Legal terms and privacy

Who we are

skillfora is run by skillfora B.V., a company registered in the Netherlands: Overtoom 141, 1054HG Amsterdam. Chamber of Commerce number: 42122023. You can reach us about anything on this page at [email protected].

What skillfora does

skillfora helps organisations understand the skills their roles need and the skills their people have. Organisations use it to:

describe roles as skill profiles, with the level each skill is needed at
keep a shared library of skills and a job level framework
keep a list of their staff, and compare each person's skills with their role
upload documents, such as job descriptions or staff lists, so we can suggest profiles, frameworks and people to start from
ask fora, our AI assistant, for help drafting and comparing

Who is responsible for what

Our customers are in charge of their staff's data. When an organisation adds its staff to skillfora, or uploads documents about them, the organisation is the controller of that personal data and we are its processor. That means we only use it to provide skillfora to that organisation, following its instructions and our data processing agreement (DPA) with it. If you work for one of our customers and have a question about your data, please ask your employer first. We will help them answer you.

We are in charge of a smaller set of data. We are the controller for the accounts of people who sign in to skillfora, for people who join our waitlist or newsletter or ask for an ROI report, and for visits to this website.

What data we handle

Accounts: name, email address, organisation and role (admin or member) of people who sign in.
Staff records: name, email address, team, role, manager, a status (OK, flight risk, ready for promotion, or misplaced) with an optional note, and skill ratings.
Content: skill profiles, comments, conversations with fora, and documents an organisation uploads.
Audit log: a record of what changed and when. It identifies people by an internal ID only, never by name or email.
Website: email addresses given to join the waitlist or newsletter or to get an ROI report, and anonymous visit statistics.

Please do not upload special categories of personal data, such as health, religion or trade union membership. skillfora does not need them.

How we use AI

skillfora uses Claude, an AI model made by Anthropic, to read uploaded documents, suggest skill profiles, frameworks and staff records, and to answer questions in fora. To do this, the relevant documents, messages and staff details are sent to Anthropic when a request is made.

AI only suggests. Nothing the AI proposes is saved to an organisation's data until an admin has reviewed it and accepted it, and it can be changed or deleted afterwards.
No automated decisions. skillfora does not make decisions about people on its own. It gives organisations information to help their own people make decisions.
No training on your data. Under Anthropic’s commercial terms, Anthropic may not train its models on what we send it or what it sends back. Anthropic deletes this data within 30 days, unless its safety systems flag a request, in which case it may keep it for up to 2 years.

Third parties we use

We use these companies (sub-processors) to run skillfora. Each one only gets the data it needs for its job, under a contract that protects it.

Supabase — database, sign-in, transactional emails and file storage for the skillfora app. Regions: EU Central and EU West.
Render — hosting for the skillfora app and this website, in Frankfurt, Germany.
Anthropic — the AI model behind document reading and fora. Anthropic is based in the United States; we contract with Anthropic Ireland, Limited. Transfers outside the EU are protected by the EU Standard Contractual Clauses in Anthropic's data processing addendum.
Plausible Analytics — visit statistics for this website. It does not use cookies and does not collect personal data. Hosted in the EU.
Sanity — the content of this website. It does not hold any customer or staff data.

We will tell our customers before we add or replace a sub-processor, so they can object.

How long we keep data

Some data is deleted automatically every night once it is old enough:

Uploaded documents: 1 month after upload.
AI suggestions made from uploaded documents: 1 month after they were made.
Resolved comment discussions: 1 month after they were resolved.
Notifications: 1 month after they were sent.
Conversations with fora: 6 months after the last message.

Other data is kept until the organisation deletes it, or until our contract with the organisation ends. We delete an organisation's data within 60 days of the contract ending, unless the law requires us to keep it. The audit log identifies people by ID only, so once a person is deleted it can no longer be linked back to them.

Your rights

Under the GDPR you can ask to see the personal data held about you, have it corrected or deleted, limit or object to how it is used, and get a copy in a format a computer can read.

If your employer uses skillfora, they hold your data, so please ask them. Their admins can edit or delete your record, and download everything skillfora holds about you as a single file. If you contact us directly, we will pass your request to your employer and help them deal with it.

For data we are in charge of, such as your account or a waitlist signup, email [email protected]. We will reply within one month.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

How we keep data safe

Each organisation's data is kept separate. This is checked in our application and again by the database itself.
Staff records can only be seen by an organisation's admins, not by other members.
All data is encrypted in transit with HTTPS, and at rest with AES-256 — the database, uploaded files and backups alike.
Changes are recorded in an audit log, and access to production systems is limited to the people who need it.

Data protection impact assessment (summary)

Because skillfora evaluates employees' skills and uses AI, we have assessed the risks to the people whose data it holds. This is a summary.

Risks and how we reduce them

Wrong or unfair conclusions about a person, such as a "flight risk" label. AI only suggests; an admin reviews everything before it is saved, labels can be changed or removed, and a note explains each one.
Colleagues seeing each other's data. Staff records are visible to admins only, enforced twice.
Another organisation seeing data. Each organisation's data is kept separate and this is tested.
Keeping data longer than needed. The automatic deletion schedule above.
Data leaving the EU. Only what a request needs is sent to Anthropic, under contractual safeguards, and it is not used for training.
People not knowing their data is used. Customers must tell their staff; this page and our DPA help them do so.
People finding it hard to use their rights. Admins can correct, delete and export a person's data in a few clicks.

We think the remaining risk is low. We review this assessment at least once a year and whenever skillfora changes in a way that affects personal data.

What we ask of our customers

Have a lawful basis for adding staff to skillfora, and tell your staff you use it.
Only upload what skillfora needs, and no special categories of personal data.
Use the tools in skillfora to act on your staff's requests about their data.

Changes to this page

We will update this page when something changes and change the date at the top. If a change matters to customers, we will tell them directly.