Privacy Policy

Scope, and which product this covers

This policy covers:

• The website at www.skilldrift.org.
• SkillDrift Career Launchpad, the platform an institution deploys for its students and staff, including each institution's own environment on its own subdomain.

It does not cover the consumer SkillDrift platform at www.skilldrift.ai. That is a separate product, with a separate database, a separate user base and its own privacy policy. If you signed yourself up for something, you are on the consumer product, not on Career Launchpad, because Career Launchpad has no self signup at all.

It also does not cover your institution's own systems, its own website, or any third party service your institution asks us to connect to. Those are governed by their own policies.

Who is responsible for your information

This is the part that changes everything else, so it comes first.

If you visit our website, book a demonstration or email us, SkillDrift is the controller of your information. Ask us, at legal@skilldrift.ai.

If you work at an institution and we are talking to you about buying or running the platform, SkillDrift is the controller. Ask us.

If you are a student or a member of staff inside an institution's environment, your institution is the controller and SkillDrift is the processor, acting on its instructions. Ask your institution.

In plain terms: if you are a student using Career Launchpad, your institution decided to deploy it, decided who is in it, and decides what happens to your data in it. We hold and process that data for your institution under a written agreement, and we do not use it for our own purposes. Send your request to your institution. If you send it to us, we will pass it on and support your institution in answering it.

Where we act as processor, our Data Protection document sets out the terms, and the institution's own privacy notice sits alongside this one.

What we collect from website visitors

• Information you give us when you book a demonstration: first name, last name, email address, organisation name, your role, and a phone number if you choose to give one.
• Information you give us when you email us or speak to us: whatever is in the message, plus your contact details and the record of the conversation.
• Technical and usage information collected after you accept analytics cookies: IP address, device and browser type, pages viewed, referring page, the marketing parameters in the link you arrived on, and interactions such as clicks and scroll depth.
• Meeting records: the fact, date and content of a meeting we hold with you, and our notes on it.

We do not ask website visitors for special category data, and you should not send it to us.

Why we use it, and on what basis

Arranging and holding a demonstration you asked for: steps taken at your request before a contract, or our legitimate interests.

Replying to your enquiry: our legitimate interests in being able to answer people who contact us.

Understanding how the website is used and improving it: your consent, given through the cookie banner.

Sending information about the product to institutional contacts: consent where required, otherwise our legitimate interests in business communication, with an opt out in every message.

Keeping records of our sales and contracting activity: our legitimate interests, and legal obligation where record keeping is required.

Security, fraud prevention and protecting the website: our legitimate interests, and legal obligation where it applies.

Where we rely on legitimate interests, we have considered your interests and rights, and you can ask us for that assessment.

Cookies and analytics on the website

The website uses two analytics services to understand traffic and how the pages are used. They record events such as page views, clicks and scroll depth, and they store the marketing parameters of the link you first arrived on so that we can attribute an enquiry to the channel that produced it.

Nothing is loaded until you choose. When you first arrive you are asked to accept or decline analytics cookies, and no analytics script runs, no cookie is set and nothing is stored on your device until you accept. If you decline, none of it loads at all.

Two further points worth stating clearly:

• Our website analytics are kept entirely separate from the analytics of the consumer product. They are separate properties, not a shared one.
• No marketing or advertising technology is loaded inside an institution's environment. The tenant subdomains carry no marketing tag of any kind.

Analytics data is retained for no longer than 14 months.

How long we keep visitor information

• Demonstration bookings and enquiries that do not become an opportunity: 24 months from last contact.
• Records relating to an institution we are in an active sales conversation with: for the duration of the conversation and 24 months after it ends.
• Contract and finance records: for the period required by applicable law, commonly six to seven years.
• Website analytics: no longer than 14 months.

How you got an account

Your institution created it, or created it through its identity provider. You did not sign yourself up and you could not have. There is no self signup for Career Launchpad, for anyone.

