Privacy notice

P1. Who we are and what this notice covers

This notice explains what personal data Skilient (Pvt.) Limited collects through Skilient, why we collect it, who we share it with, how long we keep it and what you can do about it. It covers students, graduates, faculty, recruiters, university staff, people who visit our public pages and people who contact us.

This notice applies to the Skilient website and web application at www.skilient.com. We are responsible for the personal data described in this notice. When a university or a company uses Skilient to manage its own records or people, it is responsible for what it does with the information it sees. This notice describes what it can see and the rules it must follow, which are set out in the user agreement.

P2. What we collect

Account and sign-in. Your name, your university or company email address, and your password. Passwords are stored in hashed form, never as plain text. If you use two-factor sign-in, we store your authenticator setup and recovery codes in protected form. If you sign in with Google, we receive your Google account identifier, your verified email address and your name.

Profile. Your photograph, headline, about text, skills, department, programme, batch, city and any links you add.

University status. Your university, department, programme, batch and whether you are a current student or a graduate. We confirm your university from your email address and the university's records.

GitHub. Your GitHub login and numeric account identifier, the repositories you connect (their names, visibility and ownership), commit identifiers and dates, file and line counts, merged pull requests, reviews and approvals that count as evidence, and whether your connection has been revoked. We do not collect your source code or the text of your commit messages.

Activity on Skilient. Your ventures and project updates, posts, comments, polls, events you join or host, applications, messages, friends and blocks, endorsements you give and receive, reports and feedback you write, the answers you give to short surveys, and views of posts, which we count per viewer to rank content.

Credentials and documents. Certificates, letters or transcripts that you upload to support a credential, and the outcome of our review. These are stored privately, and only you and our reviewers can open them.

CV. The signed snapshot of your skills and evidence, your CV settings, your share links, and records of who has viewed your CV and when.

Payments. Your plan, invoice details (including the name and address you give for an invoice), transaction references and amounts from our payment gateways. We do not receive or store your full card number.

Technical data. Your IP address, which we use for security and rate limits and store as a hash wherever we can, your browser and device details, timestamps, error reports and request identifiers in logs. We use cookies that keep you signed in and protect your account. We do not use advertising cookies or cross-site tracking. Analytics, session recordings and performance measurements are described in P7.

Code checks. Where a code check's snippet sits in one of your repositories, your answers to the check, and the outcome of the review. We store the location of the snippet, not the code itself.

P3. Google user data

This section covers the information we receive from Google when you sign in with Google. We call it Google user data.

What we access. When you choose to sign in with Google, we ask Google only for the openid, email and profile permissions. From Google we receive your Google account identifier, the email address on the account and your name. We do not request access to your Gmail, Google Drive, Google Calendar, Google Contacts or any other Google service. We do not copy your Google profile photo. We do not take any action in your Google account other than signing you in.

How we use it. We use Google user data only to provide or improve user-facing features of Skilient that you can see in the app. Those features are: signing you in; confirming that your university email address belongs to a listed university; showing your name and email address in your account; sending your sign-in codes, security alerts and notifications to that email address; and recognising your account when you sign in again. We do not use Google user data for any other purpose.

What we never do with it. We do not use Google user data for targeted, personalised, retargeted, interest-based or other advertising, and we do not use it to serve ads. We do not sell it, and we do not transfer it to advertising platforms, data brokers or information resellers. We do not use it to determine creditworthiness or for lending. We do not use it to create any database other than your Skilient account. We do not use it to develop, improve or train any AI or machine-learning model, personalised or not. Skilient does not send Google user data to any AI or language-model service.

AI and machine learning. Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models.

Who receives it. We share Google user data only with the service providers listed in P6, which process it on our behalf and only as far as they need it to provide the features above. Each of them must protect it under contract and may not use it for its own purposes. We disclose Google user data where the law requires it, and for security purposes such as investigating abuse. Our employees, contractors and agents who handle Google user data must comply with this section.

Who can read it. People read Google user data only: with your affirmative agreement, for example when you ask our support team to look at your account; for security purposes, such as investigating a bug or abuse; where the law requires it; or in aggregated form for our internal operations. Staff access is logged. When a member of staff views your account as you see it, you are notified.

