This policy explains what Skill Deck does with personal data. It was written to meet the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) and the California Consumer Privacy Act (CCPA). Region-specific sections are at the end.

This policy is also available in Portuguese and Spanish.

Skill Deck LTDA ("Skill Deck", "we") is a company registered in Brazil under CNPJ 67.748.313/0001-01, with its registered office at Rua Pais Leme 215, conj. 1713, Pinheiros, São Paulo, SP, CEP 05424-150.

Privacy contact: [email protected]

Data protection officer (LGPD Art. 41): Gustavo Paiva, at [email protected]

You may write to us in Portuguese, English, or Spanish.

1. We never record a meeting. Bots are configured for transcription only. Audio goes through our transcription vendor to become text, and is never recorded or stored. Video is not processed at any point.
2. Raw content does not survive. Meeting transcripts stay in a temporary cache for 7 days and are then deleted. They are never written to our database.
3. We keep the conclusions, not the recordings. What remains is the analysis: scores, score history, written evaluations, and short excerpts.
4. Only the account holder is evaluated from a meeting. In a meeting with several people, we analyze the behavior only of the person whose calendar scheduled the bot. Other participants are context, never the subject of evaluation.
5. We do not sell personal data, we do not run advertising, and we do not use tracking cookies.

Skill Deck holds two roles at the same time, and the distinction matters for your rights.

We are the controller of each person’s development data. Skills, scores, score history, evidence, and evaluations belong to the person and follow them if they change employer. We decide how that data is analyzed and retained, so we are the controller for it, and you exercise your rights directly with us.

We are the processor of organization data. When a company hires Skill Deck for its teams, that company is the controller of organization configuration, team structure, license assignment, and the manager views built on top of them. We follow that company’s instructions on those points, and a request about them may be forwarded to the company.

If you are not sure which case applies to your request, write to [email protected]. We will handle it or forward it, and we will tell you which of the two we did.

We collect the information you send when you create an account, complete your profile, administer an organization, pay for the service, or ask for support.

To collect meeting evidence, you may connect:

• Google Calendar or Microsoft Calendar, so the bot can be scheduled on the meetings you choose.
• Zoom, so the bot can join the meeting.

Meetings are the only source of evidence. We do not read email, chat, documents, or files. We do not access Gmail, Outlook, Slack, documents, files, or phone calls to evaluate skills.

When the bot joins a meeting you scheduled:

• Audio goes through the transcription vendor and becomes text. We never record or store audio or video.
• The transcript stays in a temporary cache for 7 days and is then deleted. It is never written to columns in our database.
• The bot stays for a maximum of 2 hours.
• Single-participant meetings are not transcribed.
• A daily job removes expired cache.
• Email addresses are blocked from the raw transcript.

After analysis, what remains is the conclusion, not the recording:

• Meeting metadata, such as date, duration, and participants visible to the account holder.
• Written evaluations on a 0 to 20 scale.
• Scores and score history.
• Short Track and moment excerpts: at most 5 excerpts of up to 500 characters each.
• Communications you exchange with us.
• Sharing settings you choose, including an optional public profile.

When you use the site or the product, we also record limited technical data:

• Access logs.
• Device and browser.
• IP address.
• Product use, such as pages and features you open.

We use privacy-focused anonymous site analytics, without personal identification. The only cookies we set are necessary session cookies to keep you signed in. We do not use tracking cookies.

On purpose, we do not seek or keep:

• Audio or video recordings.
• Email content (Gmail, Outlook, or any inbox).
• Documents, chat, or phone conversations.
• Biometric data.
• Sensitive data sought on purpose, such as racial origin, health, religion, sexual orientation, or political opinions.

In a meeting with several people, only the account holder whose calendar scheduled the bot is the subject of evaluation. Other participants are context: they appear in the temporary transcript because they were in the conversation, not because we are measuring their performance.

We process those other people’s speech on the basis of legitimate interest, under LGPD Art. 7, IX, to provide the service to the account holder. The raw transcript is deleted in 7 days.

If the account holder creates a Track, optional short excerpts (at most 5 excerpts of up to 500 characters) may include other people’s speech from the same moment in the meeting. Those excerpts exist to illustrate the account holder’s development, not to evaluate anyone else.

For people in Brazil, the LGPD Art. 7 bases we use are these:

Skill Deck uses automated analysis to score the account holder’s behavior across 58 Skills. The result is scores, history, and written evaluations. This is not a hiring or firing tool, and it should not be used as the sole basis for deciding someone’s professional future.

There is a near-zero discard safeguard: valid meetings with more than one participant are rarely dropped from analysis by an automatic failure. Single-participant meetings are not transcribed, by design.

