Privacy Policy

The data controller for the processing described in this Policy is 4cs BV, a private limited company (besloten vennootschap) incorporated in Belgium, with its registered office at Lindekensweg 3, 2160 Wommelgem, Belgium and enterprise number BE 1014.832.509. In this Policy, "we", "us" and "our" refer to 4cs BV, operating the SKØØLSKILL service at dev.skoolskill.com and related domains (the "Service").

You can reach our privacy team at [email protected] or by post at the address above, for the attention of "Privacy".

This Policy applies to personal data we process when you visit our marketing website, create an account, use the Service (including scanning notes, practicing, chatting with our AI tutor Nova, participating in classes and leaderboards, and making purchases), contact our support, or otherwise interact with us. It does not apply to third-party sites or services that we link to — those operate under their own privacy policies.

We collect the following categories of personal data:

3.1 Account & profile data

• Email address, display name, and (if you sign in with Google) your Google account identifier.
• Authentication data (password hashes, session tokens, sign-in timestamps, device and browser information).
• Birth year, preferred language, time zone, and any optional profile fields you add.
• Class memberships, invite codes you redeem, and — if you are a minor — the parental contact information described in section 6.

3.2 Learning content you provide

• Images of notes and documents you upload to be scanned.
• Text extracted from those uploads ("atoms"), the skills they map to, and the practice questions generated from them.
• Your answers to practice questions, mistakes, mastery scores, streaks, deadlines, study sessions, and any messages you exchange with the Nova AI tutor.

3.3 Usage & device data

• Pages you view, features you use, performance and error logs, IP address, approximate location derived from IP, browser type and language, and device identifiers.
• Interaction events needed for gamification (XP, coins, hearts, quests) and for operating and improving the Service.

3.4 Billing data

• Plan type, monthly subscription status, AI-usage allowance and consumption, gem balance and transactions, purchase history, country of billing, and VAT details you provide.
• Payment card and billing data are processed directly by Stripe — we receive only a tokenised reference and limited metadata (last four digits, brand, country). We never see or store full card numbers.

3.5 Communications

• Emails or messages you send us for support, feedback, abuse reports, or legal requests, together with our responses.

3.6 Data we do not knowingly collect

• We do not ask for, and should not be sent, special categories of personal data under Article 9 GDPR (health, ethnicity, religion, biometrics, sexual orientation, etc.). If you choose to include such data in notes you upload, you do so at your own initiative; we treat it with the same safeguards as other uploaded content and do not use it to profile you.

We only process personal data for the specific purposes listed below. For each purpose we rely on a legal basis set out in Article 6(1) GDPR:

You have the right to object to processing based on legitimate interests — see section 10.

Several SKØØLSKILL features rely on large language models: scanning notes (OCR), matching them to skills, generating practice questions, and chatting with the Nova tutor. To power these features we send the minimum necessary content — such as an uploaded image, a study excerpt, or your chat message — to Anthropic, PBC over the Claude API, and sometimes through OpenRouter Inc. acting as a neutral routing layer.

What this means in practice:

• We do not currently use your content to train any AI model, and we have not authorised our AI providers to train on API content you send through the Service.
• Anthropic has publicly committed that API inputs and outputs from its commercial products are not used to train its models by default. See Anthropic's explainer: privacy.anthropic.com — "Is my data used for model training?"
• Anthropic may retain API content for a limited period for trust-and-safety and legal purposes, in line with its own published policies. See Anthropic's Privacy Policy and Commercial Terms of Service.
• A user-facing setting ("Help improve the AI") is available in Account Settings and is off by default. Enabling it signals your consent for us to use anonymised practice data to improve our models and features in the future. Even for users who opt in, we do not currently run any training pipeline; if that changes we will update this Policy, give reasonable prior notice, and re-confirm consent where legally required before any new training purpose begins.
• AI output can be wrong, incomplete, biased, or out of date. You are responsible for verifying anything you rely on for real coursework, grades, or decisions. See the Terms of Service for the full disclaimer.

EU AI Act. SKØØLSKILL is a study aid. We have assessed the classification of our AI functionality against Article 6 and Annex III, point 3, of Regulation (EU) 2024/1689 (the AI Act), which in principle classifies AI systems used in education to evaluate learning outcomes and to steer the learning process as high-risk. The Service is not used to determine a person's access to education, to grade formal assessments, or to allocate admissions. On the basis of Article 6(3) of the AI Act, we consider that the adaptive learning functionality, given its limited and supporting role alongside the regular educational path, does not pose a significant risk to the health, safety, or fundamental rights of the user.

Minimum age — 13. SKØØLSKILL is not offered to anyone under 13 years of age, anywhere. We do not knowingly create accounts for children under 13 and we do not knowingly collect personal data from them. If we become aware that a user is under 13, we will close the account and delete the associated personal data on the schedule described in section 11.

