Privacy Policy
1. Who is responsible Amplivine, Wustermark, Germany. Email: info@skillweb.space.
2. What we collect, why, and on what basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, password (stored only as a protected hash by our login service), confirmation code | Create and secure your account | Art. 6(1)(b) contract |
| First and last name | Your account; for providers, the public name is built from it | Art. 6(1)(b) |
| Address: postcode (required), street and city (optional), country | Show you nearby providers; for providers, set the base location and service area. Street and city are never shown to others. | Art. 6(1)(b) |
| Profile picture (optional) | Shown with a provider's profile once it is published; for customers it is a safety feature for providers | Your consent (Art. 6(1)(a)), given by uploading it. You can remove it at any time in the app, also while your profile is published |
| Provider profile: business name, type, texts, services, prices, service area, references, photos, legal status, VAT number (if entered), the text of your legal notice (Impressum) | Publish your public profile. The text of your legal notice and the client names you enter as references are public as soon as your profile is published, so only enter names with the client's permission | Art. 6(1)(b); client names: Art. 6(1)(f) |
| Documents you upload for checks, with our staff note and the date of each decision | Staff verify qualifications and identity as a trader; stored privately, visible only to you and our staff, never public. Kept while your account exists, so that providers can be identified (trader traceability) | Art. 6(1)(b), Art. 6(1)(c) (duty to know our traders) and Art. 6(1)(f) (trust and safety) |
| Suspension: end date and reason (if your account or profile is suspended) | Protect users and run the service | Art. 6(1)(b) and (f) |
| Notifications in the app (for example "profile is live") | Tell you what happened to your account | Art. 6(1)(b) |
| Notifications and emails about your account (approval, rejection, suspension, "profile is live") | Run the service | Art. 6(1)(b) |
| Language setting, login sessions | Keep you logged in; the login service stores sessions. [Confirm the session length in Neon Auth.] | Art. 6(1)(b) |
| Technical server logs (IP address, time, requested page) kept by our hosting provider Vercel, and a salted hash of your IP address kept 24 hours to limit translation requests | Operate and secure the service | Art. 6(1)(f) |
| Camera and photo library access on your phone | Only when you choose to take or pick a picture or document; pictures are uploaded only when you confirm | Your choice; consent in the phone's permission dialog |
| Provider texts sent to the translation function, and the translations we store | Translate public profile texts when a visitor presses the translate button (see section 4). Stored translations are not linked to your account | Art. 6(1)(f) |
| Result of the AI check of a document: verdict, confidence, short reason when not approved, date, whether it was a spot check | Help our staff check documents; approve clearly fine documents faster | Art. 6(1)(b) and (f) [confirm] |
| Time at which you accepted the Terms and the Privacy Policy when registering | Prove that you agreed to the terms | Art. 6(1)(b) and (f) |
| Date of birth (optional; read from your ID card if you scan it, or typed in by you) | Check that providers meet the age requirement; never shown to others | Art. 6(1)(b) and (c) [confirm] |
| Requests, quotes (with a numbered PDF), bookings, chat messages and photos, reviews | Run the marketplace between customer and provider | Art. 6(1)(b) |
| Payment data: amount, status and time of each payment and payout, invoices and receipts (for providers also the invoice details you enter) | Take and pay out payments, create invoices and receipts, keep tax records | Art. 6(1)(b) and (c) (accounting and tax duties) |
| Photo of your ID card, if you scan it to fill in your details (not stored) | Suggest your name, date of birth and address | Your consent (Art. 6(1)(a)), given by using the scan, and Art. 6(1)(b) |
We do not use advertising, tracking or analytics cookies. We use only what is needed to keep you logged in. [Confirm when the website gets analytics: then add a consent banner.]
3. Who sees your data
Public: the published profile (public name, picture, texts, photos, services, prices, service area, references).
Staff of SkillWeb who check documents and run the service.
Service providers (processors) working for us, under data-processing agreements:
- Neon (database, login and file storage; servers in Frankfurt, Germany),
- Vercel (hosting of the website and the app's server; Frankfurt region),
- Resend (sending emails),
- OpenRouter and the AI model provider behind it (translation, see section 4, the check of documents, see section 4a, and reading your ID card, see section 4c),
- Stripe Payments Europe, Ltd. [confirm the legal entity and address] (payments and payouts, see section 4b).
[Confirm the agreements are signed, and add the full company names and addresses.]
Authorities, where the law requires it.
4. Translation When a visitor presses the translate button, the public texts of that provider's profile (biography, strengths, experience, skills, service titles and descriptions, and reference descriptions, loaded from our database, not from the visitor's device) are sent to an AI language model through OpenRouter (which forwards them to the model provider) and the translated text is returned. Names, emails, addresses and documents are never sent. Translations are stored and reused for other visitors. Texts you write in these fields may contain names of other people, so please do not enter personal data of third parties there. [Confirm with OpenRouter's terms that the chosen model does not train on the data, and whether some data leaves the EU; if so add transfer safeguards (standard contractual clauses).]
