Privacy Policy
skilledrabbit.ai / Skilled Rabbit Version 1.12 · Effective date: 2026-11-06
1. Who We Are
Skilled Rabbit (skilledrabbit.ai) Operated by Sjors van de Wiel, trading as Skilled Rabbit The Netherlands Privacy email: privacy@skilledrabbit.ai General email: hello@skilledrabbit.ai
We are the data controller (Art. 4(7) GDPR) for personal data processed via the skilledrabbit.ai platform. This policy explains what data we collect, why, how long we retain it, who we share it with, and what rights you have. It applies to visitors, learners and waitlist applicants.
Our company details — legal name, registered address and Chamber of Commerce number — are not listed yet: they will be added here once the company that will run Skilled Rabbit has been founded. Until then, every privacy question goes to privacy@skilledrabbit.ai.
Data Protection Officer: we have not appointed one, because our scale and our processing do not trigger the obligation in Art. 37 GDPR. For privacy matters, contact us directly at privacy@skilledrabbit.ai.
2. What Data We Process
2.1 Account Data
When you create an account we collect:
- First name
- Email address
- Password (stored by Supabase only as a one-way hash — never readable), if you sign up with email + password
- Account creation date
- Your acceptance of the tester agreement: which version you accepted, in which language, and when
Your first name and email address are required to create an account. The questions you answer when you start a training are optional and can be skipped.
When you set a password, we check it against known leaked passwords: only the first 5 characters of its SHA-1 hash are sent to the HaveIBeenPwned service, never the password itself.
2.2 Training Progress
- Completed weeks, missions, and checkpoints
- XP and rank
- Timestamp of each completed activity
This data is necessary to deliver the training. The platform cannot function without progress tracking.
2.3 Payment Data
Payments are processed by Paddle, which has two roles: it handles the payment on our behalf, and it is our Merchant-of-Record (the legal seller of record, the counterparty on your invoice, responsible for collecting and remitting VAT). For that second role Paddle's own privacy policy applies as well. We do not store any card data. From Paddle we receive only:
- Payment confirmation (succeeded / failed)
- Which product was purchased
- Transaction timestamp
- Paddle transaction / subscription ID (for support and accounting)
2.4 Communications
- Emails you send us (support, questions), which arrive in our mailbox at Google Workspace
- Content of emails we send you (confirmations, welcome messages), which we send through Brevo
- A notice we send you through Brevo when we find that an answer Finney gave you broke one of our own coaching rules; a person decides each notice, and none is sent automatically
2.5 Technical Data
- IP address — used to limit how often sign-in, sign-in-link and sign-up requests can be made, and to stop abuse. It is kept only in our security records, for 30 days (section 4). Where such a record also holds your email address, it is part of your data export.
- Browser type and version, operating system and device type (desktop / mobile), sent with the product events described in section 6
- The time of each product event
We do not ask for your location. Paddle, as Merchant-of-Record, derives your country from your IP address to calculate VAT.
2.6 Profile Photo (optional)
If you choose to upload a profile photo, we store one copy of it, cropped to a square and re-encoded at 256 × 256 pixels. Before we store it we remove all embedded metadata, including any location (GPS) data your camera or phone added. Only you can see your photo: it is kept in private storage, shown only to your own signed-in session, and never shown to other learners or used for anything else. You can remove it at any time from your profile. Deleting your account deletes it, and your data export includes it.
2.7 Your Learning and Your Work
You start with Private coaching. With Private coaching we keep and use: your progress; your intake and calibration answers; the moments you get stuck, which Finney uses for your hints; the breakthroughs you log in a training, which Finney sees when it answers you; your checkpoint and progress events, which Finney uses for your hints and answers (they include a preview of up to 500 characters of each question you ask Finney); a record of each piece of work you save — which checkpoint, what kind of work, when, and the link if you gave one, but not its text; and your conversations with Finney in the webchat, each message for 90 days (section 4).
