Privacy policy

Data controller

The controller of the personal data collected on skillrung.com is À compléter : publisher's company name, whose contact details appear in the legal notice. For any question about your data, write to support@skillrung.com.

Data protection officer: À compléter : appointment of a DPO, or a statement that there is none.

The principle: visiting the site writes nothing about you

A visitor who is not signed in can read the public pages, the first four slides of every course and take the Beginner-level quiz without any data about them being recorded in our database. The result of a quiz taken without an account lives in the answer shown on screen, and is attached to an account only if you ask for it when you sign up.

Data we process

Account. Email address, name if you provide one, profile picture if you sign in with Google, and a hash of your password. The password itself is never stored: only a hash computed by a function suited to secrets is kept. Legal basis: performance of the contract.

Declared job. The job you choose, so that examples and wording can be adapted. Legal basis: performance of the contract. Before any account is created, that choice may be kept in the sr_job cookie, described below.

Progress and assessment. Slides read, quiz attempts, answers given, scores, experience points, badges, daily streak, scheduled reviews and certificates. Legal basis: performance of the contract.

Subscription and billing. Customer and subscription identifiers at our payment provider, subscription status and period dates. We neither receive nor store any bank details. Legal basis: performance of the contract and accounting obligations.

Emails. Two separate consents: service emails (address verification, password reset, billing), enabled by default and which you can turn off; and information emails, disabled by default and never pre-ticked. Legal basis: performance of the contract for the former, consent for the latter.

Technical logs. Our hosting providers keep connection logs for security and diagnostics. Legal basis: legitimate interest in the security of the service.

Cookies

We use no advertising cookies and no third-party trackers. As things stand, the site sets only three cookies:

• sb-<project-reference>-auth-token : session cookie issued by Supabase, strictly necessary for the account to work, inaccessible to page code, erased on sign-out. It may be split into two numbered cookies (.0, .1) when its size requires it.
• sr_job : remembers the job you chose, for 180 days. It is set only if you explicitly choose a job, never automatically when a page opens.
• sr_locale : remembers the language you chose in the language switcher, for one year. It is set only if you explicitly click a language, never from mere detection of your browser's language. It holds one of three values: fr, en or es.

No analytics tool is in service today. If we put one in place : À compléter : chosen provider, it will be cookie-free and this page will be updated before it goes live.

Recipients and processors

Your data is neither sold, nor rented, nor passed on for advertising purposes. It is processed by a deliberately small number of providers, each for a specific purpose:

• Stripe : collecting the subscription, invoicing and the management portal. Stripe is a controller for the payment data it collects directly.
• Supabase : hosting the database and managing accounts (email address, hashed password, sessions), in the European Union (Ireland).
• Google : only if you choose to sign in with a Google account, to verify your identity.
• Email provider : À compléter : provider name, to deliver transactional messages.
• Hosting provider : À compléter : name and location of the host, to host the application and the database.

Retention periods

• Account and learning data: kept for as long as the account exists, then deleted when it is deleted.
• Inactive accounts: À compléter : period chosen by the publisher, after prior notice by email.
• Address verification and password reset tokens: issued, stored and expired by Supabase, single-use, and destroyed after expiry.
• Billing data: kept for the legal retention period for accounting records, À compléter : period chosen by the publisher.
• Certificates: kept for as long as the account exists, so that a published certificate remains verifiable.

Your rights

You have a right of access, rectification, erasure, restriction, objection and portability, as well as the right to give instructions about what happens to your data after your death.

Two of these rights are exercised directly from your personal space, without writing to us: exporting your data and deleting your account, which erases every record concerning you. For other requests, write to support@skillrung.com.

You may also lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French supervisory authority to which the controller is subject. If you live in another European Union member state, you may instead contact the supervisory authority of your country of residence.

Published certificates

A certificate is published at a public address only if you explicitly ask for it. Those pages are excluded from search engine indexing and absent from our sitemap. You can withdraw a certificate from publication at any time, with immediate effect.

Security

Traffic is encrypted in transit. Passwords are hashed with a function suited to storing secrets. Access decisions for paid content are taken on the server on every request, and never inferred from a token stored in your browser. Quiz answer keys are never sent to the browser before submission.