Privacy Policy

Effective April 29, 2026

Who we are

ReSkill is operated by Agentic Intelligence Systems, Inc., a Delaware corporation (“we”, “us”). For GDPR purposes we are the data controller for personal data processed through the Service. Contact: hello@tryreskill.com.

What we collect

ReSkill is an AI coaching app. To make it work we collect:

Account info — name, email, profile photo (via Clerk), team membership, subscription status.
Coaching content — every message you send and every response from the agent, plus inferred state about which AI concepts you know, which opportunities you’ve worked on, and your daily review streak. AI-generated summaries and inferred learning state about you are personal data and subject to the same access, correction, and deletion rights as the messages themselves. This is the product; we cannot run it without storing your conversations.
Usage telemetry — page views, button clicks, error events, feature flags evaluated, latency, and aggregated event counts. Sent to PostHog. Not used for advertising; used for debugging, prioritization, and measuring whether the coaching is working.
Session replay — anonymized recordings of how you interact with the page (clicks, scrolls, mouse movement). Form inputs and any element marked sensitive are masked before recording. Used to diagnose bugs and improve UX. Stored 30 days, then deleted automatically.
Notifications — if you opt in to push, your browser’s push subscription endpoint and timezone (so we don’t ping you at 4 a.m.).

What we do not collect

Passwords (Clerk handles authentication).
Payment card numbers (Stripe handles checkout).
Your contact list, calendar, files, or anything outside ReSkill.
Behavioral profiles for advertising. We don’t sell or share your data with ad networks.

Cookies and local storage

We use cookies and browser local storage to keep you signed in (Clerk), remember your session for analytics (PostHog), and store your preferences (theme, notification settings). We do not use third-party advertising cookies.

Sub-processors

Each sub-processor receives only the data it needs to do its job, governed by its own terms and a data-processing agreement where required. All current sub-processors store data in the United States.

Clerk (US) — authentication and account management.
Supabase (US, us-west-2) — primary application database: your account, opportunities, sessions, learning state.
Vercel (US) — hosting, edge config, build analytics.
Anthropic, OpenAI (US) — LLM inference. Your messages are sent for inference and are subject to each provider’s data-handling policy. By default these providers do not train on API traffic and we have not opted in to any training program.
PostHog (US Cloud) — product analytics and session replay.
Stripe (US) — payment processing. We never see your card number.
Resend (US) — transactional email (review reminders, account notifications).
Slack (US) — only if you connect Slack: stores an OAuth token to deliver coaching nudges to your DM.
Neo4j AuraDB (US) — graph storage for the canonical AI-concept catalog and your personal learning graph.

International data transfers

If you access ReSkill from the EU, UK, or EEA, your data is transferred to the United States for processing. We rely on the EU-US Data Privacy Framework (and its UK extension) where the recipient is certified, and on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum) otherwise. By using the Service you also consent to these transfers.

Where data lives

Production application servers and databases are hosted in the United States (Supabase us-west-2, Vercel US edge regions). Sub-processor locations are listed above.

How long we keep it

Session replays: 30 days, then deleted automatically by PostHog.
Telemetry events: 12 months, then aged out.
Coaching content (messages, learning state, opportunities): kept while your account is active. Deleted within 30 days of account deletion.
Authentication and audit logs: 12 months.
Backups: rolling 30-day window before purge.

Your rights

Regardless of where you live, you can email hello@tryreskill.com to:

Access a copy of your data.
Correct inaccurate data.
Delete your account and all associated data.
Export your conversation history and learning state.
Opt out of analytics and session replay.

Identity verification. Before fulfilling an access, export, or deletion request we may require you to confirm the request from your account email or sign in to the Service, to prevent impersonation.

Response timeframes. We respond to GDPR requests within 30 days and CCPA/CPRA requests within 45 days. We may extend once where the request is complex; we will tell you why.

Appeals. If we deny a request you may appeal by replying to our denial email; an appeal is reviewed by someone who did not handle the original decision.

If you are in the EU/UK (GDPR)

You additionally have the right to restrict processing, object to processing, and lodge a complaint with your local data protection authority. Our lawful bases are (a) contract — we need your data to run the coaching app you signed up for; (b) legitimate interest — debugging, fraud prevention, improving the product; (c) consent — for analytics and session replay, which you can withdraw at any time. EU/UK/EEA visitors see a consent banner before analytics capture begins.

If you are in California (CCPA/CPRA)

You have the right to:

Know what personal information we collect, use, disclose, and retain.
Access and obtain a copy of your personal information.
Correct inaccurate personal information.
Delete personal information.
Opt out of sale or sharing of personal information (we do not sell or share personal information).
Limit use of sensitive personal information (we do not use sensitive personal information beyond providing the Service).
Be free from retaliation for exercising these rights.
Appeal a denial as described above.

We do not engage in automated decision-making that produces legal or similarly significant effects about you.

Business customers (B2B)

If your employer or organization administers your access through a ReSkill team plan, the organization is the controller of your workplace data and we are the processor on its behalf. Business customers may request a Data Processing Addendum at hello@tryreskill.com.

Security

All traffic is HTTPS. Database connections use TLS. Service-role keys are stored in encrypted environment variables, never in client code. We follow standard SOC 2-aligned practices for engineering access (we are not currently SOC 2 certified). If you discover a security issue, please email hello@tryreskill.com — we’ll respond within two business days.

Data breach notification

If a personal-data breach is likely to result in risk to your rights or freedoms, we will notify you without undue delay and, in the EU/UK, notify the relevant supervisory authority within 72 hours where required by GDPR. We will tell you what happened, what data was affected, and what we are doing about it.

Marketing vs. transactional email

Today we send transactional email only — review reminders, account notifications, and security alerts — because they are necessary to operate the Service. If we ever send promotional email, it will be opt-in (or opt-out where law permits), and every promotional message will include an unsubscribe link.

Relationship to our Terms

You retain ownership of the messages and content you submit to the Service. Your operating license to us is described in our Terms of Service, §5.

Children

ReSkill is for working professionals. We do not knowingly collect data from anyone under 16. If you believe a child has signed up, contact us and we’ll delete the account.

Changes to this policy

We’ll post any updates here and bump the effective date at the top. If a change materially expands what we collect or how we use it, we’ll notify account holders by email at least 14 days before it takes effect.

Contact

Questions, requests, or complaints: hello@tryreskill.com.