Privacy Policy

Last updated: September 15, 2026.

1. Who we are

Skilnu is operated by Alessandro Delfino ("Skilnu," "we," "us"). This policy explains what personal data we collect through the Skilnu website, registry, and MCP server (together, the "Service"), why, and what rights you have over it. We apply the same protections described here to every user regardless of location, and specifically design this policy to meet both EU GDPR and UK GDPR/DPA 2018 requirements.

2. What we collect

• Account data — the email address and password you sign up with (handled by Amazon Cognito; we never see your plaintext password), and the publisher handle you choose.
• Content you publish — skill files, descriptions, tags, and any dependency/version metadata you attach to them. Public skills are, by design, visible to anyone; private and shared skills are visible only to you and whoever you explicitly share them with.
• Usage data — which skills are read, searched, or invoked through the API/MCP server, when, and by which account or API key, so the Service can enforce access control, rate limits, and per-tier usage quotas, and so we can see basic aggregate activity (like daily active MCP users) to operate the Service.
• Billing data — if you subscribe to a paid tier, Stripe processes your payment details directly; we store a Stripe customer/subscription reference, not your card number.
• MCP/OAuth tokens — issued when you or an MCP client authorize access to your account, so the Service can tell which requests are yours.
• Technical data — standard request metadata (IP address, timestamps, request path) captured in operational logs and by our WAF (web application firewall), used for security, abuse prevention, and debugging.
• Website traffic logs — server-side access logs for our landing page and web app (IP address, timestamp, requested path, referrer, user agent), used only to measure aggregate traffic — for example, how many visits the landing page receives. These are plain request logs, not a client-side tracking script, and we don't use them to build individual visitor profiles.

We do not use third-party advertising, and we do not sell your data. The web app stores your login session in your browser's local storage (not a tracking cookie) so you stay logged in between visits — this stays on your device and isn't something we can read.

3. How we use it

• To provide the Service — authenticate you, serve and enforce access to skills, run the MCP server, process payments.
• To keep the Service secure — the automated security scan every published skill goes through, WAF-based abuse protection, and rate limiting.
• To generate optional AI-assisted features you use — semantic search, suggested/combined skill drafts, and description embeddings are computed by sending the relevant skill text to a large language model we call on your behalf (see "Third parties," below). We don't use your private skill content to train our own models.
• To communicate with you about your account — verification emails, password resets, and service-affecting notices.

4. Legal basis (GDPR / UK GDPR)

We process account, content, and billing data because it's necessary to perform our contract with you (providing the Service you signed up for). We process security/abuse data (WAF logs, rate-limit tracking) under legitimate interest — keeping the Service and other users' data safe. We process website traffic logs under legitimate interest too — understanding how many people use the Service and improving it. Where we send anything to a third-party AI model on your behalf (search, suggestions, embeddings), that's also necessary to provide the specific feature you invoked.

5. Third parties we share data with

We use a small number of subprocessors to run the Service — we don't sell or rent your data to anyone:

• Amazon Web Services (AWS) — hosts the Service, including all databases and file storage, in the eu-west-1 (Ireland, EU) region.
• Amazon Bedrock (an AWS service) — used to compute semantic-search embeddings and to generate suggested/combined skill drafts. Skill text you submit for these features is sent to the underlying model for that single request; it is not used to train the model.
• Stripe — processes payments for paid subscriptions and stores your payment method on our behalf.

6. International transfers

Your data is hosted in the EU (AWS eu-west-1). Where a subprocessor transfers data outside the EU/UK, we rely on that provider's Standard Contractual Clauses or an equivalent lawful transfer mechanism.

7. Data retention

We keep account and content data for as long as your account is active. Operational logs (including WAF/security logs) are retained only as long as needed for security and debugging and are then deleted on a rolling basis. Website traffic logs are retained for 90 days on a rolling basis, then automatically deleted. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we're required to keep something longer (for example, billing records, for tax/accounting purposes).

8. Your rights

Under GDPR and UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request erasure of your data ("right to be forgotten");
• Export your data in a portable format;
• Object to, or ask us to restrict, certain processing; and
• Lodge a complaint with your local data protection authority.

You can request account and data deletion at any time by contacting us at support@skilnu.com. Publicly published skills you own are removed from the catalog as part of that request; content you shared or that others copied before deletion may still exist independently of your account.

9. Children's privacy

The Service isn't directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we'll delete it.

10. Changes to this policy

We may update this policy as the Service changes. We'll update the "Last updated" date above, and for material changes we'll make a reasonable effort to notify account holders before the change takes effect.

11. Contact

Questions, or want to exercise any of the rights above? Reach us at support@skilnu.com.