How it is protected. Google user data is encrypted in transit and at rest. It is protected by the same row-level security and access controls as the rest of your personal data, as described in P12.

How long we keep it, and how to delete it. We keep Google user data for as long as your account is active. When you delete your account, we delete it as heading 11 of the user agreement describes. You can start deletion at any time in Settings, or ask us to delete your data by contacting us as described in P14.

Revoking access. You can stop Skilient's access to your Google account at any time at https://myaccount.google.com/permissions. Revoking access stops Google sign-in, but it does not delete your Skilient account. If you signed up only with Google, you can set a password using the password reset page and then sign in with your email address.

Limited Use. Skilient's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. If we change how we use Google user data, we will tell you and ask you to accept the updated notice before you continue to use Skilient.

P4. Why we use your data

We use personal data to provide Skilient to you and run your account, which is necessary to perform the user agreement. We use it to verify identities and evidence, because the service depends on evidence being real and because we have a legitimate interest in stopping fake evidence. We use it to show your profile, skills and activity to the people and organisations that your settings and the rules allow, as described in the user agreement. We use it to send you notifications you have chosen, and security and account emails that the service needs. We use it to keep the platform safe, prevent fraud and enforce the rules, which is a legitimate interest and, where the law requires it, a legal obligation. We use it to take payments and keep tax records, which is necessary to perform our agreement with you and to comply with the law. We use analytics and error reports to understand how the platform works and to fix problems, using masked or aggregated data wherever we can.

Some features depend on your choice. We ask for your choice in the app when a feature needs it, for example before recruiter visibility is turned on or before a recruiter can see your full profile, and you can change the choice in Settings. A university's access to student records is not optional while you are a student there. It is part of the user agreement you accept at sign-up, as heading 6 of the agreement explains, and every access is logged.

We do not sell personal data, and we do not use it for third-party advertising.

P5. Who can see your information

Other students and graduates see what your profile and your privacy settings allow. Your posts are visible to the audiences set for them. Profiles are visible only to signed-in users. Skilient has no public profile pages, and our search engine indexing excludes signed-in pages.

Recruiters see what is described in heading 7 of the agreement. Universities see what is described in heading 6. Faculty see the work of the ventures they supervise or review.

Skilient staff can see your personal data only for a reason, such as support, safety, responding to a report, a legal request or a billing question. Staff need two-factor sign-in, and every time a staff member opens your data it is logged. A staff member can view your account as you only with a recorded reason, and you receive an in-app notice when it happens. Staff cannot act as you.

The public verification page shows a CV's code, status and dates. If a CV has been revoked, it shows only the code and dates. It does not show the rest of the CV.

P6. Who we share your data with

We use service providers (processors) who handle data for us under contract, only to run the parts of Skilient that they provide. They are:

Supabase, which provides our database, sign-in service and file storage. Supabase is hosted in Mumbai, India.

Vercel, which runs our web application and server functions. Our server functions run in Mumbai.

Brevo, which sends the emails we send you, such as sign-in codes, security alerts and notifications. Brevo reports back to us whether those emails were delivered or bounced.

Cloudflare Turnstile, which checks for automated sign-ups and sign-ins.

Sentry, which receives error reports. We remove personal data from those reports before they leave our systems, as far as we can.

PostHog, which provides product analytics and session recordings in its EU region, as described in P7.

Axiom, which holds our application logs for 30 days.

Safepay, our payment gateway for payments in Pakistani rupees.

Paddle, our payment processor and merchant of record for payments in US dollars.

GitHub, which is the source of the evidence you connect. Our GitHub App sends requests to GitHub on your behalf, within the access you have given.

Have I Been Pwned, which checks new passwords against breached-password lists. It receives only the first five characters of a hash of the password, never the password itself.

Google, if you choose to sign in with Google.

We also share information when the law requires it, such as with a court or a competent authority. Before we do, we tell you unless the law prevents us from doing so.

Some of these providers store or access data outside Pakistan. P11 describes where data is held.