With Private coaching Finney builds no picture of how you learn across sessions and trainings (it does see the breakthroughs you log in a training, which are among the moments listed above), and there is no AI quality check of your work and no full Proof of Work dossier or public portfolio.
You can add any of four things, one by one; each one you add makes it Personal coaching. Each is off until you switch it on (consent — section 3):
- “Keep the text of my work” — we keep the text of the work you save while it is on, so Finney can come back to it when you ask and your Proof of Work dossier can be built from it.
- “Let Finney remember how I learn” — every night an AI model turns your intake answers, profile, recent activity and progress into a picture of how you learn (your skill trajectory, observations and a difficulty signal), which Finney then uses in its answers.
- “AI quality check of my work” — an AI model scores each piece of work once, when you save it. For that, the full text of the work is sent to the model, also when “Keep the text of my work” is off. We keep only the score, and you do not see the score yourself. While it is on, we also keep Finney's answers to you for 90 days, so the quality of Finney's coaching can be checked. Each month we read a small sample of these kept answers ourselves and record for each one whether Finney's answer was right, with a one-line note; that verdict is linked to you only as long as the record of the answer is kept, and after that it stays without your name or account.
- “Full Proof of Work dossier and portfolio” — when you finish a training, an AI model builds your full dossier from your progress and, if “Keep the text of my work” is on, from your saved work; you can publish it as a public portfolio.
If your AI tool can show a form, it may ask you to choose there: answering Personal coaching switches all four on with one answer, and answering Private coaching switches none on. You can change each switch at any time in your profile, under Coaching and privacy. Switching one off stops it from then on and asks whether to erase what is already stored.
Please do not share health, religious, political or other special-category information with Finney; your training does not need it. Our filter removes email addresses, phone numbers, bank account numbers (IBAN), Dutch citizen service numbers (BSN) and secrets from free text before it is stored or sent to an AI model; it also replaces names of people and companies, addresses and postcodes, KvK and VAT numbers, dates of birth, amounts of money and percentages with a label such as [company 1]. The filter works with fixed rules on our own server, so it can miss something, and we keep no list of what a label replaced.
2.8 Claude Code and Other AI Tools
Skilled Rabbit installs nothing on your computer and receives no events from Claude Code hooks. Your AI tool connects to us through its standard connector, and we receive only what you or your AI tool send to the Skilled Rabbit tools during your training — such as your questions to Finney, your checkpoints and the work you save.
3. Why We Process Your Data
| Purpose | Legal basis | Data |
|---|---|---|
| Creating and managing your account, and signing you in | Contract performance — Art. 6(1)(b) | First name, email, password hash |
| Granting access to the training you subscribed to | Contract performance — Art. 6(1)(b) | Email, subscription record |
| Tracking training progress | Contract performance — Art. 6(1)(b) | Progress data |
| Finney's coaching in the webchat and in your AI tool | Contract performance — Art. 6(1)(b) | Your question or message, your recent conversation, your training context and the moments you got stuck — sent to Anthropic |
| Connecting your AI tool to Skilled Rabbit | Contract performance — Art. 6(1)(b) | Hashes of sign-in codes and access keys, the tool's name |
| “Keep the text of my work”, “Let Finney remember how I learn”, “AI quality check of my work” and “Full Proof of Work dossier and portfolio” | Consent — Art. 6(1)(a), separately for each switch | What section 2.7 lists for each switch |
| Recording your consent choices, including the form in your AI tool | Legal obligation — Art. 6(1)(c), to prove consent (Art. 7(1)) | Each choice, when you made it and where |
| Recording your acceptance of the tester agreement | Contract performance — Art. 6(1)(b) | The version of the agreement you accepted, its language, and when |
| Processing payments | Contract performance — Art. 6(1)(b); invoices and VAT: legal obligation — Art. 6(1)(c), handled by Paddle | Paddle transaction data (Merchant-of-Record) |
| Sending transactional email | Contract performance — Art. 6(1)(b) | Email, first name |