That means we never obtained your data from you as a customer. We received it from your institution, or you entered it into your institution's environment.

What is processed inside an institution's environment

Depending on what your institution has enabled and what you choose to do:

• Identity and account data: name, institutional email address, student or staff identifier, department, programme, cohort, year, role and permissions.
• Profile data: what you enter in your profile, and what is extracted from a resume you upload.
• Documents you upload: resumes, transcripts, certificates and similar supporting documents.
• Academic data your institution provides or you enter, such as a grade band on your institution's own grading scale.
• Assessment data: your responses, including written responses, and the scores derived from them.
• Voice data, where voice features are enabled and you use them. See section 12, which explains that the audio itself is discarded.
• Interview practice data: session transcripts and the coaching feedback produced.
• Career and learning data: career paths you open, gap analysis, learning plans, completions, knowledge check results, saved jobs, job matches, tailored resumes and cover letters.
• Usage and engagement data: activity in the platform, progress, and quality signals about how an attempt was completed.
• Placement data your institution records about you, such as pipeline stage and outcome.
• Communications: announcements sent to you, and support requests you raise.
• Technical data: log data, IP address, device and browser information, and security and audit records of actions taken in the environment.

Why it is processed

Only to provide the platform to you and to your institution, and to keep it secure and working. In particular:

• To give you your report, your career paths, your gap analysis, your learning plan, your job matches, your interview practice and your resume.
• To compute your Career Readiness Score and to explain its movement.
• To give your institution the aggregated views it uses to run its careers and placement function, and the individual views its staff are permitted to see.
• To operate security, audit trails, support and service integrity.
• To meet legal obligations that apply to us as processor.

We do not use student data to advertise, we do not sell it, and we do not use it to train models.

Model providers

Some features are produced with the help of a third party model provider. Three things govern that.

• Direct identifiers are removed before content is sent to a model provider. Your name, email address, student identifier and similar are stripped, so the provider receives the substance of the content without your identity attached.
• Model providers are contractually prohibited from using anything sent to them to train their own models.
• The platform is model agnostic by design. An institution may require a different model provider where its own policy demands it, and where an institution runs the generative components on its own infrastructure, its own provider is used and we are not the processor for that processing.

The named provider in use, with the country in which it processes data, is given to any institution on request and to every institution under agreement.

Where artificial intelligence is used, and where it is kept out

Artificial intelligence is used to produce narrative, matching, plans, simulated interviews, coaching feedback and drafted documents.

It is kept out of the places where a reproducible number matters:

• Your Career Readiness Score is computed deterministically in our backend from measured components. It is not a language model's impression of you.
• The reason your score moved is derived from the change in those components.
• Cohort level views for your institution are built from underlying responses, with no model in the path.
• Where the platform generates an institution level interpretation, the model receives aggregated information and no student data.

No decision producing legal effects for you, or similarly significantly affecting you, is made by automated means alone on the platform. Where your institution makes a decision that affects you and uses platform outputs as one input, that decision is your institution's, and your institution is accountable for it. You can ask your institution how it reached it.

Voice and interview sessions

Some parts of the platform involve spoken answers, including voice questions in the assessment and voice and live interview practice.

You are told before a session is recorded.

The audio is discarded once it has been processed. What is kept is the transcript and the coaching report produced from it. Institutional staff can see that transcript and report where their permissions allow. Nobody can play back your voice, because the audio is not retained.

Who sees your data

• Staff at your institution, according to the permissions your institution grants them. Assume your institution can see your activity and results in its environment.
• Our own personnel, only where needed to operate and support the platform, under confidentiality obligations and access controls, and with administrative actions logged.
• Our subprocessors, being the service providers we use to run the platform. They fall into four categories: cloud hosting, model providers, communications delivery and support tooling. The current list, naming each subprocessor, the processing it carries out and the country in which it processes data, is provided to any institution on request and to every institution under agreement, with 30 days notice before any change.
• Third party systems your institution instructs us to connect to, such as its identity provider, learning management system, student information system or placement system, limited to the data needed for that connection.
• Authorities or advisers where we are legally required to disclose, or where disclosure is needed to establish or defend a legal claim. Where we receive a request for institutional data and we are lawfully able to, we redirect the requester to the institution and tell the institution.