P7. Analytics, session recordings and error monitoring

We measure how Skilient is used, so we can find and fix problems and decide what to build next. Our analytics record named events that we have chosen, such as signing up, finishing onboarding, connecting GitHub or sending a message. They are sent to PostHog in its EU region. In PostHog we identify you only by your internal Skilient identifier. We never send names, email addresses, usernames or the content of posts, comments or messages to analytics.

For a sample of sessions (about one in five), we record the screen so that we can see where people get stuck. All form inputs are masked. So is the text of posts, comments, chat messages, CV content, profile about text, and the feed survey, and images in posts and chat are not recorded. We never record chat pages, billing pages, staff pages, sign-in, sign-up or password-reset pages. Recordings are kept for about 30 days and only Skilient staff can view them. We never share them with universities or recruiters.

For a sample of page loads, we measure page speed. We keep those measurements for 14 days. Error reports go to Sentry and application logs go to Axiom, both without personal data where we can manage it, as described in P6 and P8.

P8. How long we keep your data

Your account data is kept while your account is active. When you delete your account, it is removed as heading 11 of the user agreement describes. Invoices and payment records are kept for as long as Pakistani tax and company law requires. Staff action logs, which record who did what to sensitive records, are kept for one year so that we can account for those actions. Reports and sanction records are kept for as long as needed to enforce a ban, decide an appeal or defend a legal claim, and are then deleted or anonymised. Images that are no longer used are removed soon after they stop being used.

Security events are kept for one year. Application logs are kept for 30 days. Analytics events are kept for 13 months. Session recordings are kept for about 30 days. Performance measurements are kept for 14 days. Database backups are kept for seven days and then overwritten. A backup that still holds data you have deleted will be overwritten within that period, and until then it is not used for any purpose except restoring the platform after a serious failure.

P9. Your rights and choices

Inside the app you can edit your profile; choose what others see; turn recruiter visibility on or off; opt out of the leaderboard; see who has viewed you; block people and companies; choose which notifications you receive and whether emails are instant or sent as a daily digest; revoke your CV links and CVs; disconnect GitHub; and delete your account under heading 11 of the user agreement.

You can also ask us, in writing, to tell you what personal data we hold about you, to correct it, to delete it (subject to heading 11 and P8), to restrict how we use it while we check a complaint, or to stop using a choice you have given us. We do not yet offer a self-service download of all your data, so please ask us instead, and we will provide a copy of the personal data we hold about you within 30 days. We may need to check your identity before we act. If you withdraw a choice you gave us, we will stop relying on it from that point, but this does not undo anything we did before. Withdrawing a choice may mean that some features stop working.

If you think we have handled your personal data wrongly, please contact us first so that we can put it right. If the law gives you a right to complain to a regulator, you can also do that.

P10. Children and eligibility

Skilient is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we find that an account belongs to someone under 18, we will delete it.

P11. Where your data is stored and transferred

Our main database and file storage are hosted in Mumbai, India, and our server functions run in Mumbai. Some of our service providers, listed in P6, store or access personal data outside Pakistan, including in the European Union for analytics. Before we transfer personal data to a provider, we make sure that its contract requires it to protect the data, and we send only the data the service needs.

P12. How we protect your data

We protect your data with encrypted connections (TLS) for everything, encryption at rest through our database provider, and row-level security on every table, so that no one can read another person's data unless the rules allow it. Two-factor sign-in is required for staff, recruiters and university admins. Passwords are checked against breached-password lists, using only a partial hash. We limit the rate of sign-ins and other actions. Private files are served only through links that expire after five minutes. We remove location and camera data from images that you upload. We log staff access to personal data.

No system is perfectly secure. If we discover a breach that affects your personal data, we will tell you and the authorities that the law requires, without undue delay. If you find a security problem, please write to security@skilient.com.

P13. Changes to this notice

We update this notice when our practices change. Material changes follow heading 13 of the user agreement, so you will be asked to accept them before you use Skilient again. Each version shows its date, so you can see when it changed.

P14. Contact us

You can reach us at Skilient (Pvt.) Limited, NEIC, IJP Road, I-12, Islamabad. For privacy requests, email security@skilient.com with the subject "Privacy request", or write to us at the address above. For security reports, write to security@skilient.com.