Skillhood Privacy Statement

1. Controller

Gone With Us Studio (trading as Skillhood), van der Werffstraat 10, 5622 KB Eindhoven, the Netherlands, CoC 42074981. Privacy enquiries: privacy@skillhood.app.

2. What data

• Account data: name, email, date of birth (to check you are 18 or older), language, password (encrypted), profile photo, bio.
• Proof of your consent: which version of the terms and privacy statement you accepted, when, and from which IP address and with which browser or app.
• Location data: only when you share it to show nearby providers.
• If you offer skills: your skills with photos, prices, work area and hours, the place you choose for a skill, and whether you offer as a business or as a private person (your own declaration, which clients see). That place is visible to everyone on the map. With "Hide my exact location" we show a point within about 1 km; for new providers it is on by default, and you can turn it off.
• Usage data: bookings (what you ask for, the date and, if you give them, your address and photos), messages, reviews, saved providers, device and log files.
• Requests: if you post a request, we keep what you need (category and text), when, the language, whether online is fine, and the area. We store that area as a point within about 1 km, never your address. Providers whose skill fits your request see your first name, the text (with phone numbers, email addresses and links hidden) and the area, get a notification and can reply in chat. Other providers within about 15 km see the same in a separate list, without a notification; to reply they must first offer a skill in that category. You can add up to 3 photos to a request; the same providers see them. They are deleted together with the request, and with your account.
• Cancellations: who cancelled a confirmed booking, when and why is visible to both of you. On your public profile we show only a number: how many confirmed bookings you cancelled less than 24 hours ahead in the last 6 months (no dates, names or reasons). Legal basis: our legitimate interest, and that of other users, in reliable arrangements, art. 6(1)(f).
• Languages you speak: if you add them to your profile (this is voluntary), everyone can see them on your profile and your skills, and clients can search on them. Languages can say something about your background: add only what you want to show. You can remove them at any time.
• In messages we hide phone numbers, email addresses and links until a booking between you has been accepted. We keep the message as you wrote it.
• Verification (providers only, voluntary): a photo of your ID, your VOG (Certificate of Conduct) and/or a trade certificate, when you apply for a badge. See section 4a.
• Measures: if we take a measure against your account or your content (suspending it, hiding a skill, removing a photo), we keep what we did, why, the facts, what started it and who at Skillhood decided. You also receive that explanation by email.

3. Purposes and legal basis (GDPR art. 6)

• Performing the contract (delivering the service): art. 6(1)(b).
• Location and push notifications: your consent, art. 6(1)(a).
• The languages you add to your profile: your consent, art. 6(1)(a); you withdraw it by removing them.
• Verifying your identity and VOG: your consent, art. 6(1)(a). You can withdraw it at any time by deleting your account or contacting us.
• Security and fraud prevention: legitimate interest, art. 6(1)(f).
• Legal obligations, such as proof of your consent, handling notices of illegal content, the explanation of a measure (Digital Services Act, art. 17) and showing whether a provider is a business or a private person: art. 6(1)(c). Keeping measures to recognise repeat abuse and to handle an objection: legitimate interest, art. 6(1)(f).

4. Retention

• Your account, profile, skills, bookings, messages and reviews: as long as your account exists. If you delete your account, we anonymise your data, erase your messages and what you wrote in bookings, and delete the photos you uploaded. Anonymised booking and review data stay for the other party's records, without your name, photo or contact details; the text of a review you wrote stays.
• An account whose email address was never confirmed: deleted in the same way, with its photos, 7 days after sign-up.
• If you have not signed in for 24 months, we delete your account in the same way as above. We email you 30 days before; if you sign in after that email, your account stays.
• Photos of ID, VOG and certificates: see section 4a (right after the review, at the latest after 30 days).
• Notices of illegal content: 12 months after our decision (section 4d).
• Requests: open for 7 days (shorter if you close them yourself), and deleted with their replies 90 days after they closed or expired. The conversations that follow are ordinary messages (see above).
• Translations of skill texts and reviews: deleted when nobody has asked for them for 30 days (section 4b). We do not keep translations of chat messages.
• Measures against your account or content: while the measure applies, and 12 months after that; also after you delete your account, linked to the anonymised account.
• Proof of your consent: as long as it may be needed as proof, also after you delete your account, linked to the anonymised account.
• Sign-in sessions: expire after 30 days without use; revoked sessions are deleted within an hour.
• Links in emails to reset your password or confirm your email address: expire after 1 hour or 24 hours.
• Data for push notifications to your phone: deleted after 90 days without use.
• Technical logs: deleted automatically, at the latest after 14 days.

