Privacy Policy

1. Introduction

SkillsPad (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our platform at skillspad.org, including all subdomains, APIs, and related services (the “Platform”).

This policy is issued in compliance with the Data Protection Act, 2012 (Act 843) of Ghana and applies to all users of the Platform, including creators, buyers, and affiliates.

By using the Platform, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree, please do not use the Platform.

2. Data Controller

The data controller responsible for your personal information is:

SkillsPad
Website: skillspad.org
Email: privacy@skillspad.org
Location: Ghana

3. Information We Collect

3.1 Information You Provide Directly

When you register, create products, or interact with the Platform, we collect:

• Account information: Name, email address, password (hashed), profile picture, username, bio
• Payment information: Mobile Money number, bank account details (processed and stored securely through Paystack -- we do not store card numbers)
• Product content: Product titles, descriptions, files, images, videos, pricing, and course materials uploaded by creators
• Communications: Messages between creators and buyers, support inquiries, email marketing content
• Payout information: MoMo provider, phone number, bank name, account number, account holder name (required for creator payouts)
• Email subscribers: Email addresses and names of subscribers who opt in to creator email lists
• Team member information: Email addresses and roles of invited team members

3.2 Information Collected Automatically

When you use the Platform, we automatically collect:

• Device information: IP address, browser type and version, operating system, device type, screen resolution
• Usage data: Pages viewed, features used, time spent on pages, navigation patterns, search queries
• Transaction records: Order history, purchase amounts, payment status, payout records
• Login data: Login timestamps, device fingerprints (IP + User Agent hash for new device detection), session duration
• Landing page analytics: Page views, scroll depth, section engagement, checkout initiation events
• Activity logs: Security events such as logins, password changes, payout requests, API key creation (for creator accounts)

3.3 Information from Third Parties

We may receive information from:

• Paystack: Payment verification, transaction status, payout confirmations
• Firebase (Google): Authentication tokens when you sign in via Google OAuth
• Cloudinary: Media file metadata (image dimensions, video duration)
• PostHog: Anonymized product analytics events

3.4 Cookies and Tracking Technologies

We use the following cookies and tracking technologies:

• Essential cookies: Authentication tokens, session management (required for the Platform to function)
• Affiliate tracking cookies: 30-day cookies that attribute purchases to referring affiliates
• Rolling countdown cookie: A first-party identifier that lets us record, per visitor, when a rolling countdown offer started, so the discount window cannot be reset by revisiting the page
• Analytics cookies: PostHog analytics for usage patterns and feature adoption
• Facebook Pixel: If enabled by the creator, tracks page views, checkout initiations, and purchases for creator advertising campaigns
• Theme preference cookie (sp-theme): Persists your dark/light mode choice for one year so the dashboard renders in the correct theme on return visits

4. How We Use Your Information

We use your personal information for the following purposes:

4.1 Providing Our Services

• Creating and managing your account
• Processing transactions and facilitating payments between buyers and creators
• Processing creator payouts via Paystack Transfers
• Hosting and delivering digital products to buyers
• Enabling creator-to-buyer messaging
• Operating the email marketing system (sending campaigns and sequences on behalf of creators)
• Tracking affiliate referrals and commissions

4.2 Communication

• Sending transactional emails (order confirmations, payout notifications, password resets)
• Sending security alerts (new device logins, payout setting changes)
• Sending automated buyer onboarding emails (if enabled by the creator)
• Delivering creator email marketing campaigns (to subscribers who have opted in)
• Sending platform announcements and updates

4.3 Security and Fraud Prevention

• Detecting and preventing fraudulent transactions and account abuse
• Monitoring for unauthorized access (new device detection using IP + User Agent hashing)
• Rate limiting API requests to prevent abuse
• Logging security-relevant activities (logins, password changes, payout requests, API key operations)
• Verifying payout account ownership through Paystack
• Email OTP verification for sensitive payout setting changes

4.4 Analytics and Improvement

• Analyzing usage patterns to improve the Platform
• Generating aggregated, anonymized reports on platform performance
• Providing creators with analytics on their products, landing pages, and sales
• A/B testing landing page variations (Business tier and above)
• Monitoring application errors and performance via Sentry