Under LGPD Art. 20, you may ask for an explanation of an automated decision that concerns you and request human review. Write to [email protected]. There is no separate in-product flow; email is the channel.

We keep each category for as long as the purpose requires, and not longer.

Account deletion is permanent. The in-product path is this:

• Open Settings → Profile.
• Confirm by typing your email and password. If the account uses Google or LinkedIn without a password, you will need to re-authenticate with the provider.
• If you own an organization, transfer ownership first. Deletion stays blocked while any organizations remain under your ownership.

When you delete the account, we wipe evidence, evaluations, scores, Journal, Tracks, notifications, and stored files tied to you; we cancel the subscription on this account; and we disconnect integrations. Tax and billing records the law requires us to keep may remain for the legal period.

We use vendors to operate the product. The table below lists categories only. Named recipients and processing regions are in section 11.

When your organization uses Skill Deck, a manager or administrator, as configured by the company, may see:

• Team structure and license assignment.
• Scores, score history, and written evaluations of people in the organization they can access.
• Track progress and other manager views the organization will configure on top of that data.

A manager does not see:

• The raw meeting transcript.
• Audio or video — because they do not exist.
• The evaluation of other people as if those people were the subject of analysis. Only the account holder is evaluated.
• Development data of people outside the organization or outside the reach the company configured.

Skill Deck is a Brazilian company. Operational processing of personal data takes place in the United States, primarily in AWS us-east-1 (Northern Virginia).

For international transfers from Brazil, we rely on the standard contractual clauses in ANPD Resolution No. 19/2024, plus the characteristics in the table below. You may request a copy of those safeguards at [email protected].

You may exercise the rights below. The channel is [email protected], in Portuguese, English, or Spanish. You can also correct account data and delete the account in Settings → Profile.

When we are the processor for the organization, a request about team configuration, licenses, or manager views may be forwarded to the controlling company. We will tell you which of the two paths we took.

The product architecture reduces what needs to be protected: we never record audio or video; the raw transcript stays in cache for 7 days and is then deleted; raw content is never written to the database.

Connections in transit are encrypted with TLS (Laravel Cloud automatic TLS). The managed database and cache sit in US East with provider encryption at rest. Cloudflare edge protections (DDoS and integrity) sit in front of the app. We use HTTP security headers (frame deny, nosniff) and path and bot integrity controls on Cloud. Access controls separate customer accounts, and OAuth tokens are encrypted at rest in our database.

Skill Deck has no SOC 2, ISO 27001, or equivalent certifications.

Skill Deck is intended for people 18 or older. We do not collect children’s data on purpose. If you learn that someone under 18 created an account, write to [email protected] so we can delete it.

Meeting participants who do not have an account may be minors. We do not evaluate them. If their speech appears, it is only context and disappears with the transcript in 7 days, in line with LGPD Art. 14 on the duty of care for children’s and adolescents’ data.

We review this policy at least once a year. When the date at the top changes, the published version applies.

If the change is material — for example a new data category, a new purpose, or a change in controller and processor roles — we will notify you by email or with an in-product notice before the change takes effect.

This annex applies to the processing of personal data of people in Brazil and prevails over the rest of the policy if there is a conflict about rights under Law 13.709/2018.

Controller of individual development data: Skill Deck LTDA, CNPJ 67.748.313/0001-01, Rua Pais Leme 215, conj. 1713, Pinheiros, São Paulo, SP, CEP 05424-150.

Data protection officer (LGPD Art. 41): Gustavo Paiva, [email protected]. You may write in Portuguese, English, or Spanish.

When a Brazilian company hires Skill Deck for its teams, that company is the controller of organization configuration, licenses, and manager views. On those points, Skill Deck is the processor and handles the data under the company’s instructions.

To exercise rights or contact the officer, use [email protected].

This annex is a goodwill annex for California residents. We honor California Consumer Privacy Act rights, including CPRA amendments, to the extent they fit our service, even when Skill Deck may not meet the legal thresholds for those laws to apply.

The categories of personal information we collect, the sources, the purposes, and retention are in sections 4, 6, and 8. We do not collect CCPA sensitive personal information on purpose beyond what you choose to put in your profile.

We do not sell personal data, we do not run advertising, and we do not use tracking cookies. That is why there is no separate “do not sell” button in the product: the practice is already not to sell and not to share for ads.

To exercise California rights, write to [email protected]. If an authorized agent sends the request, we will ask for proof of authorization. If we refuse a request, you may appeal at the same email.

Questions about this policy: [email protected].

[email protected]