SkillCort Legal
Privacy Policy
How SkillCort processes personal data across the platform and websites (skillcort.com and subdomains).
SkillCort is a work-sample based skill assessment platform operated by SkillCort LLC, a limited liability company registered in Florida, USA ("SkillCort", "we").
Controller identity (for processing where SkillCort is the controller): SkillCort LLC — 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA. Contact: privacy@skillcort.com.
1. Roles: who is the controller, who is the processor?
SkillCort processes personal data in two distinct capacities. Which capacity applies determines who you should direct your rights requests to:
| Data subject | Controller | SkillCort's role |
|---|---|---|
| Candidates / participants (people invited to an assessment by an organization) | The customer organization running the assessment | Processor — we process candidate data only on the organization's documented instructions |
| Customer account users (organization staff with platform accounts) | SkillCort | Controller |
| Website visitors and demo requesters | SkillCort | Controller |
If you are a candidate: the organization that invited you decides why and how your data is processed. Please direct privacy requests to that organization first. If you contact us, we will forward your request to them without delay and support its fulfilment (see Section 10).
2. What we process, why, and on what legal basis
The tables below map each processing activity to the data involved, the purpose, and the legal basis (GDPR Art. 6; Turkish DP Law Art. 5–6). Data is collected by fully or partly automated means when you use the platform or submit a form.
2.1 Candidate data (controller: the customer organization, which confirms the applicable bases)
| Activity | Data | Purpose | Typical legal basis |
|---|---|---|---|
| Assessment access | Name, email, invitation/access records | Admitting the right candidate to the right assessment | Contract necessity (Art. 6(1)(b)) |
| Response capture | Answers, uploaded files, work-sample outputs, code | Skill evaluation and scoring | Contract necessity; controller's legitimate interests (Art. 6(1)(f)) |
| Technical records | IP address, browser/device info, session and activity timestamps | Session security, troubleshooting, fraud prevention | Legitimate interests; establishment/defence of legal claims |
| Proctoring — only if enabled by the organization | See Section 3 | Assessment integrity | See Section 3 |
| Evaluation results | Scores, evaluator notes, decision records | Basis for hiring/certification/development decisions | Controller's legitimate interests |
2.2 Customer account data (controller: SkillCort)
| Activity | Data | Purpose | Legal basis |
|---|---|---|---|
| Account creation and sign-in | Name, work email, authentication records (passwordless magic-link) | Opening and securing the account | Contract necessity |
| Billing | Billing name, address, tax details | Legally required invoicing | Legal obligation |
| In-product activity records | User action logs, audit trail | Security, accountability, reviewable decision history | Legitimate interests |
| Service communications | Invitations, notifications, transactional email | Contract necessity |
2.3 Website visitors and marketing (controller: SkillCort)
| Activity | Data | Purpose | Legal basis |
|---|---|---|---|
| Demo request form | Full name, work email, company, team size | Evaluating and responding to your request | Pre-contractual steps at your request |
| Site analytics | Page views and aggregated usage metrics (Vercel Web Analytics) | Measuring site performance | Legitimate interests — verified cookieless: the site sets no cookies and the analytics script uses no cookies or persistent identifiers (code audit, 3 Aug 2026) |
| Marketing email | Product announcements | Only with your consent; every message includes an unsubscribe link |
We do not process your data for purposes beyond these tables. If a new purpose arises, we will inform you first and obtain consent where required.
3. Proctoring data — specific disclosure
Proctoring features are off by default. They run only when the organizing customer enables them, and only after the candidate is clearly informed before the assessment starts and gives separate, explicit consent. Nothing is monitored that the candidate has not been shown.
Depending on the organization's configuration, proctoring may process:
- Camera: periodic photos (every 30 seconds) or continuous video recording
- Screen: periodic screenshots or continuous screen recording
- Behavioral integrity signals: tab/focus switches, fullscreen exits, copy/paste events, print attempts, large text pasted into an answer field, disconnections, and a liveness heartbeat
How signals work (profiling disclosure):these events are recorded on a timeline and aggregated by rule-based counters into an integrity summary ("clean / minor events / requires review"). This may constitute profiling within the meaning of GDPR Art. 4(4). We commit to the following:
- No single signal ever automatically rejects a candidate. Signals only give human reviewers context; the evaluation decision always rests with a human (see Section 8).
