Privacy Policy

We collect information you provide directly to us, including: • **Account Information**: Name, email address, and password when you create an account • **Profile Data**: Optional profile picture and preferences you choose to share • **Usage Data**: Teaching sessions, topics practiced, scores, and feedback history • **Payment Information**: Billing details processed securely through our payment provider (Flutterwave) • **Communications**: Messages you send to our support team • **Audio Data (Microphone Access)**: SkillTeach collects audio recordings when you actively use features such as Teaching Sessions, Pitch Mode, or Interview Practice. These recordings are used to generate AI-powered feedback and improve your learning experience. Audio is only recorded when you explicitly start a session and is not collected in the background. We also automatically collect: • Device information (browser type, operating system, device fingerprint) • Browser information (user-agent string, language preference) • Log data (access times, pages viewed, API endpoints called) • Cookies and similar tracking technologies **Security Telemetry**: To protect the platform and our users, we additionally collect a limited set of security signals on every request: • IP address (raw and a one-way salted hash of the IP) • Security event logs (e.g. successful login, failed login, password reset request, account lockout, rate-limit trigger, suspicious request, admin access denied, ip block) • Event timestamps • Authentication activity associated with your account • Abuse-prevention signals (e.g. request frequency, scanner / bot patterns) These signals are used strictly for the legitimate security purposes described in Sections 2 and 4A. They are never used for advertising and are never sold.

We use your information to: • Provide, maintain, and improve SkillTeach services • Process transactions and send related information • Send technical notices, updates, and support messages • Respond to your comments, questions, and customer service requests • Generate AI-powered feedback and career recommendations • Monitor and analyze trends, usage, and activities • Personalize and improve your experience We use the security telemetry described in Section 1 to: • Detect, investigate, and prevent fraudulent transactions and abuse • Identify suspicious or malicious activity (e.g. credential stuffing, scanning, scraping) • Rate-limit and temporarily block abusive traffic • Protect accounts from brute-force and account-takeover attempts • Investigate security incidents and produce audit trails • Operate our internal Security Operations Center (SOC) dashboard, used by authorized administrators to monitor the platform's security posture

We work with trusted third-party services to operate SkillTeach: • **OpenAI**: Powers our AI teaching feedback and career recommendations. Your teaching transcripts are processed to generate personalized feedback. • **Flutterwave**: Processes subscription payments securely. We do not store your full payment card details. • **Google**: Provides optional OAuth authentication for account sign-in. • **MongoDB**: Securely stores your account and session data. These providers have their own privacy policies and are contractually obligated to protect your data.

We implement industry-standard security measures to protect your data: • All data transmission is encrypted using TLS/SSL • Passwords are hashed using bcrypt encryption • Access to personal data is restricted to authorized personnel only • Regular security audits and vulnerability assessments • Secure cloud infrastructure with redundant backups • Continuous security monitoring through our internal SOC dashboard While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

This section explains exactly how SkillTeach handles the security telemetry described in Section 1. **Why we collect it** We collect and process security telemetry for the legitimate purposes of: • Platform security and integrity • Abuse prevention • Fraud detection • Rate limiting and traffic shaping • Account protection (e.g. brute-force lockout, suspicious-login warnings) • Incident investigation • Operating our internal Security Operations Center (SOC) dashboard **Admin-only access** • Security information (including event logs and IP addresses) is accessible only to authorized SkillTeach administrators acting in a security or compliance role. • Real (unhashed) IP address visibility is gated behind the admin SOC dashboard and is used solely for security investigation purposes. • Real IP addresses are never displayed publicly anywhere on SkillTeach. • Real IP addresses are never shared with other users or shown in any user-facing surface (profile, feedback share pages, leaderboards, etc.). • Default views — even inside the admin dashboard — show a one-way hashed representation of the IP. Administrators must explicitly choose to reveal a real IP, and that action is itself logged. **Data protection** • Security logs are stored in our protected production database and protected by the same encryption, access controls, and backup policy as the rest of your data. • Access to security logs is restricted to authorized personnel with a documented operational need. • Security monitoring is used solely for protecting the platform and its users — not for profiling, advertising, or commercial targeting. **No sale of security data** SkillTeach does not sell IP addresses, security logs, or any user security telemetry to advertisers, data brokers, analytics resellers, or any other third party. **Abuse prevention** SkillTeach may, using the signals listed in Section 1: • Detect abuse and abusive patterns of usage • Identify suspicious or malicious activity • Rate-limit malicious or excessive traffic • Temporarily or permanently block abusive requests, IP addresses, or accounts • Investigate security incidents and preserve the necessary evidence These measures are applied automatically and/or by authorized administrators when needed to protect the platform and other users.

