Privacy Policy

Last updated: July 16, 2026

This Privacy Policy explains how SkillVault AI ("SkillVault," "we," "us"), a product of CM Tech Software, handles information when you visit our website and use our software-as-a-service platform (the "Service"). We've written it to be plain and specific so you know exactly what data we handle and how.

1. Two kinds of data, two roles

SkillVault handles two distinct categories of data, and our role differs for each:

• Account & website data — information about the people who sign up and administer an account (e.g., your name, email, billing details). For this data we act as a data controller.
• Customer Data (workforce records) — the employee, skills, certification, and training records a customer organization uploads about its own workforce. The customer organization is the controller of this data; SkillVault is a processor / service provider that processes it only on the customer's documented instructions to provide the Service. We do not use Customer Data for our own purposes, sell it, or use it for advertising.

If you are an employee whose information was uploaded by your employer, your employer is the controller of that data — please direct access or deletion requests to them, and we will support their handling of your request.

2. Information we collect

• Account data: name, work email, organization name, role, and a salted, hashed password.
• Customer Data you upload: employees, departments, skills and proficiency levels, certifications and licenses with expiry dates, training records, and documents you attach.
• Billing data: processed by Stripe. We never receive or store full card numbers — only a payment/charge identifier, card brand, last four digits, and amount.
• Usage & server logs: IP address, user-agent, pages requested, and timestamps, retained approximately 30 days for security and troubleshooting.
• AI request logs: if you use AI Insights, we log the prompt and response so your administrators can audit usage. AI is opt-in.
• Essential cookies: a session cookie and a CSRF-protection cookie. These are strictly necessary for the site to function. We use no advertising or cross-site tracking cookies.

3. How we use information

We use account, billing, and usage data to provide, secure, bill for, and support the Service, and to communicate with you about your account. We process Customer Data solely to deliver the Service to the customer organization under its instructions. We do not use Customer Data to train AI models.

4. What we do not do

• We do not sell or "share" (as defined under California law) personal information.
• We do not use third-party advertising or cross-site tracking technologies (no ad pixels, no Google Analytics).
• We do not use Customer Data to train our or any third party's AI/ML models.

5. Service providers & sub-processors

We share data only with vendors who process it on our behalf under contract, limited to what's needed to run the Service:

• Stripe — payment processing and subscription billing.
• Hostinger — VPS hosting / infrastructure (United States region).
• AI providers (Anthropic, OpenAI, Microsoft Azure) — engaged only when you explicitly run an AI Insights analysis. These providers do not train their models on data submitted through their APIs. You can disable AI entirely or supply your own API keys.

We will update this list when sub-processors change. We do not sell data to anyone.

6. International data transfers

SkillVault is operated from the United States and our infrastructure is US-based. If you access the Service from outside the US, you understand your data will be processed in the US. Where we engage AI providers, processing may occur in their US data centers. For customers subject to the GDPR/UK GDPR, we make a Data Processing Addendum available with appropriate transfer safeguards (e.g., Standard Contractual Clauses) — contact us to execute one.

7. Healthcare data (HIPAA)

SkillVault is a workforce-management tool and is not intended to store patient health information. If you are a HIPAA-covered entity and your use may involve protected health information, you must execute a Business Associate Agreement (BAA) with us before uploading any such data. Contact support@skillvaultai.io to request a BAA.

8. Data retention & deletion

We retain account and Customer Data for as long as your account is active. On cancellation, you may export your data from the app. We delete or irreversibly anonymize Customer Data within 30 days of written request or account termination, except where we must retain limited records to comply with law, resolve disputes, or enforce our agreements (e.g., billing records). Server logs roll off at ~30 days; backups are purged on a rolling basis.

9. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to opt out of sale/sharing and certain profiling. We do not sell or share personal information, and we will not discriminate against you for exercising any right.

• U.S. state privacy laws (e.g., California CCPA/CPRA and similar): you may request access, deletion, and correction, and you may appeal a denied request.
• GDPR / UK GDPR: you additionally have the right to object, to data portability, and to lodge a complaint with your supervisory authority. Our lawful bases are performance of a contract, our legitimate interests in operating and securing the Service, and consent where required.

To exercise any right, email support@skillvaultai.io. We verify requests against your account and aim to respond within 30 days (or sooner where required). Requests about employee records are routed to the employer that controls them.

10. Security

HTTPS is enforced site-wide. Passwords are salted and hashed. Card data is handled entirely by Stripe. Customer Data is isolated per organization and access is enforced at the query level. No method of transmission or storage is perfectly secure, but we work to protect your data and continually improve our safeguards.

11. Breach notification

If we become aware of a personal-data breach affecting your data, we will notify affected customers without undue delay and as required by applicable law, and will support customers in meeting their own notification obligations.

12. Children

The Service is a B2B workforce tool intended for adults in a work context. It is not directed to children, and we do not knowingly collect personal information from anyone under 16.

13. Changes to this policy

We may update this policy from time to time. We will revise the "Last updated" date and, for material changes, provide notice through the Service or by email before the change takes effect.

14. Contact us

SkillVault AI — a product of CM Tech Software
Reno-Sparks, Nevada, USA
support@skillvaultai.io · (775) 229-2579