Privacy Policy
Last updated 10 October 2026.
SkillsLedger ("we", "us") provides a skills-tracking application to organisations, each on their own private instance. This policy covers the personal data we collect through our marketing site and account area (skillsledger.co.uk and account.skillsledger.co.uk) and, briefly, how data works inside a customer's own instance.
On this page
1. Who we are
SkillsLedger is the data controller for the personal data described in this policy. You can reach us at hello@skillsledger.co.uk. If your organisation has incorporated us into a data processing agreement, our registered company details are provided there on request.
2. What data we collect, and why
| Data | Why we collect it | Legal basis |
|---|---|---|
| Name, work email, company name | To create your trial and your SkillsLedger account | Performance of a contract |
| Password (stored as a salted hash, never in plain text) | To secure your account | Performance of a contract |
| Billing name, address, VAT number | Invoicing and legal/tax compliance once you buy seats | Performance of a contract; legal obligation |
| Job title (optional) | Shown on your account, entirely optional | Consent |
| Two-factor authentication secret and recovery codes (if enabled) | To secure your account, at your choice | Consent / legitimate interest in account security |
| Basic usage analytics (pages viewed, approximate location from IP) | To understand how visitors use the site and improve it | Consent — see Cookies below |
| IP address, request logs | Rate limiting, abuse prevention, security | Legitimate interest |
3. Data inside your own SkillsLedger instance
Once your trial is provisioned, your team's skills data (names, skill ratings, certificates, objectives) lives in a private database dedicated to your organisation — never pooled or shared with any other customer. That data is controlled by your organisation, not by SkillsLedger directly; we process it on your behalf as it relates to running the service. Your organisation's own admin can export or permanently erase any individual's data at any time from within the application.
AI features
SkillsLedger's optional AI features (such as skills-report summaries, career-path suggestions, skill suggestions and report building) send the data needed for that request to our AI provider, Anthropic: for example a person's name, work email, skill ratings and the skills they want to develop. Anthropic processes it only to produce the response, on our behalf. Under Anthropic's commercial terms, data sent through its API isn't used to train its models. AI-generated content can be inaccurate, so it should be checked before it's relied on. See our Terms of Service.
Your organisation's admin can switch any AI feature off, and a switched-off feature never sends data to an AI provider. Your organisation can also connect its own AI key (Anthropic's Claude, OpenAI or Microsoft Azure OpenAI). When it does, AI requests go to that provider under your organisation's own agreement with them, not ours, and your organisation is responsible for that arrangement.
4. Who we share data with
We use a small number of service providers ("processors") to run SkillsLedger. We don't sell personal data, and we don't share it with anyone for their own marketing purposes.
- Microsoft — Entra ID (if your organisation connects SSO) and Microsoft Graph (for sending account-related emails such as password resets).
- Google Analytics — aggregate site-usage analytics, only if you accept analytics cookies. Data may be processed on servers outside the UK/EEA, covered by Google's Standard Contractual Clauses.
- Anthropic — the AI model behind SkillsLedger's AI features (see section 3). Data is processed in the United States, covered by Anthropic's Data Processing Addendum, which includes the Standard Contractual Clauses and the UK Addendum.
- Cloudflare — content delivery and security filtering in front of our servers.
- Our hosting infrastructure — where the application and databases run.
- A payment processor — once card payments go live, to handle billing; we don't store full card numbers ourselves.
5. How long we keep it
We keep account and billing data for as long as your account is active, plus a period afterward where we're required to for tax and accounting purposes. If you delete your account, we remove personal data beyond that statutory retention window. Your organisation's own skills data is retained until your admin deletes it or your tenant is closed and purged.
6. Cookies
We use a strictly necessary cookie to keep you signed in, and — only with your consent — Google Analytics cookies to understand site usage. See our Cookie Policy for the full list and how to change your choice.
7. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure of your data
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time, where we rely on consent (e.g. analytics cookies)
To exercise any of these, email hello@skillsledger.co.uk. For data held within your organisation's own SkillsLedger instance (your team's skills data), your organisation's admin is usually the right first point of contact, since they control that data day to day.
8. Contact and complaints
Questions about this policy: hello@skillsledger.co.uk. If you're unhappy with how we've handled your data, you also have the right to complain to the UK's supervisory authority, the Information Commissioner's Office (ICO).
We may update this policy from time to time; the date at the top shows when it last changed.