Privacy Policy

Effective date: August 21, 2026 Last updated: August 21, 2026

Skillthropic is run by C&K Digital Holdings, LLC, a US limited liability company. We sell digital cybersecurity certification study guides: interactive online guides, downloadable PDFs, and in-browser practice questions.

This policy explains exactly what we collect, why, who we share it with, how long we keep it, and what you can do about it. We've tried to write it in plain English. If anything here is unclear, email us at contact@skillthropic.com and we'll answer.

The short version: We collect your email address, what you bought, how you use the guides, and basic website analytics. We use Stripe for payments and never see or store your card number. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We don't run ad-tech pixels or retargeting.

1. Who we are (data controller)

For visitors in the EU, UK, and Switzerland, C&K Digital Holdings, LLC is the controller of your personal data under the GDPR and UK GDPR. We have not appointed a Data Protection Officer, as we are not required to under Article 37: contact@skillthropic.com reaches the person responsible for privacy at Skillthropic directly.

2. Notice at Collection: categories of personal information

This section is our Notice at Collection under the California Consumer Privacy Act as amended by the CPRA. It also serves as our Article 13 disclosure for EU/UK visitors. Category letters refer to Cal. Civ. Code § 1798.140(v)(1).

We do not sell or share your personal information

We have not sold personal information, and we have not shared personal information for cross-context behavioral advertising, in the preceding twelve months, and we have no plans to. We also do not knowingly sell or share the personal information of anyone under 16.

Because we do not sell or share, there is no "Do Not Sell or Share My Personal Information" mechanism to use. If we ever change this, we will update this policy and provide that link before the change takes effect.

We do not use personal information for any purpose not listed in the table above without giving you notice first.

3. The specific data flows we actually have

Rather than list every conceivable thing a website might do, here is exactly what happens in our business.

3.1 Buying a guide (Stripe)

When you check out, you are handed off to Stripe, Inc., our payment processor.

• You do not need an account to buy. Checkout is email-only.
• Your card details go directly to Stripe. They are entered into Stripe-hosted fields and transmitted to Stripe. Card numbers, CVC codes, and expiry dates never touch Skillthropic's servers and we could not access them if we wanted to.
• Stripe returns to us: your email address, billing name, billing country/postal code, card brand and last four digits, the amount, and a transaction ID.
• Stripe acts as an independent controller for its own fraud-prevention and regulatory purposes, and as our processor for handling the payment on our behalf. Stripe's own privacy policy governs their independent use of your data: https://stripe.com/privacy
• We store the transaction record for accounting, tax, refunds, and chargeback response.

3.2 Getting access after purchase

Access is provisioned automatically from the email address you use at checkout. We create an access record tied to that email holding: your email, which guides you own, when you bought them, and (for subscribers) whether your subscription is active.

If you mistype your email at checkout, contact contact@skillthropic.com and we'll move your access to the right address.

3.3 The newsletter: "The AI Security Brief"

If you subscribe, we pass your email address (and first name, if given) to Kit (formerly ConvertKit), our email service provider, which acts as our processor.

• Legal basis: consent (Art. 6(1)(a)) where you signed up directly for the newsletter.
• If you are an existing customer, we may also email you about product updates and closely related guides on the basis of our legitimate interests (Art. 6(1)(f)) / the soft opt-in permitted under the ePrivacy Directive and PECR, and under the CAN-SPAM Act in the US.
• Every marketing email has a one-click unsubscribe link. Unsubscribing is instant and does not affect access to anything you bought.
• We track email opens and link clicks in aggregate to see which topics land. You can prevent open tracking by blocking remote images in your email client.

3.4 The free readiness quiz

The quiz collects your answers and, if you want your results emailed, your email address.

• Legal basis: consent (Art. 6(1)(a)). The quiz is voluntary and you can browse the site without taking it.
• We use your answers to generate a readiness score and a recommended study path, and (if you opted in) to tailor follow-up emails.
• Quiz answers are not sold, not shared with advertisers, and are not used to make any decision that has a legal or similarly significant effect on you. We do not do automated decision-making in the Article 22 sense.

3.5 Using the guides

Inside the interactive guides, we record which sections you open, which practice questions you attempt, and your answers, so we can show your progress and see which questions are confusing and need rewriting.

• Legal basis: contract (Art. 6(1)(b)) for progress features you asked for; legitimate interests (Art. 6(1)(f)) for improving question quality.
• PDF downloads are logged (email, file, timestamp) for support and to detect abnormal patterns such as credential sharing or mass downloading.

3.6 Web analytics

We use Vercel Analytics and PostHog to understand traffic: how many people visit, which pages, which referral sources, where people drop off.

• Legal basis: consent (Art. 6(1)(a)) for EU/UK visitors where the analytics rely on cookies or similar device storage; legitimate interests (Art. 6(1)(f)) elsewhere.
• We do not use advertising pixels, retargeting tags, or data-broker enrichment.

3.7 Hosting and infrastructure

The site and the guides are hosted by Vercel, which processes data on our behalf as a processor and holds server logs (including IP addresses) for security and troubleshooting.

3.8 Who we share personal information with

We do not disclose personal information to data brokers, advertising networks, or any third party for their own marketing.

We will disclose information if legally compelled (a subpoena, court order, or valid law-enforcement request) and, where we are permitted to, we will tell you first.

4. Cookies and similar technologies

We keep cookie use minimal. Here's the full picture.

How to opt out

• EU/UK/EEA and Switzerland: a consent banner appears on your first visit. Non-essential cookies are not set until you agree. You can change your choice any time via "Cookie settings" in the footer.
• Everywhere: you can block or delete cookies in your browser settings. Blocking strictly necessary cookies will break guide access.
• Global Privacy Control (GPC): we honor the GPC browser signal. Because we do not sell or share personal information, a GPC signal has nothing to opt you out of, but we treat it as an opt-out of non-essential analytics as well.
• Do Not Track: there is no consistent industry standard for DNT, so we do not respond to DNT headers. We do honor GPC.

