Legal
Privacy Notice
1. Who we are
Trailskill is operated by Vibecrab OÜ, a private limited company registered in Estonia (registration number 17289453), with its registered address at Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia. Vibecrab OÜ is the controller of the personal data described here, within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Estonian Personal Data Protection Act.
For anything about your personal data, write to legal@vibecrab.com. We have not appointed a data protection officer, as the GDPR does not require one for our processing; the address above reaches the people responsible.
2. What we collect
We collect only what you give us and what the service needs to run. We do not buy data about you, and we do not use analytics, advertising or tracking tools.
| Category | Data |
|---|---|
| Account | Email address, password (stored only as a one-way bcrypt hash), account type (professional or recruiter), date created, date of last sign-in. |
| Professional profile | Name, headline, track, city and country, availability, work preferences, languages, current company, LinkedIn and Trailhead links, an optional photo, work experience, skills, and the official certifications you declare with any verification links. |
| Learning activity | Units completed, knowledge-check answers and attempts, practice exam attempts and answers, simulator runs and scores, points, levels, streaks and achievements. |
| Privacy choices | Whether recruiters may follow you, and any period you have chosen to go silent. |
| Trailskill Pro subscription | Your Stripe customer reference, your plan (monthly or yearly), its status, the date it renews or ends, and whether you have cancelled. Card details are entered on Stripe's page and never reach us; Stripe holds your billing address, any VAT number and your invoices. |
| LinkedIn verification (Pro) | If you choose to verify, LinkedIn's identifier for your account, your name as LinkedIn shows it, and the date you verified. We do not receive or keep your LinkedIn password, email, connections or access token. |
| Recruiter account | Company name or, for independent recruiters, your own name; contact name; company website or LinkedIn profile; approval status; your shortlists and the professionals you follow. |
| Messages | The content and timestamps of messages between recruiters and professionals, read status, and blocks. |
| Technical | A session identifier stored in a cookie and in our database; your IP address, used briefly to limit repeated requests and kept in our hosting provider's server logs. |
Please do not put special categories of data (such as health, religion or political opinions) or national identification numbers in your profile or messages. We do not ask for them and do not need them.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR Article 6(1)) |
|---|---|
| Creating and running your account, signing you in, and providing trails, exams, the simulator, your record and messaging. | (b) performance of our contract with you, the Terms of Use. |
| Showing your professional record to approved recruiters and other members, which is the core of the service you sign up for. You control following and can go silent at any time. | (b) performance of contract. |
| Selling and running Trailskill Pro: taking payment through Stripe, giving access to the simulator, showing the LinkedIn verified mark you asked for, and publishing your public profile when you switch it on. | (b) performance of contract, at your request. You can make your public profile private again at any time. |
| Keeping invoices and payment records and working out VAT or sales tax. | (c) legal obligation, including the Estonian Accounting Act and tax law. |
| Your profile photo, which is optional. | (a) consent, which you withdraw by removing the photo. |
| Your skill passport: a level from 0 to 100 for each skill, worked out from the units, practice exam objectives and simulator scenarios you have passed (first tries only), your declared certifications and the skills you list. Approved recruiters can see it and search by it. This is profiling. | (f) our legitimate interest, and yours, in recruiters finding people by what they can show they know. You can switch it off at any time under Profile › Privacy, which we treat as an objection and always honour: your levels are deleted and no more are worked out. |
| Reviewing recruiter accounts before they can search, so only genuine recruiters see professionals' records. | (f) our legitimate interest, and that of professionals, in keeping the directory safe. |
| Keeping the service secure: rate limiting, preventing abuse and fraud, and investigating misuse. | (f) legitimate interest in a secure, working service. |
| Handling notices of illegal content and complying with requests from authorities. | (c) legal obligation, including under the EU Digital Services Act. |
| Defending or bringing legal claims. | (f) legitimate interest. |
Where we rely on legitimate interests, you may object at any time (section 7). We do not send marketing email and do not sell or rent personal data.
4. Who can see your data
- Approved recruiters can search for professionals and open their records: profile, experience, skills, skill passport, declared certifications, finished trails, passed exams, simulator scores and photo. A recruiter you message with sees your messages. You can block a recruiter, turn direct messages off, turn following off, switch off your skill passport, or go silent to disappear from searches.
- Other professionals can see the leaderboard (name, country, points), once it opens, and open records from it.
- Members of your referral groups: if you joined through someone's referral link, you are in the group of that member, and of the member who referred them, and so on, if they start one. Its members see your name, photo, headline, country, level and the points you earned this week, month, year and in total, and who invited you. Everyone who joins through your link, or through theirs, is in your group if you start one. You can leave any group, or opt out of all of them, on the Groups page.
- The LinkedIn verified mark, with your name as LinkedIn shows it and the date you verified, is shown next to your name to everyone who can see your record, while you have Pro. Whether you have Pro is otherwise not shown to anyone.
