Privacy Policy

SkillCort is a work-sample based skill assessment platform operated by SkillCort LLC, a limited liability company registered in Florida, USA ("SkillCort", "we").

Controller identity (for processing where SkillCort is the controller): SkillCort LLC — 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA. Contact: privacy@skillcort.com.

1. Roles: who is the controller, who is the processor?

SkillCort processes personal data in two distinct capacities. Which capacity applies determines who you should direct your rights requests to:

If you are a candidate: the organization that invited you decides why and how your data is processed. Please direct privacy requests to that organization first. If you contact us, we will forward your request to them without delay and support its fulfilment (see Section 10).

2. What we process, why, and on what legal basis

The tables below map each processing activity to the data involved, the purpose, and the legal basis (GDPR Art. 6; Turkish DP Law Art. 5–6). Data is collected by fully or partly automated means when you use the platform or submit a form.

2.1 Candidate data (controller: the customer organization, which confirms the applicable bases)

2.2 Customer account data (controller: SkillCort)

2.3 Website visitors and marketing (controller: SkillCort)

We do not process your data for purposes beyond these tables. If a new purpose arises, we will inform you first and obtain consent where required.

3. Proctoring data — specific disclosure

Proctoring features are off by default. They run only when the organizing customer enables them, and only after the candidate is clearly informed before the assessment starts and gives separate, explicit consent. Nothing is monitored that the candidate has not been shown.

Depending on the organization's configuration, proctoring may process:

• Camera: periodic photos (every 30 seconds) or continuous video recording
• Screen: periodic screenshots or continuous screen recording
• Behavioral integrity signals: tab/focus switches, fullscreen exits, copy/paste events, print attempts, large text pasted into an answer field, disconnections, and a liveness heartbeat

How signals work (profiling disclosure):these events are recorded on a timeline and aggregated by rule-based counters into an integrity summary ("clean / minor events / requires review"). This may constitute profiling within the meaning of GDPR Art. 4(4). We commit to the following:

• No single signal ever automatically rejects a candidate. Signals only give human reviewers context; the evaluation decision always rests with a human (see Section 8).
• AI-assisted review, human adjudicated: when a reviewer opens a session, AI may scan camera frames, screen captures and the microphone transcript and flag moments worth opening; every flag receives an explicit human confirm-or-dismiss verdict. AI never runs unattended during an exam and never decides.
• The platform performs no face recognition against galleries and stores no biometric templates, and does not cross-match identities between candidates. Where an organization enables identity verification, an automated one-to-one face-verification estimatemay compare the candidate's selfie with their ID photo (computed on the reviewer's device or via a dedicated verification service in the EU region); no template is stored and a person always makes the identity decision. Camera recordings nonetheless contain imagery of a person, and we expect customer organizations to assess them against special-category data requirements in their own jurisdictions.
• Proportionality:organizations can enable only what they need (photos instead of video, screen only, etc.); we recommend the least intrusive configuration that satisfies the assessment's purpose.

Retention and deletion: proctoring records are deleted automatically at the end of the retention window set by the organization (default: 90 days). Organizations can also erase the records of any attempt immediately on demand. Deletion covers stored media files, metadata, and event records together.

4. AI-assisted features

• AI does not make decisions about candidates; its outputs are signals reviewed by a human evaluator.
• Candidates are informed when AI is used in an assessment.
• Model training: our AI subprocessors are bound not to train on this content (OpenAI does not use API content for training and retains inputs up to 30 days for abuse monitoring; Anthropic's commercial terms prohibit training on customer content). SkillCort builds no models on candidate data; avatar rendering receives only authored question text, never candidate data.
• We build no cross-customer candidate profiles, hidden reputation scores, or shared candidate memory.

5. Who we share data with

We do not sell personal data. We disclose it only to the recipients below, for the stated purposes:

Data processing agreements (DPAs) are in place with all subprocessors; changes to the subprocessor list are announced on this page.

6. International transfers

Platform data is hosted in the European Union (Frankfurt, Germany — Supabase and Vercel). As SkillCort is established in the United States, data is accessible from the US for the operation of the service; transactional email (Resend) and AI processing (OpenAI, Anthropic, HeyGen) take place in the US as described in Section 5.

• Transfers out of Türkiye rely on the standard contracts published by the Turkish DPA under Art. 9 of the Turkish DP Law (as amended in 2024), notified to the Authority within the statutory period.
• EU/UK-to-US access/transfersrely on each provider's executed Standard Contractual Clauses under GDPR Art. 46 and, where the provider is certified, the EU-U.S. Data Privacy Framework (Vercel, Resend, OpenAI, HeyGen — verified 3 Aug 2026), supported by documented transfer impact assessments and supplementary measures.

7. Retention

We fix retention periods per data category, in advance and in a documentable way:

Audit records of score and decision history are kept append-only for accountability and remain subject to retention rules.

8. Automated decision-making and profiling

We do not make solely automated decisions producing legal or similarly significant effects about you (GDPR Art. 22). Integrity signals and AI outputs may involve elements of profiling (see Sections 3–4); they are always subject to human review. See Section 10 for how to object.

9. Security

Data is encrypted in transit and at rest. Tenant data is separated; access follows role-based, least-privilege controls. Proctoring media is stored in a private, non-public bucket. Backups run daily. If unlawful access is detected, we notify the competent authority and, where required, you (GDPR Art. 33–34; Turkish DP Law Art. 12(5)). No method of transmission over the internet is 100% secure.

10. Your rights and how to exercise them

Under GDPR Art. 15–22 and Turkish DP Law Art. 11 you may access, rectify, and erase your data, restrict processing, learn of transfers, receive a portable copy, object, and contest automated outcomes. Where processing relies on consent, you may withdraw it at any time with future effect.

• Candidates: address requests to the organization that invited you. If you contact us at privacy@skillcort.com, we will forward your request to them without delay.
• Account users and site visitors: write to privacy@skillcort.com. We respond free of charge within 30 days.
• If unsatisfied, you may lodge a complaint with the Turkish Personal Data Protection Board (kvkk.gov.tr) or, where GDPR applies, your local supervisory authority.

11. Cookies

Strictly necessary cookies (session, security) run without consent. Any other cookie (including analytics, if used) is off by default and runs only with your opt-in consent. See the Cookie Policy for each cookie's name, purpose, duration, and party.

12. Changes

Material changes are announced on this page with a new effective date; registered users are additionally notified by email. Prior versions are available on request.

13. Contact

SkillCort LLC
7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA
Email: privacy@skillcort.com