4a. Automated checks of documents (AI) When you upload a document for verification, it may be read by an AI model service as an aid to our staff check. The service is a third-party AI model provider reached through OpenRouter (our processor, under a data processing agreement [confirm signed]); data is processed in the EU where available [confirm]. The document is sent once, with the provider's settings for no training and no retention. We store only the verdict, the confidence and, when a person must step in, a short reason that contains no ID number, date of birth or address; nothing read from the document is stored. A person decides every case the AI does not clearly approve, and checks a random sample of the rest. Photo ID images are deleted 30 days after the check has finished and with your account. Legal basis: Art. 6(1)(b) and (f) GDPR [confirm with the lawyer, with the data protection impact assessment]. You can export the results ("Your data" under Account) and delete them ("Delete my account"); you can also write to info@skillweb.space.
4b. Payments Payments for bookings are processed by Stripe Payments Europe, Ltd. [confirm legal entity and address], an independent payment provider. Customers enter their card details on Stripe's own payment page; we never see or store card numbers. A provider who wants to receive payouts gives Stripe the details Stripe needs to verify identity and bank account, in a form hosted by Stripe; Stripe is responsible for those checks and for that data under its own privacy policy [add the link]. We receive from Stripe the status of each payment and payout and keep the amount, the time, the status, the booking it belongs to, the commission and any refund, and we create invoices and receipts from them. Stripe may process data outside the EU on the basis of an adequacy decision or standard contractual clauses [confirm]. Legal basis: Art. 6(1)(b) and (c) GDPR. We keep payment records, invoices and receipts for the period the law requires for accounting and tax records [period to be confirmed by the tax adviser].
4c. Filling in your details from your ID card (optional) In the app, under Account, you can photograph your ID card to fill in your name, date of birth and address instead of typing them. Only you start this, and only if you have accepted the Terms. The photo is sent once, with the settings for no training and no retention, to the same AI model service as in section 4a, which suggests the values. We do not store the photo, and the card number and other numbers are not read or stored. You see every value, you can change it, and nothing is saved until you tap Save. What you save is stored in your account like anything you type in yourself. The date of birth is private, never shown to other users, and used to check that providers meet the age requirement. Legal basis: your consent (Art. 6(1)(a) GDPR), given by using the scan, and Art. 6(1)(b). You can always type the details in yourself instead, and you can change or delete your date of birth in the app or delete your account. [Confirm with the lawyer and in the data protection impact assessment.]
5. Transfers outside the EU Our main servers are in Germany. Some processors may process data in other countries (for example the United States). Where this happens we rely on an adequacy decision or standard contractual clauses.
6. How long we keep data
- Account and profile data: until you delete your account. Deleting your account in the app removes your data immediately and for good: profile, photos, services, references, notifications and login, apart from what is listed in the next point.
- Documents: kept while your account exists. You can replace a document by adding the new one first and then deleting the old one. When you delete your account, the verification documents you submitted, together with your basic trader details (name, business name, email, address, legal status, VAT number and legal notice), are kept for 6 months because of our legal duty to be able to identify traders, and then deleted automatically. During this time they are used for nothing else. Photo ID images are the exception: they are deleted at once, with your account. [Legal review pending: if this duty does not apply to Amplivine, this point is removed and everything is deleted immediately.]
- Documents you uploaded but did not submit, and notifications: deleted with the account.
- AI results of documents: deleted with the document and with your account. Photo ID images: deleted 30 days after the check has finished.
- Date of birth: kept while your account exists and deleted with it.
- Payment records, invoices and receipts: kept for the period the law requires [to be confirmed with the tax adviser and the lawyer: how this fits with the deletion of your account].
- Technical logs: kept by Vercel for [its retention period, to be confirmed]; the hashed IP address for translation limits: 24 hours.
- Emails we send are processed by Resend, which keeps them for [period to be confirmed].
7. Your rights You may ask for access to your data, correction, deletion, restriction of processing, a copy in a common format (data portability), and you may object to processing based on legitimate interest. Where processing relies on consent you can withdraw it at any time. You can do most of this yourself in the app, under Account: "Export my data" gives you a copy of your data (JSON or CSV) and "Delete my account" erases it, as described under retention. For anything else write to info@skillweb.space; we answer within one month and may ask you to write from your registered email address. You can complain to a data protection authority, in particular in your country or federal state of residence or at our seat: [competent authority for Amplivine's state].
8. Security and data breaches Data is transmitted encrypted (HTTPS). Private data such as your address and documents is protected by access rules in the database so each person can only reach their own data. Our staff can see addresses and documents to do their checks; staff accounts are limited by role and their changes are logged. Published pictures and portfolio photos are stored in a public storage location and are reachable by their web address. If a breach puts your rights at risk we tell you without delay and inform the data protection authority within 72 hours. Report security problems to info@skillweb.space.
9. Children SkillWeb is not meant for people under 18, and by registering you confirm that you are at least 18.
10. Changes We update this policy when the service changes. The date is shown below. Last updated: 04/11/2026.