Privacy policy

Controller

SkillManager is the controller of the data described here. For any question or request: contact@skill-manager.fr.

Data we process

• Account: email address, name and profile picture if you add them, sign-in data. Authentication is handled by Clerk.
• Billing: your plan, subscription status and dates, Stripe customer id, invoices. Card details, billing address, and VAT number are entered into and kept by Stripe; we never see your card number.
• CLI devices: device name (machine name), when it was connected and last used. The sign-in token is stored only as a hash.
• Catalog use: which agents and versions you fetch, how often, and when.
• File marking: installed agent files contain an invisible identifier derived from your account, used to trace the source of a leak.
• Teams: team name, members, and roles. Team admins see each member's email address and connected devices (name and last use). Private agents written by a team are stored for that team and visible only to its members.
• Blog comments: the name and picture shown when you post, and the comment text.
• Feedback form: your message, your email if you give it, the page and browser used.
• Analytics: pages viewed and actions in the app, through PostHog hosted in the European Union, without cookies and without identifying you. Unique visitors are counted with a hash computed on the server (IP address and browser) that is renewed every day with a key that is then destroyed.

Why, and on what basis

• Providing the service (account, agent installs, devices, teams): performance of the contract.
• Billing and accounting: performance of the contract and legal obligation.
• Security and preventing abuse or resale of the catalog (device limits, download log, file marking): legitimate interest in protecting the service and its content.
• Improving the product with anonymous, cookieless analytics: legitimate interest.
• Answering your feedback and comments: legitimate interest, or your request.

Processors

We use the following providers, each only for its own function:

• Clerk: authentication and team management (United States).
• Stripe: payments, subscriptions, and invoices (European Union and United States).
• Cloudflare: website hosting and delivery.
• Railway: API hosting.
• Supabase: database (European Union, Ireland).
• PostHog: analytics (European Union).

Transfers outside the European Union

Some providers may process data in the United States. These transfers rely on the safeguards of the GDPR: the EU–US Data Privacy Framework where the provider is certified, or the European Commission's standard contractual clauses.

How long we keep data

• Account and related data: as long as the account exists. When the account is deleted, it is erased from the database, including team memberships and devices.
• Invoices and accounting records: 10 years, as required by law.
• Devices: until revoked or until the account is deleted.
• Feedback form: as long as needed to handle the request.
• Database backups: kept for a limited time, then deleted.

Your rights

You can access, correct, or erase your data, ask for a copy in a portable format, restrict its processing, or object to it by writing to contact@skill-manager.fr.

If you believe your rights are not respected, you can lodge a complaint with your data protection authority (in France, the CNIL: cnil.fr).

Cookies and local storage

The site only uses the cookies and local storage it needs to work: sign-in (Clerk), payment (Stripe), and preferences (theme, language). Analytics sets no cookies, which is why no consent banner is shown.