Digital-consent age in the EEA. Under Article 8 GDPR each EEA Member State sets the digital-consent age for information-society services at between 13 and 16 (Belgium 13, Italy 14, France 15, Germany and the Netherlands 16, etc.). Where the digital-consent age in the user's country of residence is higher than 13, a parent or legal guardian must give consent on the child's behalf below that age — and in any case, see our stricter "under 18" rule below.

Stricter internal rule — parental involvement under 18. Regardless of the local digital-consent age, we require parental involvement for any user under 18:

• During onboarding we ask for the user's year of birth. If the user is under 18, we require them to provide a parent or legal guardian's email address and to confirm that the parent/guardian has given permission for the child to use the Service. We then send a request to confirm parental consent to that email address, with a unique confirmation link that the parent or guardian must activate themselves. The child's account is only fully activated once this confirmation has been received. Without confirmation, access to the Service remains limited.
• We store that email on the child's account as a contact address for the parent or guardian. We use it to respond to requests made on behalf of the child, to notify the parent/guardian about material service or policy changes where appropriate, and for account-safety communications.
• A parent or legal guardian may at any time ask us to access, export, correct, suspend, or delete the child's account, by emailing [email protected] from the address on file or by providing reasonable proof of authority.
• We do not knowingly collect or use a child's personal data for behavioural advertising, and we do not sell or rent children's data.

United States — COPPA. SKØØLSKILL is a general-audience service that is not directed to children under 13 within the meaning of the U.S. Children's Online Privacy Protection Act (COPPA). We do not knowingly collect, use, or disclose personal information from a child under 13 in the United States. A U.S. parent or guardian who believes a child under 13 has provided personal information to us can contact [email protected] to request deletion.

United Kingdom — Age Appropriate Design Code. For users in the UK, we design the Service consistently with the principles of the Children's Code (Age Appropriate Design Code) issued by the Information Commissioner's Office, including data minimisation, default privacy-protective settings, and no behavioural advertising to children. UK GDPR applies to UK users in addition to (and where stricter, in place of) the EU GDPR references in this Policy.

If you believe a child under 18 has created an account without appropriate parental involvement, or that a child under 13 has created an account at all, please contact us and we will take prompt action.

We share personal data with a small set of service providers ("sub-processors") that help us run the Service. Each one is bound by a written contract that restricts them to processing data only on our documented instructions and to the same security and confidentiality standards.

We will update this list when sub-processors change. Material additions that affect how your data is processed will be notified in advance via email or an in-app notice.

We also disclose personal data to competent public authorities, courts, or law-enforcement bodies where we are required or legally permitted to do so, and to professional advisers (lawyers, accountants, auditors) bound by confidentiality, where strictly necessary. The detailed rules on when and what we disclose to authorities are set out in section 7 of this Policy's companion: the Terms of Service, section 16 (Law enforcement & legal requests). Authorities may contact us at [email protected]; this address also serves as our Article 11 (authorities) and Article 12 (recipients) single point of contact under the Digital Services Act.

Access inside 4cs BV. Access to your personal data by our personnel is restricted to staff who need it for a specific legitimate task (support, abuse handling, security, billing, legal, engineering during an incident). Access is logged and covered by written confidentiality obligations. We do not routinely view the contents of your notes, scans, or Nova chats.

Content moderation is complaint-driven. We do not pre-screen the content you upload. We act on specific notices of illegal content (see section 14 of the Terms), on orders from competent authorities, and on signals from our automated abuse-detection systems that flag specific platform-wide abusive patterns.

We do not sell your personal data, and we do not share it with advertisers for targeted advertising.

Some of our sub-processors are established outside the European Economic Area, primarily in the United States. When personal data leaves the EEA we put in place at least one of the transfer mechanisms recognised under Chapter V GDPR, typically:

• an adequacy decision by the European Commission (for example the EU–US Data Privacy Framework, where the recipient is certified), or
• the European Commission's Standard Contractual Clauses (Decision 2021/914), supplemented where appropriate by additional technical and organisational measures (encryption in transit and at rest, pseudonymisation, access controls).

You may request a copy of the relevant safeguards by contacting [email protected]. We may redact commercially sensitive terms.

We keep personal data only as long as we need it for the purposes described in this Policy:

• Account & profile data: for as long as your account is active, and up to 12 months after closure, so you can reactivate without losing progress.
• Uploaded notes, atoms, questions, attempts, mastery records: for as long as your account is active; you can delete individual items at any time from the Atoms screen.
• Nova chat history: kept to give you continuity across sessions; you can delete individual conversations at any time.
• Authentication and security logs: up to 12 months.
• Billing records & invoices: retained for 7 years after the end of the financial year to which they relate, as required by Belgian tax and accounting law.
• Support correspondence: up to 3 years after the case is closed.
• Backups: rotated on a maximum 35-day cycle; data in backups is restored only in disaster-recovery scenarios and is overwritten in the normal course of the rotation.