4a. ID, VOG and certificates

• Cover your citizen service number (BSN) and passport photo before uploading a copy of your ID; the Dutch government's KopieID app does this for you. A copy with a visible BSN is rejected and deleted.
• The photo is stored privately and seen only by a Skillhood administrator, solely to check that you are who you say you are, or that you hold a valid VOG or trade certificate (for example for electrical work).
• We delete the photo as soon as it has been reviewed and keep only the outcome (approved or rejected) and its date. A photo not reviewed within 30 days is deleted anyway.
• Clients see only the badge, never the document.

4b. AI features

Some features use AI models that Cloudflare (our processor) runs for us: plain-language search, translating chat messages, skill texts and reviews into the language you choose (and, when it is unclear, recognising which language a text is written in), checking chat messages, request descriptions and the notes with proposals for insults, threats and sexual harassment before they are sent, filling in a request from a few words of your own, and filling in your sign-up as a provider from what you write about your work or from a link to your own profile on another website. With such a link we fetch that public page once, use only your own text from it (never reviews, ratings or other people's names) and do not keep the page. The text is used only to answer that one request: Cloudflare does not store it or train models on it. A filled-in request or sign-up is a draft: nothing is saved or shown until you have checked it. We keep a translation of a skill text or a review for a while ourselves, so the next person who asks gets it straight away; it is stored under a fingerprint of the text, not under who asked (section 4). Legal basis: performing the contract, art. 6(1)(b), and for checking messages our legitimate interest in a safe platform, art. 6(1)(f).

Reading a photo: when you use a photo to fill in a request or to search, Cloudflare's AI model looks at it to suggest the service and a short text, and whether there is danger (gas, sparks, fire). A photo you search with is not kept. The model does not describe people.

4c. Parties we use

We do not sell your data. These parties process data for us, only for the purpose given:

• Cloudflare: hosting the app and the website, the database, photo storage, email, the AI features in section 4b, and the check that you are human (Turnstile) on the web forms for reports and account deletion.
• Apple: push notifications to iPhones, Sign in with Apple if you choose it, and the map in the iPhone app (Apple Maps loads map images of the area you are viewing).
• Google: push notifications to Android phones (Firebase Cloud Messaging), Google sign-in if you choose it, and the map in the Android app (Google Maps loads map images of the area you are viewing).
• PDOK (the Dutch Land Registry): when you enter a postcode and house number or a street name, we look up the address in the public address register. Our server makes that request, so PDOK does not see who you are or your IP address.
• OpenStreetMap (Nominatim): when you search for a place name we do not know, our server looks it up. Only the search text is sent.
• Grafana Labs: technical logs used to fix problems. They contain technical data about requests to our server (such as the time, the page address, the country and possibly your IP address), user numbers and, for emails we send, the recipient's email address; never passwords or the content of messages.

Where a party processes data outside the European Economic Area, this relies on an adequacy decision of the European Commission (such as for the United Kingdom), the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

4d. Notices of illegal content

Anyone can report something on Skillhood as illegal at skillhood.app/report (Digital Services Act, art. 16). We keep the notice: what and where it is, why it would be illegal, and your name and email address if you give them (this is optional). We use your email address only to confirm receipt and send our decision. We do not store your IP address. The notice is deleted 12 months after our decision. The person reported is not told who sent the notice. Legal basis: legal obligation, art. 6(1)(c).

5. Your rights

You have the right to access, rectification, erasure ("right to be forgotten"), restriction, objection and data portability. You can export your data in the app (Legal & Privacy → Download my data) or delete your account. We respond within one month.

6. Minors

Skillhood is only for people aged 18 or older (see the Terms). We ask for your date of birth to check this: when you create an account with your email address, or right after you first sign in with Google or Apple.

7. Complaints

You may lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).