| Product analytics | Legitimate interest — Art. 6(1)(f) | Product events under a pseudonym |
| Security records and request limits | Legitimate interest — Art. 6(1)(f) | Email address or IP address, sign-in attempts |
| The log of what administrators do, and the record of each time an administrator opened a page showing what you wrote or did | Legitimate interest — Art. 6(1)(f) | Administrator, you, the page, the time |
| The waitlist and the order of its applications | Legitimate interest — Art. 6(1)(f) | Your application and answers |
| Weekly beta check-ins, bug reports you send us, records of the cost of each AI call and of each answer Finney gives, and invitations to a training group | Legitimate interest — Art. 6(1)(f) | Your answers, your report, the cost figure, the invitation |
| Running the service and finding faults (server logs) | Legitimate interest — Art. 6(1)(f) | Your account id, with email addresses and secrets filtered out |
| Customer support | Legitimate interest — Art. 6(1)(f) | Communication content |
| Showing the profile photo you chose | Consent (you choose to upload it, and removing it withdraws it) | Profile photo |
Consent is given separately for each of the four switches of section 2.7. Each is off until you switch it on, and you can withdraw it at any time in your profile, under Coaching and privacy, without any consequence for your training or what you pay.
Where we rely on legitimate interest, we have weighed our interest against your rights in our legitimate-interest assessment; you can ask for it at privacy@skilledrabbit.ai, and you can object (section 10).
We do not send newsletters or marketing email. If we ever do, we will ask for your explicit consent first, and you will be able to withdraw it at any time.
4. How Long We Retain Your Data
We keep each kind of personal data only as long as we need it for what we use it for. The table below gives the period for each kind.
| Data | Retention |
|---|---|
| Account data: your name, email address, password, profile, training progress, Carrots, subscription status, your coaching and privacy choices and your acceptance of the tester agreement | As long as your account exists, and deleted at once when you delete it. If you have not signed in and not used Finney in Claude for 24 months, we email you once; if you do not come back within 30 days, we delete your account. This does not apply while you have an active subscription. |
| Profile photo (optional) | Until you remove it or your account is deleted |
| Your webchat conversations with Finney | Each message is deleted 90 days after it was written. A conversation with no messages left is deleted too. |
| Learning activity: the record of what you did in a training, such as checkpoints, hints and the moments you got stuck, which Finney uses for your coaching and your Proof of Work | Deleted 12 months after it was recorded. Your progress itself stays as long as your account. |
| The text of the work you save (only when “Keep the text of my work” is on) | The text is erased 12 months after you saved it. The record that you saved a piece of work, and for which checkpoint, stays as long as your account. |
| AI quality scores of your work (only when “AI quality check of my work” is on) | Deleted 12 months after the work was scored. |
| Your Proof of Work dossier and public portfolio | The dossier is erased 12 months after it was made, and the public portfolio goes offline with it. Your certificate and the page that verifies it stay as long as your account. |
| The picture Finney builds of how you learn (only when “Let Finney remember how I learn” is on) | Kept while it is on. If you switch it off and choose to keep what is stored, it is erased 12 months after you switched it off. |
| Records of the cost of each AI call made for you | After 90 days the link to your account is removed. The cost figure stays, without your name or account, so our totals stay correct. |
| A record of each answer Finney gives you: when, where in the training, which AI model and prompt version, the result of our automatic checks, and a fingerprint of your question and of the answer from which the text cannot be read back. With “AI quality check of my work” on, the answer text itself too | Deleted 90 days after the answer. |
| Delivery records of the emails we send you (for example delivered or bounced) | Deleted 90 days after the event. |
| Your waitlist application and its answers | If you were invited: deleted 79 days after your invitation, which is 30 days after the last weekly check-in. If you were not invited: deleted 12 months after you applied. |
| Your answers to the weekly beta check-ins | The link to you is removed when your waitlist application is deleted, and at the latest 12 months after you answered. The answers themselves stay, without your name or email address, to help us improve the product. |
