Privacy Policy

SkillPass Prep is the data controller for the personal data described below. For any privacy-related request, contact us at privacy@skillpassprep.org.

• Account data: name, email, password hash, role.
• Payment data: Stripe customer ID, payment status, amount, currency (we do not store card numbers).
• Uploaded documents (Phase 2): CV, job offer, and a copy of your passport.
• Audio and video recordings: webcam + microphone recordings captured during the Part 3 Speaking & Listening Test and other monitored exams, plus per-question audio files.
• Test results & metadata: attempt timestamps, scores, AI scoring reports, transcripts.
• Technical data: IP address, device, browser, session logs.

• To deliver the test platform and your account (Art. 6(1)(b) GDPR - performance of a contract).
• To record and assess your spoken English by AI (Art. 6(1)(a) GDPR - your explicit consent, given on the consent screen before each Speaking & Listening Test).
• To process payments and meet legal obligations such as tax retention (Art. 6(1)(b) and 6(1)(c) GDPR).
• To prevent fraud and abuse and to monitor exam integrity (Art. 6(1)(f) GDPR - legitimate interests).

We share data only with processors that act on our instructions under written agreements:

• Lovable Cloud / Supabase - application backend, database, transient file storage.
• Stripe - payment processing.
• Google (Gemini API) - AI scoring of audio recordings.
• OpenAI - speech-to-text (Whisper) and text-only AI scoring as a fallback provider.
• Speechace - phoneme-level pronunciation scoring when enabled.
• DeepSeek - text-only AI scoring as a fallback provider when enabled.
• The external object-storage provider configured by the controller (e.g. Cloudflare R2, Backblaze B2, Bunny Storage) - long-term storage of audio and video recordings.

Some processors are established outside the European Economic Area. Where this is the case, transfers are protected by the European Commission's Standard Contractual Clauses (SCCs) and supplementary technical safeguards.

• Audio and video recordings: up to 24 months after the relevant exam, unless you exercise your right to erasure earlier.
• Account and result records: kept while your account is active and for 6 years after closure to comply with tax and accounting obligations.
• Payment records: kept for the period required by applicable tax law.

Under the GDPR you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict processing.
• Receive your data in a portable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, without affecting the lawfulness of processing performed before withdrawal.

To exercise any of these rights, email privacy@skillpassprep.org. You also have the right to lodge a complaint with your national data protection supervisory authority.

We use encryption in transit and at rest, role-based access control, row-level security on our database, and signed credentials for the external storage provider. Service-role keys and AI provider keys are stored only on the server.

We may update this Policy. Material changes will be notified inside the app and reflected in the "Last updated" date above.