Skillflo, Inc. ("Skillflo", "we") is an applied AI company. We provide the skillflo.ai website, the Skillflo products — Echo (live meeting assist), Hire (hiring pipeline and AI-led interviews), and Learn (training simulations) — and forward-deployed Studio engagements (together, the "Services") that help customers, authorized users, candidates, meeting participants, trainees, partners, and visitors ("you") get real work done with AI.
To deliver the Services, Skillflo handles information that identifies you or could reasonably be used to identify you ("Personal Data"). When you interact with Skillflo, you trust us with that data, and we want to keep that trust by being transparent about how and why we collect, use, process, store, and share it — and about the choices you have. Before the details, a few key points:
- We do not train AI models on your content. Skillflo runs no model-training pipeline on customer or end-user data, so there is no training opt-out to hunt for — the answer is no by default. We do not permit AI subprocessors to use your content to train their models: model training is disabled at the AI gateway that carries our model calls, and where a provider offers an enforceable zero-data-retention route we pin our calls to it.
- Your data is encrypted in transit and at rest, in access-controlled Postgres databases and private object storage. Stored integration credentials receive additional application-layer encryption, and our subprocessor register — available on request — lists who processes what, and where.
- You can see, export, and delete your data yourself. Echo includes per-meeting and full-account deletion; Hire includes a self-service privacy hub covering access, export, correction, restriction, objection, consent withdrawal, and deletion.
We encourage you to also review our Terms of Service, which govern your use of the Services, and to contact us with any questions. Capitalized terms used without definition here have the meaning given in the Terms of Service.
Scope of this Privacy Policy
This policy applies whenever you access or use the Services or submit Personal Data to Skillflo, wherever you are located.
Please read this policy and the Terms of Service carefully. They explain how we collect, use, process, store, transfer, and protect your Personal Data across the website and the products.
Each product publishes its own supplemental privacy notice with product-specific detail — for example the SkillfloHire Privacy Policy. For business customers, a signed data processing agreement (DPA) and your order form or MSA govern customer data and prevail over this policy where they differ. This policy does not replace the privacy notices our customers owe their own candidates, meeting participants, or employees.
Our two roles
Sometimes we decide how data is used; sometimes we only handle it on a customer's instructions. The distinction matters.
- We act as a controller for visitors to skillflo.ai, people who contact us, demo and sales conversations, and the account data needed to create and administer customer accounts.
- We act as a processor for everything our customers and their people put into Echo, Hire, and Learn, and for client data we touch during a Studio engagement. There, our customer is the controller: they decide why the data is processed and are responsible for informing their own people.
If your data reached Skillflo through a company — you applied for a job, joined a meeting, or took a training session — contact that company first; they are the controller. If you are unsure who that is, write to us and we will help route your request.
Your rights and preferences
You can exercise your privacy rights and manage how we use your information.
Privacy and data protection laws vary by region and give individuals rights in relation to their Personal Data. Where permitted by applicable law, we may process or store Personal Data in the regions where we and our service providers operate. The sections on retention and access rights and regional privacy considerations describe your rights in detail; if anything is unclear, contact us.
Information we collect
Skillflo collects information that relates to you and your interactions with us and the Services.
Categories of Personal Data
The table below lists the categories of Personal Data we may collect, including within the past 12 months, and the categories of third parties with whom each may be shared.
| Category of Personal Data | Examples of what we collect | Shared with |
|---|---|---|
| Profile or contact data |
|
Service providers; parties you authorize |
| Device / IP data |
|
Service providers |
| Web analytics |
|
Service providers (PostHog, Sentry) |
| Professional or employment-related data |
|
Service providers; the customer whose role you applied to |
| Recordings and transcriptions |
|
Service providers (speech-to-text and AI subprocessors); parties you authorize |
| Calendar and meeting metadata |
|
Service providers |
| Other content you choose to provide |
|
Service providers; parties you authorize |
Skillflo has no billing integration today and does not collect payment card data. If that changes, we will use a dedicated payment processor and update this policy first.
Information that you provide to Skillflo
We collect Personal Data you give us when you register for and use the Services — your name, email, and sign-in identity — and anything you submit through them: meeting notes, interview answers, resumes, preferences, feedback, and correspondence. Providing some Personal Data is required to use the Services; other data is optional and personalizes your experience. Customers control what enters the products. Sensitive or special-category data is processed only if a customer chooses to submit it and configures the service accordingly.