5. Children's privacy

Skillthropic is intended for adults pursuing professional IT certifications. It is not directed at children.

• United States: we do not knowingly collect personal information from children under 13. If we learn we have, we will delete it promptly. Parents or guardians can contact contact@skillthropic.com.
• EU/UK: we do not knowingly collect personal data from anyone under 16. Where a lower age of digital consent applies in your Member State, we still do not target or knowingly serve under-16s.
• We do not knowingly sell or share the personal information of consumers under 16, and as stated above, we do not sell or share anyone's personal information.

6. How long we keep your data

When a retention period ends, we delete the data or irreversibly de-identify it. If a legal hold or open dispute applies, we keep the relevant records until it is resolved.

7. Your rights

7.1 If you are in the EU, UK, EEA, or Switzerland (GDPR / UK GDPR)

You have the right to:

• Access: get a copy of the personal data we hold about you, plus the information in this policy.
• Rectification: have inaccurate data corrected and incomplete data completed.
• Erasure ("right to be forgotten"): have your data deleted where we no longer have a lawful reason to keep it. Note: we may need to keep transaction records for the tax retention period above, and deleting your access record ends your access to purchased guides.
• Data portability: receive the data you gave us in a structured, commonly used, machine-readable format (we provide CSV/JSON), and have it transmitted to another controller where technically feasible.
• Restriction of processing: have us pause processing while a dispute about accuracy or legitimate interests is resolved.
• Object: object at any time to processing based on legitimate interests, including profiling. You can object to direct marketing at any time and we will stop, no questions asked and no balancing test.
• Withdraw consent: where processing is based on consent (newsletter, quiz, non-essential cookies), withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
• Not be subject to solely automated decision-making producing legal or similarly significant effects. We don't do this.

Right to complain: you can lodge a complaint with your local supervisory authority. In the UK, that is the Information Commissioner's Office (ico.org.uk). In the EU, a list of authorities is at edpb.europa.eu/about-edpb/about-edpb/members_en. We'd appreciate the chance to fix it first (email contact@skillthropic.com) but you are not required to contact us before complaining.

7.2 International transfers

Skillthropic is based in the United States, and our processors (Stripe, Kit (formerly ConvertKit), Vercel Analytics and PostHog, Vercel) process data in the United States and other countries. That means personal data of EU/UK/Swiss visitors is transferred outside the EEA/UK.

We rely on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914), incorporated into our data processing agreements with each processor;
• the UK International Data Transfer Addendum to the SCCs, or the UK IDTA, for transfers from the United Kingdom;
• the Swiss addendum to the SCCs for transfers from Switzerland;
• where a recipient is certified, the EU–US Data Privacy Framework (and its UK Extension and Swiss–US bridge) as an adequacy-based alternative.

We carry out transfer impact assessments where required and apply supplementary measures including encryption in transit (TLS 1.2+) and at rest, access controls, and data minimization. You can request a copy of the relevant SCCs, with commercial terms redacted, by emailing contact@skillthropic.com.

7.3 If you are in California (CCPA/CPRA)

You have the right to:

• Know what personal information we collect, use, disclose, and (if we did) sell or share: the tables above are that disclosure.
• Access a copy of the specific pieces of personal information we hold about you.
• Delete personal information we collected from you, subject to the exceptions in § 1798.105(d).
• Correct inaccurate personal information.
• Opt out of sale or sharing: not applicable, because we do not sell or share.
• Limit the use of sensitive personal information: not applicable, because we do not collect it.
• Non-discrimination. We will never charge you a different price, give you a lower-quality product, or deny you service for exercising a privacy right. We do not offer financial incentives for personal information.

You may use an authorized agent to submit a request; we will ask for written proof of authorization and may ask you to verify your identity directly.

7.4 Other US states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have comparable rights to access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and profiling. We honor these through the same process below. Where a state provides a right to appeal a denied request, you may appeal by replying to our decision email with the word "Appeal"; we will respond within 45 days with a written explanation, and will tell you how to contact your state Attorney General if you remain unsatisfied.

7.5 How to exercise your rights

Email contact@skillthropic.com with the subject line "Privacy Request" and tell us what you want (access, deletion, correction, portability, objection, restriction). Include the email address you used with Skillthropic.

• Verification: we verify you by confirming control of the email address on the account, usually a confirmation link sent to that address. For sensitive requests such as deletion of a purchase record, we may ask for one additional data point already in our records (for example, the last four digits of the card used or the approximate purchase date). We will not ask you to create an account to make a request.
• Timing: we acknowledge within 10 business days and substantively respond within 30 days (GDPR: one month, extendable by two further months for complex requests, with notice; CCPA: 45 days, extendable once by 45 days, with notice).
• Cost: free. If a request is manifestly unfounded or excessive we may charge a reasonable fee or decline, and we will explain why.

8. How we protect your data

• All traffic to the site and guides is encrypted with TLS.
• Card data is handled entirely by Stripe, a PCI-DSS Level 1 service provider. We do not store card numbers.
• Access to customer records is limited to the people who need it to run the business, protected by strong authentication.
• Processor relationships are governed by written data processing agreements.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and notify affected individuals without undue delay as required by applicable law.

9. Changes to this policy

If we make a material change (a new category of data, a new purpose, a new recipient, or a change to your rights), we will update the "Last updated" date, post a notice on this page, and email active customers and newsletter subscribers at least 14 days before the change takes effect. Continuing to use Skillthropic after the effective date means the updated policy applies.

We keep prior versions available on request at contact@skillthropic.com.

10. Contact