- Our administrators can see account and profile data to run and protect the service and to review recruiters. The service gives them no way to read messages.
- Anyone with your public profile link, if you have Trailskill Pro and switch your public profile on: your name, photo, role, headline, company, city and country, years of experience, languages, the skills and industries you list, level and points, hours of study, badges and when you earned them, practice exams passed, declared certifications, experience, achievements, simulator scores, and, if you allow profiling, your skill passport and the share of units you passed on the first try. It never shows your email, availability, messages or followers. The page asks search engines not to index it. It disappears when you make it private, go silent, or your Pro subscription ends.
- Nobody else. Records are otherwise not public and are not indexed by search engines. Pages you share yourself, such as a finished trail, name the trail only, not you.
5. Service providers and transfers
We use a small number of providers who process data on our behalf under data processing agreements (GDPR Article 28):
| Provider | What they do |
|---|---|
| Vercel Inc., USA | Hosts the website and application servers; keeps request logs. |
| Supabase Inc., USA | Hosts our database, where all account, profile, learning and message data is stored. Database region: the EU (Ireland). |
| Google Ireland Ltd / Google LLC | Serves the web fonts the pages use, which means your browser sends your IP address to Google when a page loads. |
| Stripe Payments Europe Ltd, Ireland | Takes payments for Trailskill Pro, calculates tax, issues invoices and runs the page where you manage your subscription. Stripe is also an independent controller for some data, for example to prevent fraud and meet its own legal duties; see Stripe's privacy policy. |
If you verify your LinkedIn account, you sign in on LinkedIn's own page (LinkedIn Ireland Unlimited Company). LinkedIn then sends us your account identifier and name. LinkedIn acts as an independent controller under its own privacy policy, not as our provider.
Some of these providers are based in the United States or may access data from there. Where personal data leaves the European Economic Area, the transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses (GDPR Article 46), with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
The ChatGPT and Claude buttons on our home page only open those services in a new tab when you click them; we send them nothing ourselves, and their own privacy terms apply.
We may disclose data if required by law, to a court or authority, or to protect the rights and safety of users, and to a successor if the business is sold or merged, in which case this notice continues to protect your data.
6. How long we keep it
- Account, profile and learning data: for as long as your account exists. When your account is deleted, we delete it, together with your messages, photo, experience, certifications, progress and simulator runs, within 30 days.
- Backups: deleted data may remain in encrypted database backups until they expire, within a further 30 days.
- Sessions: a session ends when you sign out or after 30 days.
- Rate-limit records: deleted once their time window ends, usually within an hour.
- Server logs at our hosting provider: kept for a short period set by the provider for security and troubleshooting.
- Recruiter applications we decline: kept for up to 12 months to prevent repeated misuse, then deleted.
- Invoices and payment records: kept for 7 years from the end of the financial year, as the Estonian Accounting Act requires, even after your account is deleted.
- LinkedIn verification: until you remove it or your account is deleted.
We keep data longer only where the law requires it or where it is needed for a legal claim.
7. Your rights
Under the GDPR you have the right to:
- Access your personal data and receive a copy (Article 15).
- Rectify inaccurate data (Article 16). You can edit most of your profile yourself in the app.
- Erase your data (Article 17). To delete your account, write to us from the email address on the account.
- Restrict processing (Article 18).
- Data portability: receive the data you gave us in a structured, machine-readable format (Article 20).
- Object to processing based on legitimate interests, including profiling (Article 21). For the skill passport you can do this yourself under Profile › Privacy.
- Withdraw consent at any time, without affecting earlier processing (Article 7(3)).
Write to legal@vibecrab.com. We answer within one month, which can be extended by two further months for complex requests, and we will tell you if it is. We may ask you to confirm your identity first. Requests are free unless they are manifestly unfounded or excessive.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In Estonia this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. We would appreciate the chance to address your concern first.
9. Security
Connections are encrypted with TLS. Passwords are stored only as bcrypt hashes. Sessions use HTTP-only cookies and are renewed when you sign in. Access to records is checked on the server for every request, the directory is rate limited and capped, and recruiters are reviewed before they get access. No system is perfectly secure; if a personal data breach puts your rights at high risk, we will tell you and the supervisory authority as the GDPR requires.
10. Children, automated decisions, changes
Children. Trailskill is for people aged 16 and over. We do not knowingly collect data from younger children; if you believe a child has given us data, contact us and we will delete it.
Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR Article 22). Points, levels, leaderboard places and skill passport levels are calculated automatically from your activity. Recruiters can search and sort by skill level, but they decide for themselves whom to contact, and nothing is decided about you by the system.
Changes. We will update this notice when our processing changes, show the new effective date at the top, and tell you in the app or by email before a significant change takes effect.