4.5 Legal Compliance

• Complying with applicable laws, regulations, and legal processes
• Responding to lawful requests from authorities
• Enforcing our Terms of Service

5. Legal Basis for Processing

Under the Data Protection Act, 2012 (Act 843), we process your personal data on the following legal bases:

• Consent: When you create an account, subscribe to email lists, or enable optional features like Facebook Pixel
• Contractual necessity: Processing required to fulfill our obligations when you use the Platform (account management, payment processing, product delivery)
• Legitimate interest: Security monitoring, fraud prevention, analytics, and Platform improvement
• Legal obligation: When required to comply with applicable laws, court orders, or regulatory requirements

6. Information Sharing and Disclosure

6.1 With Other Users

• Creator profiles, product listings, and landing pages are publicly visible
• Creators can see buyer names and email addresses associated with purchases of their products
• Affiliate performance data (clicks, conversions) is visible to the creator who owns the product
• Team members can see data within the scope of their assigned role permissions

6.2 With Service Providers

We share data with third-party service providers who help us operate the Platform:

• Paystack (Ghana) -- Payment processing, recurring billing, payout transfers, account verification
• Firebase / Google (USA) -- User authentication, Google OAuth sign-in
• MongoDB Atlas (cloud) -- Database hosting and storage
• Vercel (USA) -- Application hosting and content delivery
• Cloudinary (USA) -- Image and video hosting, optimization
• Resend (USA) -- Transactional and marketing email delivery
• Upstash (cloud) -- Redis caching, background job processing (QStash)
• Sentry (USA) -- Error tracking and performance monitoring
• PostHog (EU/USA) -- Product analytics

These service providers are contractually obligated to protect your data and may only use it for the purposes of providing their services to us.

6.3 Creator Webhook Integrations

Creators on Scale tier and above may configure webhook endpoints that receive event data (e.g., order details, subscription events). When a webhook is triggered, order and customer data relevant to the event is sent to the creator's configured endpoint. Webhook payloads are signed with HMAC-SHA256. Creators are responsible for the security and data handling practices of their webhook endpoints.

6.4 For Legal Reasons

We may disclose your information if required to:

• Comply with applicable laws, regulations, or court orders
• Respond to lawful requests from government authorities
• Protect the rights, property, or safety of SkillsPad, our users, or the public
• Prevent or investigate fraud, security breaches, or Terms of Service violations
• Enforce our Terms of Service

6.5 Business Transfers

If SkillsPad is involved in a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Platform before your information becomes subject to a different privacy policy.

6.6 What We Do NOT Do

• We do not sell your personal information to third parties
• We do not share your data with advertisers for ad targeting (except via creator-enabled Facebook Pixel on their own pages)
• We do not use your content to train machine learning models

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Authentication: Firebase Auth with JWT-based session management and token refresh
• Password storage: Passwords are hashed using bcrypt -- we never store plaintext passwords
• API security: Zod-based input validation on all API endpoints, rate limiting, CORS protection
• Payment security: Payment data is processed by Paystack (PCI DSS compliant) -- we do not store card numbers
• API keys: Creator API keys are stored as SHA-256 hashes -- the raw key is shown only once at creation
• Webhook security: HMAC-SHA256 payload signing for webhook deliveries
• Payout security: Email OTP verification required for payout setting changes
• Data encryption at rest: Sensitive financial data (bank account numbers, mobile money numbers) and support ticket messages are encrypted using AES-256-GCM before storage in our database
• Device monitoring: New device login alerts sent to creator and admin accounts
• Transport security: All data in transit is encrypted via HTTPS/TLS
• Infrastructure: Hosted on Vercel with automatic DDoS protection and global CDN

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. If you discover a security vulnerability, please report it immediately to security@skillspad.org.