Automatic collection, analytics, and functional information
On skillflo.ai, there are no accounts, no advertising trackers, no analytics cookies, and no session replay. We use PostHog in cookieless mode to collect basic audience measurement — pages viewed, selected product and call-to-action links, referrer path, and browser and device category. We strip query strings and page titles before events are sent, and we do not identify website visitors.
In the products, we collect usage and diagnostic information tied to your account — features used, session counts and durations, token and cost metering for AI calls, errors and crash reports — to operate, support, and improve the Services. Echo lets you turn product telemetry off in settings. Error monitoring is configured to strip IP addresses and usernames.
Derived information
The Services generate derived information as part of doing their job: AI meeting notes and follow-ups, screening assessments and readiness scores, interview-integrity signals, and memory that makes Echo more useful over time. Derived information belongs to the same controller as the data it came from and follows the same retention and deletion rules.
Personal Data from third parties
If you connect a third-party account — Google or Microsoft sign-in, a calendar, or Notion — we receive the data you authorize, within the scopes you grant (calendar access is read-only). We store the authorization tokens needed to keep the connection working, encrypted at the application layer, and delete calendar and Notion tokens when you disconnect the integration. On Hire, a customer may direct us to collect publicly available professional profile information for sourcing. Third parties you connect remain responsible for their own privacy practices, and we encourage you to review their policies.
Children's data
Skillflo is built for businesses and is not directed to children. It is not intended for anyone under 18, and we do not knowingly collect Personal Data from children. If you believe a child's data reached us, contact privacy@skillflo.ai and we will remove it as quickly as possible.
How Skillflo uses your Personal Data
We use Personal Data to provide the Services and to operate, secure, support, and improve them — and, as a processor, only on our customer's documented instructions.
For account registration, access, and servicing
- to create, provide access to, maintain, service, or delete your account;
- to act on accounts administered by your employer or workspace owner;
- to verify and authenticate access, including multi-factor authentication; and
- to resolve support questions and follow up on your experience.
To communicate with you
- to send service and transactional messages — sign-in codes, interview invitations, deletion confirmations, and similar;
- to respond when you contact us and to run sales conversations you asked for; and
- to send occasional product updates you can opt out of at any time. We do not use your Personal Data for third-party advertising, and we do not disclose it to third parties for their independent marketing.
To improve and develop the Services
- to understand aggregate usage and reliability so we can fix and improve the Services;
- to evaluate quality using synthetic and licensed evaluation datasets — not your content; and
- to produce aggregated, de-identified statistics that identify no customer and no person. Case studies are published only with the customer's agreement.
To provide the Services and operate our business
- to fulfill your requests and provide technical and customer support;
- to protect the Services, including combating fraud and abuse and keeping interviews fair; and
- to maintain legal and regulatory compliance.
To facilitate third-party integrations
- to establish and maintain connections you authorize — sign-in identity, read-only calendars, Notion;
- to capture meeting audio locally on your device during calls you run through Echo (Echo does not join your calls as a bot participant); and
- to troubleshoot integration issues and provide support.
No sale or sharing of your Personal Data
Skillflo does not sell Personal Data, and does not "share" it for cross-context behavioral advertising (as those terms are defined under the CCPA/CPRA). We also do not permit our service providers to sell Personal Data we disclose to them or to use it for their own marketing.
How Skillflo shares your Personal Data
We only share Personal Data as described in this policy.
We may disclose Personal Data:
- with vetted service providers who need it to run the Services on our behalf: cloud hosting and storage (Vercel, Supabase, Google Cloud, Cloudflare), AI model providers and gateways, speech-to-text and voice vendors, real-time media infrastructure, email delivery, and analytics and error monitoring. Each is bound to confidentiality, security obligations, and processing only for the service;
- with the customer whose workspace your data belongs to — for example, the company whose role you applied to or whose meeting you joined;
- to enforce our terms or protect the rights, property, or safety of Skillflo or its users;
- in connection with a merger, acquisition, financing, or sale of assets, or in anticipation thereof; and
- to law enforcement or regulators in response to a valid legal request.
We maintain a named subprocessor register and share it with customers under the DPA, including notice of material changes and a chance to object. Contact privacy@skillflo.ai to request it. Aggregated, de-identified data that identifies no person may be used for lawful business purposes such as service statistics.
Data transfers
We use appropriate transfer mechanisms and protection measures when data crosses borders.
Skillflo and its subprocessors process and store Personal Data in more than one region, which may be outside your country of residence. The current regions for each subprocessor are listed in our subprocessor register, available from privacy@skillflo.ai. Wherever Personal Data is processed, the safeguards in this policy and our DPA apply.
