Privacy Policy for MuchSkills Product

Welcome to MuchSkills AB ("MuchSkills", "we", "us" or "our"). Your privacy matters to us. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the choices you have when using the MuchSkills platform (the "Service"). For information about cookies on our public website, see our separate Website Cookie Policy.

1  Who we are

MuchSkills AB is a Swedish company (organisation no. 559282‑2521) headquartered at Andra Långgatan 7 A, 413 03 Gothenburg, Sweden. For the processing activities described in this Policy, we act as data controller.

E‑mail: privacy@muchskills.com
Mail: MuchSkills AB, Attn: Privacy, Andra Långgatan 7 A, 413 03 Gothenburg, Sweden

2  What personal data we process

We collect only the data necessary to operate, secure and improve the Service.

RefContextDefinition2.1Account creationData: Name, e‑mail, login credentials, optional Google / LinkedIn IDsSource: You or single‑sign‑on provider2.2Profile & skillsData: Skills, expertise level, certifications, career goals, profile photo, bio text, education history, work and project experience, and years of experience.Source: You; organisation admins / managers; HRIS / API import, organization forms.2.3Usage & logsData: Login timestamps, in‑app actions, error & security logsSource: Collected automatically from your device2.4CommunicationsData: Support requests, feedback, newsletter preferencesSource: You2.5Organisation dataData: Admin contact details, aggregated team‑usage statsSource: Employer / client organisation

3  Why we process your data (legal bases)

4  How we use the data

We use personal data to:

• create, secure and maintain your account and workspace;
• let you record, validate and showcase skills and certifications;
• match you with projects, roles or teams inside the organisations you join;
• deliver onboarding flows, support responses and product updates;
• generate anonymised analytics that help us improve the Service;
• meet legal and compliance requirements;‍
• compile CVs/resumes and project capability statements for staffing, bids and recruitment, as instructed by your organization.

No third-party analytics, tracking pixels, fingerprinting, or profiling technologies are active inside the logged-in Service. Clients may export data via the MuchSkills API for their own analytics; they act as independent data controllers for such processing.

5  Use of artificial intelligence (AI)

Providers, such as OpenAI, operate under our instruction via written data processing agreements, including Standard Contractual Clauses and additional technical safeguards (e.g., strict API input filtering, no retention, no learning from data). For CV drafting, we minimize or remove personal identifiers from prompts before sending to the AI provider.

‍

6  Sharing your data

We may share data:

1. Within MuchSkills – authorised employees and contractors bound by confidentiality.
2. With organisations you join – your profile is visible only inside workspaces you accept.
3. With approved sub‑processors (see Section 7) under data‑processing agreements.
4. With public authorities when legally required.
5. In corporate transactions (e.g. merger or acquisition) – we will notify you.

We never sell personal data.

7  Sub‑processors and hosting

Your data is stored on EU servers provided by Amazon Web Services (Stockholm region). We also use:

• Intercom – in‑app chat and support (EU data centre)
• ActiveCampaign – optional e‑mail automation (Ireland)
• Google Workspace – business e‑mail & documents (EU)
• OpenAI API – AI skill suggestions (EU-based; SCCs + extra safeguards)
• Forest Admin – internal admin interface (EU-based, partial indirect access via secure proxy)
• MongoDB Atlas – managed cloud database (Stockholm, Sweden)‍
• Twilio SendGrid — email delivery for transactional/system emails (EU regional subuser)

The full, current list is available in the Service and reviewed regularly.

8  International transfers

If data moves outside the European Economic Area, we rely on:

• an EU adequacy decision; or
• Standard Contractual Clauses plus technical and organisational safeguards (encryption, access controls, pseudonymisation).

9  Retention and deletion

• Self‑service deletion: Users can delete their profile under Profile › Settings › Delete Account; organisation admins can remove a workspace under Admin › Settings › Delete Organisation.
• Back‑ups: Encrypted and retained for up to 35 days before irreversible deletion.
• Logs: Security logs may be retained for up to 12 months for fraud detection and compliance.

10  Your rights

Under the GDPR you can:

1. Access your data;
2. Rectify inaccurate data;
3. Erase data (“right to be forgotten”);
4. Restrict processing;
5. Object to processing based on legitimate interest;
6. Port data to another provider;
7. Withdraw consent at any time for optional e‑mails.

Contact privacy@muchskills.com. We reply within one month and may request proof of identity.

11  Cookies and tracking

The logged‑in Service sets only essential session cookies. We do not run external analytics scripts inside the platform. Cookie use on our public website is covered by the Website Cookie Policy.

12  Children’s privacy

The Service is intended for users 18 years and older. If we learn that we have collected personal data from a minor, we will delete it without delay. If you believe an underage individual has accessed the platform, please contact us. We will take immediate steps to investigate and remove associated data.

13  Changes to this policy

We may update this Policy from time to time. Material changes will be announced via in‑app notice or e‑mail at least 30 days in advance. The “Last updated” date at the top shows the current version.

14  Contact & supervisory authority

Questions or requests? E‑mail privacy@muchskills.com.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):
Website: https://www.imy.se
Phone: +46 8 657 61 00
E‑mail: imy@imy.se

Thank you for using MuchSkills – we are committed to protecting your privacy and giving you clear control over your data.

‍