(sessionStorage): You changed the city we guessed (until the tab closes)skillsquid_ink_*(sessionStorage): The ink your meter last showed, so new ink counts up (until the tab closes)
Your rights
- Access (Art. 15): See what we store about you. Download it right here any time.
- Portability (Art. 20): Get your data in a machine-readable format (the download is JSON).
- Correction (Art. 16): Most things you can change yourself; for anything else, ask us.
- Erasure (Art. 17): Delete your account. What the law makes us keep is kept pseudonymised and deleted later.
- Restriction (Art. 18): We keep your data but stop using it, e.g. while you dispute that it is correct.
- Objection (Art. 21): Object to processing based on our legitimate interest (e.g. trust & safety records).
You can also withdraw consent (Art. 7(3)). Use Settings → Privacy & data or write to privacy@skillsquid.example. We answer within 1 month — if a request is complex, we may extend this by two months and tell you why (Art. 12(3)).
You have the right to complain to a supervisory authority (Art. 77), for exampleBerliner Beauftragte für Datenschutz und Informationsfreiheit.