For individuals in the EU, EEA, UK, or Switzerland, transfers to countries not recognized as providing adequate protection are conducted under appropriate legal mechanisms such as European Commission–approved Standard Contractual Clauses. Business customers can obtain our DPA, which incorporates these safeguards, from privacy@skillflo.ai.
Managing your data and privacy
You can manage your information, your communications preferences, and our limited use of cookies.
Marketing communications
Skillflo sends mostly service and transactional email. If we send you marketing or product-update email, every message includes an unsubscribe link, and we honor it. We do not send marketing SMS and do not send push notifications to your devices; product notifications appear in-app. Even if you opt out of marketing, we will still send mandatory service communications such as sign-in codes and security or deletion notices.
Cookies and similar technologies
skillflo.ai sets no cookies or browser storage for analytics and uses no advertising trackers. PostHog's cookieless mode counts visits using a privacy-preserving hash calculated on PostHog's servers and does not identify visitors.
The products use a small set of cookies and equivalent storage, limited to these purposes:
| Purpose | What it does |
|---|---|
| Essential / authentication | Signs you in and keeps you signed in (for example Hire's candidate session cookie and Supabase auth session). The Echo desktop app stores its session in your operating system's keychain rather than cookies. |
| Preferences | Remembers settings and choices you make inside the products. |
| Analytics | Helps us understand product usage and reliability, as disclosed in each product's privacy notice and consent controls. |
We use no advertising or cross-site tracking cookies anywhere. You can control cookies through your browser settings; disabling essential cookies may prevent sign-in.
Do Not Track
Like most companies, Skillflo does not currently respond to browser "Do Not Track" signals because no formal standard has been adopted. Our website analytics is cookieless and does not identify you regardless of that signal.
Data retention and your access rights
We keep data only as long as it serves you, your company's configuration, or a legal obligation — and you can delete yours.
Data retention
As a processor, we retain customer data for the term of the engagement and per the customer's configuration and DPA. Product specifics:
- Echo meeting audio is retained according to your recording settings. You can keep recordings, delete them per meeting or all at once, or turn on automatic deletion of audio once a meeting's transcript is finalized. Transcripts and notes remain until you delete the meeting.
- Echo deleted meetings go to a trash and are permanently purged 30 days later (or immediately if you hard-delete them).
- Echo account deletion starts a 30-day grace period during which you can restore the account; after it, an automated job permanently erases your sessions, transcripts, notes, memory, connected-account tokens, and stored files, and deletes your sign-in record.
- Hire interview-integrity signals (such as browser focus events) are deleted automatically 90 days after the interview by a scheduled job.
- Hire candidate profiles, recordings, and transcripts are retained for the life of the hiring workflow under the customer's agreement, and removed when a verified deletion request completes or the workspace closes.
- Verified deletion requests on Hire run after a short cooling-off period, then automatically remove the profile, resume, recordings, transcripts, and derived assessments — completed well within 30 days of the request. A minimal audit trail is kept where the law requires it.
- Integration credentials (calendar, Notion) are deleted when you disconnect the integration; sign-in tokens are deleted with your account.
- On termination, we return or delete customer data per the DPA. Deleted data may persist briefly in secure backups before rotation.
As a controller, we keep business-contact data only while the relationship is active, then delete or de-identify it. Cookieless website analytics is kept only while useful for measuring and improving the site, subject to our PostHog project retention settings, then deleted or aggregated.
Deleting your data yourself
- Deleting an Echo meeting: open the meeting in the app and delete it; trash purges after 30 days. Recording audio can be deleted separately in settings, per meeting or in bulk.
- Deleting your Echo account: Settings → Account → Delete account (you confirm by typing your email; 30-day restorable grace period applies).
- Hire privacy hub: candidates can access, export, correct, restrict, object, withdraw consent, and request deletion from the self-service privacy controls inside the product.
Responses from Skillflo
We respond to all properly submitted and verified requests to exercise data protection rights — access, correction, deletion, restriction, objection, portability, and consent withdrawal — within the timeframes required by applicable law, and you will not be penalized for exercising your rights. Where we act as processor, we may need to route your request to the controller (the company that used Skillflo); we will tell you if so and help. Email privacy@skillflo.ai to make a request. You may also complain to your local data protection authority.
Information security
We apply reasonable and appropriate technical and organizational measures to protect your Personal Data.
- Encryption. Data is encrypted in transit (TLS, secure WebSockets) and at rest. Stored credentials receive additional application-layer encryption, and the Echo desktop app protects local session data and recordings with your operating system's keychain and restrictive file permissions.
- Logical isolation. Every record is scoped to its user and workspace, enforced through row-level security policies and access-scoped queries, so one customer's data is not visible to another.
