GDPR Notice

Overview

This notice summarizes how we process personal data under the EU General Data Protection Regulation (GDPR). For the full picture, see our Privacy Policy.

Controller

skillwhimsy is the data controller for the personal data described here. Contact: info@skillwhimsy.com.

What we process and the legal basis

• Account & authentication (email, Cognito identifiers) — Art. 6(1)(b) performance of a contract.
• Learning content and study activity (courses, sessions, messages — possibly about a child) — Art. 6(1)(b), with parental/guardian consent where it concerns a child.
• Billing (subscription status via Stripe) — Art. 6(1)(b)/(c).
• Analytics (Google Analytics) — Art. 6(1)(a) consent; loaded only after you accept the cookie banner.

Recipients (processors)

Amazon Web Services (hosting/auth/storage), OpenAI (AI generation — lesson and conversation text is sent to generate responses), Stripe (payments), and Google Analytics (only with consent).

International transfers

Some processors are outside the EEA (e.g. the United States). Transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Retention

We keep account and learning data while your account is active and as needed to run the service; billing records may be kept longer where law requires. You can request deletion at any time.

Your rights

Under the GDPR you have the right to:

• access your data and obtain a copy (portability);
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict or object to processing;
• withdraw consent (e.g. analytics) at any time;
• lodge a complaint with your local data protection authority.

To exercise any of these, contact info@skillwhimsy.com.

Children

Accounts are for adults. Where content concerns a child, the parent/guardian who owns the account provides and manages consent, and only they (and our backend systems) can access that content.