Powskill is best on a tablet or laptop - some screens have more room to work there.
Loading
Last updated: [EFFECTIVE DATE]
This Privacy Policy explains how [LEGAL ENTITY NAME & TYPE](“Powskill”, “we”, “us”, “our”) collects, uses, shares and protects your personal data when you use the Powskill website and app at powskill.com (and currently also powskill-v5.vercel.app) (the “Service”).
We’ve written this in plain English because most of our users are students. Where the law uses specific terms (like “lawful basis” or “data controller”), we’ve kept them but tried to explain them simply.
We are the data controllerfor the personal data described here, which means we decide how and why it’s processed. You can reach us using the details in section 13.
Powskill is used by students, many of whom are minors(typically around 15–18, sometimes younger). We take this seriously and design the Service with younger users in mind — for example, marketing is off by default, and we try to collect only what we need.
Minimum age. You must be at least 13 to use Powskill. The Service is not intended for children under 13, and we do not knowingly collect personal information from anyone under 13. If we discover we have collected information from an under-13 without proper consent, we will delete it.
Younger users / guardian consent.Where the law requires it, users below a certain age need a parent or guardian to consent on their behalf before they use the Service or before we rely on their consent to process their data. The exact age depends on the country (under the EU/UK GDPR it can range from 13 to 16). If you are below that age in your country, you may only use Powskill with your parent’s or guardian’s agreement.
If we learn we’ve collected data from a child below the permitted age without the required consent, we’ll delete it. If you’re a parent or guardian and believe your child has given us data they shouldn’t have, contact us (section 13) and we’ll help.
a. Account information
b. Education profile
c. Usage and content
d. Consent and preference records
e. Technical and log data
f. Payment information (Pro users)
Please don’t include unnecessary sensitive information in your answers.Your free-text answers could unintentionally reveal sensitive details (for example about your health, beliefs, or background — what the law calls “special category data”). We don’t ask for this and don’t want it. We process whatever is in your answers only to provide marking and the Service, and we ask you to avoid putting sensitive personal information about yourself or others into your answers where you don’t need to.
If you’re in the EU/UK, the GDPR requires us to have a “lawful basis” for each use of your data. Here’s the breakdown:
| What we do | Why | Lawful basis (GDPR) |
|---|---|---|
| Create and run your account; provide free and Pro features; mark your answers and show your progress | To deliver the Service you asked for | Performance of a contract (Art. 6(1)(b)) |
| Verify your email; keep the Service secure; prevent fraud and abuse; debug and improve reliability | Our legitimate interest in a safe, working Service | Legitimate interests (Art. 6(1)(f)) |
| Send marketing / weekly study emails | Only if you opt in | Consent (Art. 6(1)(a)), withdrawable anytime |
| Process payments for Pro | To take payment for a service you bought | Performance of a contract (Art. 6(1)(b)) |
| Keep records and meet legal obligations (e.g. tax, responding to lawful requests) | Because the law requires it | Legal obligation (Art. 6(1)(c)) |
| Use aggregated/de-identified data to understand and improve Powskill | Our legitimate interest in improving the Service | Legitimate interests (Art. 6(1)(f)) |
Where we rely on consent (such as marketing), you can withdraw it at any time without affecting anything we did before you withdrew it.
This is the most important part to understand.
When you submit an answer for marking, the text of your answer is sent to a third-party AI provider (currently DeepSeek) which generates a mark and feedback that we return to you.
What this means:
Your rights around automated processing.You can ask us about how the automated marking works, share your point of view, and ask us to look into a result. Although we don’t consider AI marking to be a decision that has a legal or similarly significant effect on you (it’s a study estimate), we’ll still handle these requests fairly. See section 10.
We use a small number of trusted companies to run Powskill. They process personal data on our instructions and only to provide their service to us. Current providers:
| Provider | What they do for us | Where / notes |
|---|---|---|
| Supabase | Authentication, Postgres database, and storage — this is where your account, education profile, answers and activity live | Project hosted in Singapore (ap-southeast-1) |
| DeepSeek | AI marking of submitted answers (see section 5) | See international-transfer note in section 7 |
| Resend | Sending transactional emails (e.g. email verification) and — only if you opt in — marketing/weekly emails | Sending domain: powskill.com |
| Optional “Sign in with Google” | Only if you choose Google sign-in | |
| Vercel | Application hosting and content delivery (CDN) | Serves the app and handles related log data |
| Stripe | Processing Pro payments | Processes payment data under its own privacy policy |
We may add, change, or replace providers as Powskill grows. When we make material changes we’ll update this list. Each provider has its own privacy terms, and we put data-protection agreements in place with them where required.
Powskill’s users are international, and some of our providers are based in different countries (for example, Supabase in Singapore, and our AI provider as noted in section 5). This means your data may be transferred to and processed in countries other than your own, which may have different data-protection laws.
When we transfer personal data of EU/UK users to a country that the EU/UK doesn’t consider to provide “adequate” protection, we rely on appropriate safeguards — typically Standard Contractual Clauses (and, for the UK, the UK International Data Transfer Agreement / Addendum) — together with any additional measures needed. You can ask us for more detail (section 13).
We keep your personal data only as long as we need it for the purposes in this policy, then delete or anonymise it.
We take reasonable technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls, and using reputable providers. No system is 100% secure, but we work to keep your information safe and to respond quickly if something goes wrong. If a data breach occurs that legally requires it, we’ll notify the relevant authority and affected users as required.
Depending on where you live, you have rights over your personal data. We honour these for all users where we reasonably can. You can:
California residents (CCPA/CPRA). You have rights to know what we collect, to access and delete it, to correct it, and to non-discrimination for exercising your rights. We do not sell your personal data, and we do not “share” it for cross-context behavioural advertising, so there’s nothing to opt out of there. You can exercise your rights using the contact details below.
To make a request, contact us at [CONTACT EMAIL]. We may need to verify your identity, and we’ll respond within the timeframe the law requires. Using these rights is free, and we won’t treat you differently for it.
We keep cookies to a minimum:
If we ever add non-essential cookies (for example, optional analytics), we’ll ask for your consent first and update this section.
We may update this Privacy Policy as Powskill evolves. If we make material changes, we’ll take reasonable steps to tell you (for example by email or an in-app notice). The “Last updated” date at the top always shows the current version.
For privacy questions or to exercise your rights, contact us at [CONTACT EMAIL].
Data-protection contact: [DATA-PROTECTION CONTACT / DPO IF ANY]
[LEGAL ENTITY NAME & TYPE]
[COUNTRY OF INCORPORATION / REGISTERED ADDRESS]