- AI-assisted review, human adjudicated: when a reviewer opens a session, AI may scan camera frames, screen captures and the microphone transcript and flag moments worth opening; every flag receives an explicit human confirm-or-dismiss verdict. AI never runs unattended during an exam and never decides.
- The platform performs no automated face matching or face recognition against galleries and stores no biometric templates, and does not cross-match identities between candidates. Where an organization enables identity review, the candidate's session selfie, ID photo and any optional organization-provided reference photo are shown side by side to an authorized reviewer. A named reviewer records the identity decision and timestamp. Camera recordings nonetheless contain imagery of a person, and we expect customer organizations to assess them against special-category data requirements in their own jurisdictions.
- Proportionality:organizations can enable only what they need (photos instead of video, screen only, etc.); we recommend the least intrusive configuration that satisfies the assessment's purpose.
Retention and deletion: proctoring media files—including camera, screen and microphone captures, session selfies, ID-document images and any reference-photo version used in an identity review—and integrity-signal event records are deleted automatically at the end of the window set by the organization (default: 90 days). Organizations can trigger earlier deletion of attempt-scoped media and integrity-signal events. The non-media identity-review record (decision, named reviewer and timestamp, notes, and identifiers or path references for media that may already have been deleted) follows the separate assessment-data retention window (default: 24 months).
4. AI-assisted features
- AI does not make decisions about candidates; its outputs are signals reviewed by a human evaluator.
- Candidates are informed when AI is used in an assessment.
- Model training: our AI subprocessors are bound not to train on this content (OpenAI does not use API content for training and retains inputs up to 30 days for abuse monitoring; Anthropic's commercial terms prohibit training on customer content). SkillCort builds no models on candidate data; avatar rendering receives only authored question text, never candidate data.
- We build no cross-customer candidate profiles, hidden reputation scores, or shared candidate memory.
5. Who we share data with
We do not sell personal data. We disclose it only to the recipients below, for the stated purposes:
| Recipient | Purpose | Location |
|---|---|---|
| The customer organization (running the candidate's assessment) | Delivering results and records to the controller | The organization's country |
| Supabase (database, file storage, authentication) | Hosting subprocessor | Data hosted in Frankfurt, Germany (EU) |
| Vercel (application hosting; cookieless site analytics) | Hosting subprocessor | Frankfurt (EU — fra1); US entity (DPF-certified) |
| Resend (transactional email) | Delivery of invitation and notification email | US — N. Virginia (DPF-certified) |
| OpenAI (speech-to-text, text-to-speech, reviewer-triggered AI review of proctoring media, live AI interviewer speech) | AI subprocessor | US (DPF-certified); no training on API content; ≤30-day abuse-monitoring retention |
| Anthropic (default AI model for evaluation summaries, suggestions and drafting) | AI subprocessor | US; contractually barred from training on this content |
| HeyGen / LiveAvatar (interviewer avatar rendering and streaming) | Avatar subprocessor — receives only authored question text; no candidate data is sent to it | US (DPF-certified) |
| Cloudflare (only during a live webcam view) | Real-time relay of the live camera feed (not recorded) | Global network; US entity |
| Public authorities | Where legally required, against verified requests | — |
Data processing agreements (DPAs) are in place with all subprocessors; changes to the subprocessor list are announced on this page.
6. International transfers
Platform data is hosted in the European Union (Frankfurt, Germany — Supabase and Vercel). As SkillCort is established in the United States, data is accessible from the US for the operation of the service; transactional email (Resend) and AI processing (OpenAI, Anthropic, HeyGen) take place in the US as described in Section 5.