- Access controls. Role-based permissions; multi-factor authentication, which Hire workspaces can require for all members; and audit logging of privacy-relevant actions.
- Least privilege. Skillflo staff access is scoped to what the work requires. Studio engineers work under confidentiality, limited to the engagement.
- Incident response. If a breach affects your data, we notify affected customers without undue delay.
The safety of your data also depends on you: keep your password and sign-in codes confidential. No method of transmission or storage is completely secure; we work continuously to protect data but cannot guarantee absolute security. For more detail, see our security overview.
Artificial intelligence and automated processing
AI powers core features of the Services. Here is how it uses your data, the choices you have, and how we approach AI regulation.
How we use artificial intelligence
When you use Skillflo's AI features, our systems process the content you provide — meeting audio and transcripts, interview answers and resumes, practice sessions — to generate outputs such as live transcription, notes, follow-up items, screening assessments, and coaching feedback. Skillflo's AI is assistive: it screens, drafts, flags, and prepares; your team — or our customer's team — reviews the important decisions. We do not use AI to make solely automated decisions about you that produce legal or similarly significant effects without human review.
AI-generated content
Outputs produced by Skillflo's AI features — transcripts, summaries, notes, assessments — are AI-generated and can be imperfect. Review AI outputs for accuracy before relying on them; they support human judgment and should not be the sole basis for decisions about people. Where required by law, we provide notice when AI is being used, such as the disclosure candidates see before an AI-led interview begins.
AI model training
We do not use customer or end-user data to train our own AI models — no training pipeline exists, and any change to that would require the customer's documented agreement and an update to this policy first. Model quality is evaluated with synthetic and licensed datasets, not your content. Third-party AI providers act as subprocessors under contract, restricted to processing your content to serve your requests: model training is disabled at the AI gateway that carries our model calls, and zero- or limited-retention terms are applied where the provider supports them. Customers with heightened requirements can discuss private-model configurations with us.
Automated decision-making and your rights
- EU and EEA residents: under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Where any such processing occurs, you may request human review, express your point of view, and contest the decision.
- UK residents: the same rights apply under UK GDPR Article 22, and we follow ICO guidance on AI and data protection.
- California residents: under the CPRA and its regulations on automated decision-making technology, you may have rights to opt out of certain automated processing and to request disclosure about how automated decisions are made.
- Everyone: Hire candidates consent to AI analysis before applying, can object to automated processing, and can request human review of AI-assisted outcomes through the in-product privacy controls or privacy@skillflo.ai.
Regional privacy considerations
Additional rights may apply depending on where you live.
United States
We model our U.S. practices on the CCPA as amended by the CPRA; other state laws may also apply. In the preceding 12 months we have disclosed, for business purposes to service providers only: identifiers (name, email), professional or employment-related information, internet and usage activity, audio and video recordings and transcripts, and inferences such as AI assessments. We have not sold or shared personal information as those terms are defined by the CPRA. You may request access, correction, deletion, portability, or restriction, and you have the right not to be discriminated against for exercising your rights. We respond to verified requests within the timeframe the law requires (generally 45 days). Skillflo does not knowingly collect "sensitive personal information" as defined by the CPRA as structured data; free-form content you submit may incidentally contain it, and we do not use or disclose it except as permitted by law. If you have concerns, you may also contact the California Privacy Protection Agency or your state's attorney general.
EU, UK, and Switzerland
Where GDPR or UK GDPR applies, we process Personal Data only on a lawful basis: contractual necessity (profile and contact data, recordings and transcripts, content you submit — the data needed to provide the Services), legitimate interests (device and usage data, analytics, securing and improving the Services, corresponding with you), consent (where indicated at collection — for example a candidate's consent to AI analysis, or optional telemetry), and legal obligation. You may request access, rectification, erasure, restriction, portability, or object to processing, and withdraw consent at any time, by emailing privacy@skillflo.ai with the subject line "Privacy Request". Withdrawal does not affect the lawfulness of prior processing. You may lodge a complaint with your supervisory authority — the ICO in the UK, or the authority in your EU country of residence.
Changes to this Privacy Policy
We may update this policy; changes take effect when posted.
When this policy changes, we post the new version here with a new effective date. If we believe changes are material, we take reasonable steps to notify customers in advance — such as a site notice or an email to account administrators — before the changes take effect.
Contact us
Email is the fastest way to reach us about privacy:
privacy@skillflo.ai
Everything else: hello@skillflo.ai
Skillflo, Inc.
See also our Terms of Service and the security overview.