| Bug reports you send us | 12 months after a report is closed, the link to your account is removed and personal details are taken out of its description; the report stays as product history. If you delete your account, your reports are deleted. |
| Security records: sign-in attempts, temporary account locks, requests for a sign-in or sample link, request limits (these can include your email address or IP address), and the record of each form we showed you in your AI tool | Deleted 30 days after they were recorded; a temporary lock 30 days after it ended. |
| Connections between your AI tool and Skilled Rabbit (sign-in codes and access keys) | Kept while the connection is in use. A code or key that has expired, has been used or has been revoked is deleted 7 days later. |
| Records of installing the Skilled Rabbit connector in your AI tool | Deleted 90 days after the installation. |
| Invitations to join a training group | Kept while you are a member of the group. An invitation that was never accepted is deleted 12 months after it was sent. |
| The log of what our administrators do, including actions on your account | Deleted 24 months after the entry. If your account is deleted, the entries about it stay for the rest of those 24 months without your name, email address or account. |
| A record each time an administrator opened a page showing what you wrote or did on the platform (who, when, which page) | 24 months after the view. If your account is deleted, the record keeps no link to you. |
| Requests we send to PostHog and Brevo to delete your data there after your account is deleted | Kept only until the deletion there has succeeded. |
| Payment records | Paddle, our payment provider and Merchant of Record, keeps invoices for the 7-year legal tax period. Our record of your subscription is deleted with your account. |
| Support email | 2 years after resolution |
| Marketing consent | Until withdrawn |
| Encrypted backup copies of the data above, made every night so we can recover from a failure | Each copy is deleted automatically 30 days after it was made at the latest. If you delete your account, you can stay in a backup copy for at most 30 days. |
Every night an automatic process deletes or anonymises what has reached the end of its period. Anonymised means the data can no longer be linked to you. When you delete your account, everything above is deleted at once, except what this table says is kept without your name, email address or account, and backup copies, which are deleted within 30 days.
5. Who We Share Data With
We never sell or rent your data to third parties. We use the following processors, each under a data processing agreement:
| Processor | Purpose | Location | Privacy policy |
|---|---|---|---|
| Supabase | Database, authentication and file storage (your profile photo and certificate) | EU (Ireland) | supabase.com/privacy |
| Anthropic | AI coaching (Claude API — Finney) and, with your consent, the four switches of section 2.7 | United States (see below) | anthropic.com/legal/privacy |
| Paddle | Payment processing + Merchant-of-Record | United Kingdom (EU adequacy decision) | paddle.com/legal/privacy |
| Brevo | Transactional email | EU (France) | brevo.com/legal/privacypolicy |
| PostHog | Product analytics (cookieless) and error reports, without your name, email address or what you wrote | EU (eu.i.posthog.com) |
posthog.com/privacy |
| Hetzner | Hosting: the server that runs the platform and keeps its server logs, and the storage of the encrypted backup copies (section 4) | EU (Germany; the backup copies in Finland) | hetzner.com/legal/privacy-policy |
| Google Workspace | The mailbox that receives the emails you send us | Data region not yet confirmed — under Google's terms the mail may be processed in any country where Google or its subprocessors have facilities (see below) | policies.google.com/privacy |
| HaveIBeenPwned | Leaked-password check | Receives only the first 5 characters of your password's SHA-1 hash | haveibeenpwned.com/Privacy |
| Cloudflare | DNS for skilledrabbit.ai only | Not applicable — DNS only: website traffic does not pass through Cloudflare, and Cloudflare receives no learner content | cloudflare.com/privacypolicy |
Stripe (payments) is connected in our code but switched off: it receives no data.
To the extent the GDPR requires it, personal data that Skilled Rabbit sends to Anthropic through the Claude API is transferred under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two and/or Module Three, Art. 46(2)(c) GDPR), which Anthropic's Data Processing Addendum incorporates by reference together with the jurisdiction-specific addenda in its Schedule 3.