- Transfers out of Türkiye rely on the standard contracts published by the Turkish DPA under Art. 9 of the Turkish DP Law (as amended in 2024), notified to the Authority within the statutory period.
- EU/UK-to-US access/transfersrely on each provider's executed Standard Contractual Clauses under GDPR Art. 46 and, where the provider is certified, the EU-U.S. Data Privacy Framework (Vercel, Resend, OpenAI, HeyGen — verified 3 Aug 2026), supported by documented transfer impact assessments and supplementary measures.
7. Retention
We fix retention periods per data category, in advance and in a documentable way:
| Data category | Period |
|---|---|
| Proctoring media and integrity-signal events | Per organization setting (7–3650 days; default 90 days), deleted automatically by a daily job. This includes identity-capture media and reference-photo versions used in review. Organizations can trigger earlier deletion of attempt-scoped media and integrity-signal events. |
| Non-media identity-review record | The decision, named reviewer, timestamp, notes and references to deleted media follow the related assessment-record window (default 24 months). A retained reference does not preserve or restore deleted media. |
| Candidate responses, scores, evaluator notes and result records | Where SkillCort processes on behalf of an organization: the period that organization lawfully configures; if none is configured, 24 months from completion of the assessment session. Deleted earlier on the organization's documented instruction. Where a longer period is required by law, or to establish, exercise or defend legal claims, records are kept only for the period and scope strictly necessary. This schedule is enforced by a daily automated deletion job; organizations set their own window in Settings → Data. |
| Account data | For the life of the account, then deleted on the account-closure schedule below. |
| Account or contract termination | Customer data stays exportable for up to 30 days after termination, is then deleted from active production systems, and residual encrypted backup copies are deleted or overwritten through the ordinary backup cycle within a maximum of 90 days. Legally required records and narrowly necessary legal-claim records are excluded. |
| Security, access and audit logs | Kept separately from backups for accountability for 24 months, enforced by a daily automated deletion job. |
| Billing records | Statutory tax retention periods |
| Demo request records | 24 months from the last interaction, unless a customer relationship begins. |
| Deletion requests | Verified requests fulfilled within 30 days. |
Audit records of score and decision history are kept append-only for accountability and remain subject to retention rules. Daily encrypted backups exist for disaster recovery; a deletion is propagated to backups as they cycle, within a maximum of 90 days.
8. Automated decision-making and profiling
We do not make solely automated decisions producing legal or similarly significant effects about you (GDPR Art. 22). Integrity signals and AI outputs may involve elements of profiling (see Sections 3–4); they are always subject to human review. See Section 10 for how to object.
9. Security
Data is encrypted in transit and at rest. Tenant data is separated; access follows role-based, least-privilege controls. Proctoring media is stored in a private, non-public bucket. Backups run daily. If unlawful access is detected, we notify the competent authority and, where required, you (GDPR Art. 33–34; Turkish DP Law Art. 12(5)). No method of transmission over the internet is 100% secure.
10. Your rights and how to exercise them
Under GDPR Art. 15–22 and Turkish DP Law Art. 11 you may access, rectify, and erase your data, restrict processing, learn of transfers, receive a portable copy, object, and contest automated outcomes. Where processing relies on consent, you may withdraw it at any time with future effect.
- Candidates: address requests to the organization that invited you. If you contact us at privacy@skillcort.com, we will forward your request to them without delay.
- Account users and site visitors: write to privacy@skillcort.com. We respond free of charge within 30 days.
- If unsatisfied, you may lodge a complaint with the Turkish Personal Data Protection Board (kvkk.gov.tr) or, where GDPR applies, your local supervisory authority.
11. Cookies
Strictly necessary cookies (session, security) run without consent. Any other cookie (including analytics, if used) is off by default and runs only with your opt-in consent. See the Cookie Policy for each cookie's name, purpose, duration, and party.
12. Changes
Material changes are announced on this page with a new effective date; registered users are additionally notified by email. Prior versions are available on request.
13. Contact
SkillCort LLC
7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA
Email: privacy@skillcort.com