Transparency
skilledrabbit.ai / Skilled Rabbit
We believe you should know exactly who touches your data and how our AI coaching works. This page sets out, in plain terms, the AI systems we use and the third-party processors that handle your personal data on our behalf.
This page supports two things at once:
- EU AI Act Art. 50 transparency — you are told, up front, when you are interacting with an AI system.
- GDPR transparency — you can see which processors handle your data, for what purpose, and on what lawful basis.
The processor register below is hand-derived from our internal Record of Processing Activities (docs/compliance/ROPA.md), which is the single source of truth. When the ROPA changes, this page is updated to match.
AI system disclosure
Finney is an AI coach. When you interact with Finney — in the coaching area or inside your AI tool — you are interacting with an AI system, not a human. Finney guides you as you build; it does not do the work for you. If you sincerely ask, we will tell you honestly which model powers Finney.
Processors we work with
We are the data controller for your personal data. The following six sub-processors handle personal data on our behalf. Each row summarises what they process, why, and the lawful basis under GDPR Art. 6.
| Processor | What data | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|---|
| Supabase | Account identity (email, auth credentials), learner profiles, training enrolments and progress, behavioural event stream, saved artifacts | Store and serve your account, training state, and generated work; authenticate your sessions | Contract — Art. 6(1)(b) |
| Anthropic | Your prompts and coaching context sent to generate Finney's responses | Per-learner AI coaching personalisation (Finney) | Contract — Art. 6(1)(b) |
| Paddle | Payment and invoice records, billing identity (name, billing address, payment-method metadata) | Take payment for paid training tiers; issue invoices; handle VAT/tax as seller-of-record | Contract — Art. 6(1)(b) and legal obligation — Art. 6(1)(c) |
| Brevo | Email address and transactional message content (welcome, purchase-confirmation, magic-link, certificate, cohort-credentials, re-engagement, waitlist) | Deliver the transactional email required to operate your account and training | Contract — Art. 6(1)(b) |
| PostHog | Pseudonymous product-usage events and feature-flag evaluations | Understand product usage; gate features safely | Legitimate interest — Art. 6(1)(f) |
| Sentry | Error diagnostics (stack traces, request context; may incidentally include identifiers) | Detect and diagnose software faults for reliability | Legitimate interest — Art. 6(1)(f) |
These six — Supabase, Anthropic, Paddle, Brevo, PostHog, Sentry — are the complete set of sub-processors for our current (beta) environment.
Paddle — our Merchant-of-Record
Paddle plays two roles at once:
- Payment sub-processor — Paddle processes your payment and billing data on our behalf to take payment for paid training tiers.
- Merchant-of-Record — Paddle is the legal seller of record to you. Paddle, not Skilled Rabbit, is the counterparty on your invoice and is responsible for collecting and remitting VAT/sales tax.
Because Paddle is the Merchant-of-Record, the payment and invoice records it holds are kept under a legal-retention obligation (tax and accounting law require sellers to retain invoice and transaction records for a statutory period). This affects what we can delete when you ask us to erase your data:
We delete your Skilled Rabbit account and learning data. Payment and invoice records held by Paddle — our Merchant-of-Record — are retained under a legal-retention obligation and cannot be deleted on request.
Your data rights
You can exercise your GDPR rights yourself, from your account, at /account/data (you must be signed in). From there you can:
- Export your data (Art. 15 access / Art. 20 portability) — download your full personal record as a machine-readable file: your profile, learner profile, enrolments, progress, training context, behavioural event stream, and saved artifacts.
- Erase your data (Art. 17 "right to be forgotten") — delete your Skilled Rabbit account and all associated learning data.
As noted above, the payment and invoice records held by Paddle as Merchant-of-Record are the one exception: they are retained under a legal-retention obligation and are not deleted on an erasure request. You are told this at the point you confirm erasure.
See also our Privacy Policy.