When a retention period ends we either delete the data or anonymise it irreversibly so it can no longer be linked to you.

Subject to the conditions set out in the GDPR, you have the right to:

• Access — obtain confirmation that we process your data and a copy of it (Art. 15).
• Rectification — have inaccurate data corrected or incomplete data completed (Art. 16).
• Erasure — ask us to delete your data in the situations listed in Art. 17 ("right to be forgotten").
• Restriction — ask us to limit processing while a dispute is resolved (Art. 18).
• Data portability — receive data you have provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible (Art. 20).
• Object — at any time, to processing based on legitimate interests, including profiling, on grounds relating to your particular situation (Art. 21). You can object to direct marketing at any time, no reasons needed.
• Withdraw consent — at any time, where we rely on consent, without affecting the lawfulness of prior processing (Art. 7(3)).
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you (Art. 22). See section 14.

To exercise any of these rights, email [email protected]. We reply within one month (extendable by two further months for complex requests, in which case we will tell you within the first month).

We may ask for reasonable proof of identity before acting on a request, to protect you against impersonation.

You also have the right to lodge a complaint with a supervisory authority. In Belgium, that is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be. You may also complain to the supervisory authority of your habitual residence.

10.1 Additional rights for residents of the United States

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, or another U.S. state with a comprehensive privacy law, you may have additional rights under that state's law, which can include the rights to know what personal information we hold about you, to request a copy or deletion, to correct inaccurate information, and to opt out of certain categories of "sale", "sharing", or "targeted advertising" as defined by your state's law.

SKØØLSKILL does not "sell" your personal information for money, and we do not "share" or process it for cross-context behavioural / targeted advertising, as those terms are defined in California, Virginia, Colorado, Connecticut, and similar state laws. We therefore do not offer a "Do Not Sell or Share My Personal Information" link, but you can still exercise the access, deletion, and correction rights above by emailing [email protected]. We do not discriminate against users who exercise their privacy rights.

Sensitive personal information. We do not ask for sensitive personal information (e.g. precise geolocation, health data, racial or ethnic origin, religious beliefs, sexual orientation), and we do not use any such information that may incidentally appear in your uploaded notes for purposes other than delivering the Service to you.

10.2 United Kingdom

If you are in the UK, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply to your personal data. The rights described in this section apply to you on the same basis, and you may lodge a complaint with the UK Information Commissioner's Office (ICO), ico.org.uk.

We use a small number of cookies and local-storage items:

• Strictly necessary — session cookies (authentication), CSRF protection, and a language-preference cookie. These do not require consent because they are essential to deliver the Service you have asked for.
• Functional — preferences like dark/light mode and onboarding state. These cookies are only set after you have given your consent through our cookie banner. You can withdraw this consent at any time through your cookie settings.
• Analytics / diagnostics — minimal error-monitoring beacons (Sentry) used only to identify crashes and performance issues. We do not use third-party advertising or cross-site tracking cookies.

You can control cookies through your browser. Blocking strictly necessary cookies will prevent the Service from working.

We take reasonable and appropriate technical and organisational measures to protect your personal data, including: transport encryption (HTTPS/TLS), encryption at rest for stored files and database backups, scoped access controls based on the principle of least privilege, audit logs, time-limited authentication tokens, password hashing, rate limiting and abuse detection, regular patching, and segregated production environments.

No system is perfectly secure. You play an important role too: use a strong, unique password, enable two-factor authentication where available, and keep your device and browser updated.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, in line with Articles 33 and 34 GDPR. Where the breach is likely to result in a high risk, we will also notify affected users directly.

The Service uses algorithms to rank questions by difficulty, adapt practice to your weakest skills, generate tutor responses, and award XP, streaks, and leaderboard positions. These decisions affect your in-app experience but do not produce legal effects or similarly significant effects on you in the sense of Article 22 GDPR. We do not use automated decision-making for credit-scoring, insurance, hiring, or similar high-impact decisions.

We may update this Policy to reflect changes to the Service, our sub-processors, or the law. When we make a material change, we will update the "Effective date" above and, for significant changes, give you reasonable prior notice by email or in-app banner. The current version is always available at https://skoolskill.com/privacy.

For any question, request, or complaint regarding your personal data, please contact:

If you are not satisfied with our response, you may lodge a complaint with the Belgian Data Protection Authority (details in section 10) or the supervisory authority of your EU Member State of residence.