We do not disclose a student's individual data to an employer or recruiter. Employer facing information is the institution's to share, on its own terms, with the student's knowledge.

International transfers

Environments are hosted in Singapore unless another region is agreed with the institution in its order form. Other regions are supported where an institution's own requirement calls for one, including deployment on the institution's own infrastructure.

Where personal data is transferred out of the European Economic Area, the United Kingdom or another country whose law restricts transfers, we rely on an approved transfer mechanism, which for most transfers means the European Commission's standard contractual clauses, with the United Kingdom addendum where the United Kingdom is involved, together with any additional measures the transfer assessment requires.

Ask us and we will tell you where a given environment sits.

How long data is kept inside an environment

Your institution sets retention within its agreement with us. As a default position:

• Data stays in the environment while the institution's agreement is running and while your account is active in it.
• When the agreement ends, the institution has 30 days to export its data, and we then delete personal data from live systems within a further 30 days.
• Backups age out on a 30 day cycle, so deleted data is removed from backups within that cycle.
• We may keep data where applicable law requires it, and we may keep aggregated information that cannot identify any individual.

Security

We protect data with measures appropriate to the risk, including isolation of each institution's environment with its own database and subdomain, encryption in transit and at rest, role based access control enforced at the interface layer rather than only in the user interface, a one time passcode sent to the registered email address on administrative access, with the option to bind administrative accounts to the institution's own identity provider so that its authentication policy governs them, audit logging of administrative actions, least privilege access for our own personnel, separation of development and testing from production with no production personal data used outside it, tested backup restoration, and review of subprocessors before appointment.

The full description of our technical and organisational measures is in our Data Protection document and is what an institution's IT reviewer should read.

No system is perfectly secure. If a personal data breach affects an institution's environment, we notify the institution without undue delay and within 72 hours of becoming aware, under our Data Protection document, and the institution notifies students and regulators where the law requires it.

Your rights

Depending on where you live, you may have the right to ask for access to your personal data, correction, deletion, restriction, objection, portability, and withdrawal of consent where processing is based on consent. You may also have the right to complain to your data protection authority.

Where to send the request:

• Inside an institution's environment: send it to your institution. Your institution is the controller and will answer it. We support the institution and act on its instruction.
• As a website visitor or a business contact: send it to us at legal@skilldrift.ai and we will answer it.

You can also take your profile with you. A student may export her profile from Career Launchpad at any time and, at her own initiative, upload it to the consumer SkillDrift product to seed a new profile there. It is a handover and not a synchronisation: it carries her data only and nothing institutional, and it creates a new profile in a different product.

We do not charge for a request, and we respond within the time the applicable law allows, normally one month. We may need to verify who you are before we act, which is a protection for you.

Exercising a right never means losing access to your institution's environment. That access is your institution's to grant or remove.

Children and young people

Career Launchpad is deployed by institutions for students. Where an institution provisions users below the age of digital consent in their country, the institution is responsible for obtaining any consent or authorisation the law requires and for telling us that such users are in the deployment, so that appropriate handling applies.

We do not knowingly collect data from children through our website.

Changes to this policy

We may update this policy. Where a change is material, we will give notice on this page and, for institutional deployments, to the institution. The version and date at the top always tell you which version you are reading. Previous versions are available on request from legal@skilldrift.ai.

Contact

Data protection, security and procurement: legal@skilldrift.ai

General and sales: sales@skilldrift.ai

Website: www.skilldrift.org

SkillDrift Inc, 4 Calvert Street, Newport, Rhode Island 02840, United States.

SkillDrift Inc is incorporated in Delaware, United States, with offices in Newport, Rhode Island, Singapore, and Kolkata, India.