Transparency
skilledrabbit.ai / Skilled Rabbit
We believe you should know exactly who touches your data and how our AI coaching works. This page sets out, in plain terms, the AI systems we use and the third-party processors that handle your personal data on our behalf.
This page supports two things at once:
- EU AI Act Art. 50 transparency — you are told, up front, when you are interacting with an AI system.
- GDPR transparency — you can see which processors handle your data, for what purpose, and on what lawful basis.
The processor register below is hand-derived from our internal Record of Processing Activities (docs/compliance/ROPA.md), which is the single source of truth. When the ROPA changes, this page is updated to match.
AI system disclosure
Finney is an AI coach. When you interact with Finney — in the coaching area or inside your AI tool — you are interacting with an AI system, not a human. Finney guides you as you build; it does not do the work for you. If you sincerely ask, we will tell you honestly which model powers Finney.
Processors we work with
We are the data controller for your personal data. The following processors and recipients handle personal data on our behalf. Each row summarises what they process, why, and the lawful basis under GDPR Art. 6.
| Processor | What data | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|---|
| Supabase | Account identity (email, password hash), learner profiles, training enrolments and progress, behavioural event stream, saved work, your profile photo and certificate | Store and serve your account, training state, and generated work; authenticate your sessions | Contract — Art. 6(1)(b); for the saved text of your work, memory, quality scores and the full Proof of Work dossier: consent — Art. 6(1)(a) |
| Anthropic | Your question or message, your recent conversation, your training context and the moments you got stuck; with your consent, also the text of your work, the picture of how you learn, and what your Proof of Work dossier is built from | Finney's AI coaching; with your consent, memory, the AI quality check and the Proof of Work dossier | Contract — Art. 6(1)(b); the consent-based features: consent — Art. 6(1)(a), each switched on separately |
| Paddle | Payment and invoice records, billing identity (name, billing address, payment-method metadata) | Take payment for paid training tiers; issue invoices; handle VAT/tax as seller-of-record | Contract — Art. 6(1)(b) and legal obligation — Art. 6(1)(c) |
| Brevo | Email address, first name and transactional message content (welcome, credentials, certificate, reminders, waitlist and beta mail); delivery events | Deliver the transactional email required to operate your account and training | Contract — Art. 6(1)(b) |
| PostHog | Product events under your account's internal id as a pseudonym (never your name or email address); a shortened hash at request-limit decisions | Understand product usage | Legitimate interest — Art. 6(1)(f) |
| Hetzner | Everything that passes through our server; server logs with your account id, with email addresses and secrets filtered out | Host the platform (the server in Germany) and find faults | Contract — Art. 6(1)(b) for hosting; legitimate interest — Art. 6(1)(f) for the logs |
| Google Workspace | The content of the emails you send us | Receive and answer support and privacy requests (Google acts as our processor under its Cloud Data Processing Addendum) | Legitimate interest — Art. 6(1)(f) |
| HaveIBeenPwned | Only the first 5 characters of your password's SHA-1 hash | Check a new password against known leaked passwords | Contract — Art. 6(1)(b), as part of keeping your account secure |
| Cloudflare | DNS queries for skilledrabbit.ai only — website traffic does not pass through Cloudflare, and Cloudflare receives no learner content | Resolve our domain name | Legitimate interest — Art. 6(1)(f) |
To the extent the GDPR requires it, personal data that Skilled Rabbit sends to Anthropic through the Claude API is transferred under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two and/or Module Three, Art. 46(2)(c) GDPR), which Anthropic's Data Processing Addendum incorporates by reference together with the jurisdiction-specific addenda in its Schedule 3.
Google acts as our processor under Google's Cloud Data Processing Addendum (last modified June 8, 2026); for customers in Europe, the Middle East and Africa other than France, Italy and Poland, the contracting Google company is Google Cloud EMEA Limited. Under Google's Cloud Data Processing Addendum, personal data in Skilled Rabbit's Google Workspace mailbox that is transferred outside the EEA is transferred first under an Alternative Transfer Solution where Google has adopted one — for transfers to the United States, Google LLC's certification to the EU-U.S. Data Privacy Framework, adopted by Google as of 1 September 2023 — and otherwise under the EU Standard Contractual Clauses that the Addendum specifies. Google LLC's certification under the EU-U.S. Data Privacy Framework is listed as active.
Sentry (error monitoring) and Stripe (payments) are connected in our code but switched off: they receive no data. Our Privacy Policy gives each processor's location and how long data is kept.
Paddle — our Merchant-of-Record
Paddle plays two roles at once:
- Payment sub-processor — Paddle processes your payment and billing data on our behalf to take payment for paid training tiers.
- Merchant-of-Record — Paddle is the legal seller of record to you. Paddle, not Skilled Rabbit, is the counterparty on your invoice and is responsible for collecting and remitting VAT/sales tax.
Because Paddle is the Merchant-of-Record, the payment and invoice records it holds are kept under a legal-retention obligation (tax and accounting law require sellers to retain invoice and transaction records for a statutory period). This affects what we can delete when you ask us to erase your data:
We delete your Skilled Rabbit account and learning data. Payment and invoice records held by Paddle — our Merchant-of-Record — are retained under a legal-retention obligation and cannot be deleted on request.
Your data rights
You can exercise your GDPR rights yourself, from your account, at /account/data (you must be signed in). From there you can:
- Export your data (Art. 15 access / Art. 20 portability) — download your full personal record as one machine-readable JSON file, with a section for each kind of data we keep about you, including the record of each time an administrator opened a page showing your content.
- Erase your data (Art. 17 "right to be forgotten") — delete your Skilled Rabbit account and all associated learning data.
As noted above, the payment and invoice records held by Paddle as Merchant-of-Record are the one exception: they are retained under a legal-retention obligation and are not deleted on an erasure request. You are told this at the point you confirm erasure.
See also our Privacy Policy.