Anthropic deletes the inputs and outputs of Skilled Rabbit's API calls on its side within 30 days of receipt or generation, except where a longer-retention service or a separate agreement applies, where a request is flagged under Anthropic's Usage Policy (inputs and outputs up to 2 years, trust and safety classification scores up to 7 years), or where the law requires longer retention.
Google acts as our processor under Google's Cloud Data Processing Addendum (last modified June 8, 2026); for customers in Europe, the Middle East and Africa other than France, Italy and Poland, the contracting Google company is Google Cloud EMEA Limited. Under Google's Cloud Data Processing Addendum, personal data in Skilled Rabbit's Google Workspace mailbox that is transferred outside the EEA is transferred first under an Alternative Transfer Solution where Google has adopted one — for transfers to the United States, Google LLC's certification to the EU-U.S. Data Privacy Framework, adopted by Google as of 1 September 2023 — and otherwise under the EU Standard Contractual Clauses that the Addendum specifies. Google LLC's certification under the EU-U.S. Data Privacy Framework is listed as active.
Anthropic may not train its models on the data we send it. Paddle is in the United Kingdom, which the European Commission has found to offer an adequate level of protection (Art. 45 GDPR).
6. Analytics
We use PostHog for product analytics, hosted in the EU region (eu.i.posthog.com). We run PostHog without cookies or local storage, without automatic click capture and without session recording; we send only the events we choose, such as a page view. PostHog also receives reports of errors in the app, without your name, email address or what you wrote. When you are signed in, these events carry your account's internal id as a pseudonym — never your name or email address — so we can see how the product is used over time. At a request-limit decision PostHog receives only a shortened one-way hash of the email address or IP address involved. When you delete your account, we ask PostHog to delete your data there too.
7. Authentication
You sign in with your email address and password; the password is stored by Supabase only as a one-way hash, never in readable form. We do not offer sign-in through another company's account. Your email address and authentication data are stored securely by Supabase (our authentication provider, hosted in the EU). Some specific flows — claiming a sample-lesson result, accepting a training-group invitation, or a sign-in link an administrator sends you — use a one-time email link or a temporary password sent to your email instead. Your AI tool signs in to Skilled Rabbit through the connector with OAuth; we keep only hashes of its codes and keys (section 4).
8. Waitlist
When you apply to the waitlist for an upcoming training, we collect your email address, the training you chose, your answers to the application questions (one of them is free text, which our filter cleans as described in section 2.7), where you came from (for example a campaign link), and the time you gave your consent on the form. Your answers give an order to our list; a person reviews every application and decides every invitation. No application is invited or turned down by a computer alone. If you are not invited, your application is deleted 12 months after you applied (section 4). You can ask us to remove it at any time at privacy@skilledrabbit.ai.
9. Cookies
We use only functional cookies — cookies strictly necessary for the platform to work:
| Cookie | Purpose | Duration |
|---|---|---|
sb-<project-ref>-auth-token |
Login session (managed by Supabase) | Up to 400 days; removed when you sign out |
sjors.sample_active |
Remembers that you opened a sample lesson | 7 days |
admin_training |
Remembers which training an administrator is viewing (administrators only) | 1 year |
Your browser's local storage also keeps a few settings on your own device, such as your light or dark theme; we do not use it for analytics or tracking.
During checkout, Paddle's payment overlay may set its own strictly functional cookies required to complete the transaction. We do not set tracking, analytics, or advertising cookies. A cookie banner is not required for strictly functional cookies under EU ePrivacy rules.
10. Your Rights
Under the GDPR you have the following rights:
Access (Art. 15) — You may request a copy of the personal data we hold about you, including the record of each time an administrator opened a page showing your content.
Rectification (Art. 16) — You may have inaccurate data corrected. You can change your first name and email address yourself in account settings.