Depending on your location, you may have the following rights: **Access & Portability**: Request a copy of your personal data **Correction**: Update or correct inaccurate information **Deletion**: Request deletion of your account and associated data **Restriction**: Limit how we process your data **Objection**: Object to certain processing activities **Withdrawal**: Withdraw consent where processing is based on consent To exercise these rights, contact us at contact@skillteach.ai

We retain your data for as long as your account is active or as needed to provide services. After account deletion: • Account information is deleted within 30 days • Teaching session data may be anonymized and retained for analytics • Payment records are retained as required by law (typically 7 years) • Backup copies are purged within 90 days **Security log retention** Security event logs and the associated security telemetry (including IP address, IP hash, event type, and timestamp) may be retained for security, compliance, auditing, abuse-prevention, and incident-investigation purposes. We aim to retain routine security events for up to 90 days, and we may retain records related to confirmed abuse, fraud, or security incidents for longer where necessary to investigate the incident, enforce our Terms, or comply with applicable law.

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place, including: • Standard contractual clauses approved by relevant authorities • Data processing agreements with all third-party providers • Compliance with applicable data transfer regulations

SkillTeach is committed to complying with applicable data protection laws: **GDPR (EU/UK)**: If you are in the European Economic Area or United Kingdom, you have rights under the General Data Protection Regulation. We process your data based on legitimate interests, contract performance, or your consent. **Nigeria Data Protection Act (NDPA 2023)**: For users in Nigeria, we comply with the Nigeria Data Protection Act 2023, ensuring lawful processing, data minimization, and respect for your privacy rights as a data subject. We will update this policy as regulations evolve to maintain compliance.

If you are located in the European Economic Area (EEA) or United Kingdom, this section outlines your rights and our obligations under the General Data Protection Regulation (GDPR). **Lawful Basis for Processing** We process your personal data based on: • **Contract Performance**: To provide SkillTeach services you have requested • **Legitimate Interests**: To improve our services, prevent fraud, and ensure security • **Consent**: For optional features like marketing communications (you can withdraw anytime) • **Legal Obligations**: To comply with applicable laws and regulations **Your GDPR Rights** You have the right to: • **Access**: Request a copy of your personal data we hold • **Rectification**: Correct any inaccurate or incomplete data • **Erasure**: Request deletion of your data ("right to be forgotten") • **Restriction**: Limit how we process your data in certain circumstances • **Data Portability**: Receive your data in a structured, machine-readable format • **Object**: Object to processing based on legitimate interests or direct marketing • **Withdraw Consent**: Withdraw consent at any time where processing is consent-based **Data Retention Summary** • Account data: Retained while active, deleted within 30 days of account closure • Session & feedback data: Retained while active, deleted with account • Payment records: Retained for 7 years (legal requirement) • Security logs: Routinely retained for up to 90 days; records tied to confirmed abuse, fraud, or security incidents may be retained longer where necessary for investigation, enforcement, or legal compliance. **GDPR Requests** To exercise your GDPR rights or submit a data-related request, contact our Data Protection contact: **Email**: support@skillteach.ai We will respond to your request within 30 days. You also have the right to lodge a complaint with your local data protection authority.

SkillTeach is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of SkillTeach after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, please contact us: **Email**: contact@skillteach.ai **GDPR/Privacy Requests**: support@skillteach.ai We aim to respond to all inquiries within 48 hours.

SkillTeach requires access to your device microphone to enable voice-based features, including teaching simulations, pitch practice, and interview sessions. Microphone access is only used when you actively initiate a recording session. We do not access or record audio without your knowledge or consent. **When Microphone Is Used** • Teaching Sessions: To record your explanations for AI feedback • Pitch Mode: To practice and refine your presentation delivery • Interview Practice: To simulate interview responses and receive feedback **Your Control** • You must explicitly grant microphone permission before any recording • Recording only occurs when you tap the "Start Recording" button • You can revoke microphone permission at any time through your device settings • No background audio collection occurs **Data Handling** • Audio recordings are transmitted securely to our servers for processing • Recordings are used solely to generate AI-powered feedback • Audio data is handled in accordance with our data retention policies outlined in Section 6