8. International Data Transfers

Your personal information may be transferred to and processed in countries other than Ghana, including the United States and European Union, where our service providers operate. When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Using service providers with strong privacy and security practices
• Contractual data processing agreements with all service providers
• Compliance with the Data Protection Act, 2012 (Act 843) requirements for cross-border transfers

9. Data Retention

We retain your personal information as follows:

• Account data: Retained for as long as your account is active, plus 12 months after deletion request
• Transaction records: Retained for 7 years for tax, accounting, and legal compliance
• Payout records: Retained for 7 years for financial compliance
• Activity logs: Retained for 12 months for security purposes
• Webhook delivery logs: Automatically deleted after 30 days (TTL index)
• Email campaign data: Retained for the lifetime of the creator's account
• Analytics data: Aggregated and anonymized data may be retained indefinitely

When you request account deletion, we will delete or anonymize your personal data within 30 days, except for data we are legally required to retain.

10. Your Rights

Under the Data Protection Act, 2012 (Act 843) and applicable law, you have the following rights:

10.1 Right of Access

You may request a copy of the personal data we hold about you. You can access most of your data directly through your account dashboard and settings.

10.2 Right to Rectification

You may update your account information at any time through your profile settings. If you need assistance correcting data you cannot update yourself, contact us at privacy@skillspad.org.

10.3 Right to Deletion

You may request deletion of your account and associated personal data by contacting us at privacy@skillspad.org. We will process your request within 30 days. Some data may be retained for legal compliance as described in Section 9.

10.4 Right to Restrict Processing

You may request that we restrict the processing of your data in certain circumstances, such as when you contest the accuracy of your data or object to our processing.

10.5 Right to Object

You may object to the processing of your personal data for direct marketing purposes at any time. You can unsubscribe from marketing emails using the unsubscribe link in every email or by updating your notification preferences in your account settings.

10.6 Right to Data Portability

Creators on eligible tiers can export their data (products, orders, customers) in CSV format through the Platform's export functionality. You may also request a copy of your data in a structured, machine-readable format by contacting us.

10.7 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@skillspad.org. We will respond within 30 days and may request verification of your identity before processing your request.

11. Creator Responsibilities

Creators who collect and process buyer data through the Platform have additional responsibilities:

• Creators must comply with the Data Protection Act, 2012 (Act 843) when handling buyer data
• Email marketing must only target subscribers who have given explicit consent
• Creators must not export buyer data for use on competing platforms
• Creators who use webhook integrations are responsible for the security and compliance of their receiving endpoints
• Creators must not share buyer personal data with unauthorized third parties
• Team members granted access must be trusted and briefed on data handling obligations

12. Facebook Pixel and Third-Party Tracking

Creators may enable Facebook Pixel on their product pages and landing pages. When enabled, Facebook may collect data about visitors to those pages, including page views, checkout initiations, and purchases. This data is subject to Facebook's (Meta's) own privacy policy. SkillsPad does not control how Facebook uses this data.

Buyers who wish to opt out of Facebook tracking can use browser-based ad blockers or adjust their Facebook ad preferences.

13. Children's Privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a person under 18, please contact us immediately at privacy@skillspad.org, and we will take steps to delete such information.

14. Third-Party Links

The Platform may contain links to third-party websites, including creator external links, post-purchase redirect URLs (e.g., WhatsApp, Telegram, Google Classroom), and affiliate tracking links. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or Platform features. We will notify you of significant changes by posting a notice on the Platform and/or sending an email to your registered email address. The “Last updated” date at the top indicates when the policy was last revised. Continued use of the Platform after changes constitutes acceptance of the updated policy.

16. Data Protection Authority

If you are not satisfied with our handling of your personal data, you have the right to lodge a complaint with the Data Protection Commission of Ghana:

Data Protection Commission
Website: dataprotection.org.gh
Accra, Ghana

17. Contact Us

If you have questions about this Privacy Policy, your personal data, or wish to exercise your rights, contact us at:

Privacy inquiries: privacy@skillspad.org

General support: support@skillspad.org

Security reports: security@skillspad.org

Your Consent

By using SkillsPad, you consent to the collection and use of your information as described in this Privacy Policy and in compliance with the Data Protection Act, 2012 (Act 843) of Ghana.