Erasure (Art. 17) — You may request deletion of your account and associated data. Payment and invoice records held by Paddle as Merchant-of-Record are retained under legal tax/accounting retention and cannot be deleted on an erasure request. See our Transparency page for details.
Restriction (Art. 18) — You may ask us to pause the processing of your data while a dispute about it is resolved.
Portability (Art. 20) — You may export your personal data as one machine-readable JSON file, with a section for each kind of data we keep about you, including your profile photo.
Objection (Art. 21) — You may object to processing based on legitimate interest (e.g., product analytics or security records).
Withdraw consent (Art. 7(3)) — You may switch off any of the four switches of section 2.7 at any time in your profile, under Coaching and privacy. Withdrawing does not affect what happened before.
Complaint (Art. 77) — If you believe we are not processing your data correctly, you may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.
How to exercise your rights
- Yourself, at once — at /account/data (sign-in required, after you have accepted the tester agreement) you can export your data as JSON or delete your account.
- By email — for every other right, or if you need help, send your request to privacy@skilledrabbit.ai.
We answer within one month of receiving your request (Art. 12(3) GDPR). If a request is complex, or we receive many, we may extend this by two further months; we will then tell you so within the first month, with the reason.
We act on a request that comes from the email address of your account or from your signed-in session. If it comes from anywhere else, we first ask you to show that the account is yours, and we act only after that.
11. Security
We take the security of your data seriously:
- All connections are encrypted via HTTPS, and browsers are told to use HTTPS only (HSTS)
- Passwords are stored only as a one-way hash (never in readable form) and are checked against known leaked passwords by hash prefix
- The codes and keys of your AI tool's connection are stored only as hashes
- Every table we create in our database is protected by row-level security, and an automated check verifies this
- Our filter removes contact details and secrets from free text, and replaces names, addresses, company numbers, dates of birth, amounts and percentages with a label, before it is stored or sent to an AI model (section 2.7)
- Paddle processes all card data — we never see it
If a personal data breach is likely to put your rights and freedoms at risk, we notify the Dutch Data Protection Authority within 72 hours of becoming aware of it. If the risk to you is high, we also tell you directly, without undue delay.
12. Minors
The platform is intended for people aged 18 and over. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact privacy@skilledrabbit.ai.
13. Changes
We may update this policy. Material changes will be announced by email at least 14 days before they take effect. The current version is always published at skilledrabbit.ai/privacy, and earlier versions are available on request.
Version 1.7 (2026-10-06) describes the processing as it is built: the four coaching switches and their consent, the transfer basis and retention at Anthropic, every processor that receives data, the record of administrators' views, and the corrected cookie, analytics and sign-in sections. It adds the record of your acceptance of the tester agreement.
Version 1.8 (2026-10-08) says more precisely in section 2.7 what Finney sees with Private coaching and that the AI quality check sends the full text of your work to the AI model. The processing itself has not changed.
Version 1.9 (2026-10-11) adds in section 2.7 that the filter also replaces names, addresses, company numbers, dates of birth, amounts and percentages with a label. The processing becomes more protective; nothing new is collected.
Version 1.10 (2026-11-06) adds in section 4 the record of each answer Finney gives you, kept for 90 days, and with “AI quality check of my work” on the answer itself; adds in section 5 that PostHog also receives error reports; and removes Sentry, which is no longer in our code.
Version 1.11 (2026-11-06) adds in section 2.7 that each month we read a small sample of Finney's kept answers ourselves and record a verdict on each, linked to you only as long as the record of the answer is kept. Nothing new is sent to anyone.
Version 1.12 (2026-11-06) adds in section 4 the encrypted backup copies we make every night, each deleted within 30 days; in section 5 that Hetzner stores these copies in Finland; and in section 2.4 the notice we may send you about an answer Finney gave you.
14. Contact
Questions about your privacy or this policy? Email privacy@skilledrabbit.ai. A Dutch translation of this policy is available on request.
For general inquiries: hello@skilledrabbit.ai For support: support@skilledrabbit.ai