Skip to main content
    ← Back to Home

    Privacy Policy

    Effective Date: March 13, 2026 · Last Updated: August 1, 2026

    Privacy at a Glance

    This summary is not legally binding. Please read the full policy below.

    • • We collect only what is necessary to verify skills and operate the Service.
    • • We do not sell your personal data.
    • • We do not train AI on your submissions without explicit consent.
    • • Your ArcProof credential is private by default — you control visibility.
    • • You can export or delete your data at any time.

    1. Scope

    SkillUpArc LLC, a Delaware Limited Liability Company, is the data controller for personal information collected through this platform. This Privacy Policy applies to all users of the ArcProof platform, including learners, instructors, university administrators, and employers. It describes how SkillUpArc LLC ("we," "us," or "our") collects, uses, discloses, and protects your information when you use our website, applications, and services (collectively, the "Service").

    2. Information We Collect

    2.1 Information You Provide

    • • Account Information: Name, email address, password (encrypted), and optional profile details
    • • Payment Information: Processed securely by Stripe. We do not store full payment card details.
    • • User Content: Resumes (see Section 9 for how resumes submitted through the free, no-signup scan are handled), assignments, project submissions, assessment responses, forum posts, and AI mentor conversations
    • • LMS Data: Coursework and assignment data imported from integrated learning management systems (Canvas, Blackboard, Moodle, Brightspace) at your direction
    • • Communication: Messages sent to support or through platform features

    2.2 Information Collected Automatically

    • • Usage Data: Pages visited, features used, session duration, and learning progress
    • • Device Information: Device type, operating system, browser type, and screen resolution
    • • Network Information: IP address and general location (country/region level only)
    • • Assessment Behavioral Data: Response timing, editing patterns, and interaction signals used to ensure assessment integrity (see our AI Usage Policy)
    • • Session Integrity Data: When completing assessments or skill scans, we collect session telemetry including tab-focus and tab-blur events, time spent per question, copy-paste event counts, and a hashed device identifier. This data is used to generate a cryptographic Session Integrity Hash — a tamper-evident record embedded in your credential that allows independent verification that the assessment was completed by a real human in a genuine session. The raw telemetry is not stored permanently; only the resulting hash is retained as part of your credential record.

    2.3 Information Generated by the Service

    • • Skill scores, competency evidence, and proficiency levels
    • • Digital credentials and certificate data
    • • AI mentor conversation histories
    • • Learning path recommendations and progress analytics

    3. How We Use Your Information

    • • Provide the Service: Deliver courses, AI mentoring, assessments, skill verification, credential issuance, and learning path personalization
    • • Process Submissions: Analyze uploaded content (resumes, assignments, projects) using AI to extract skills and generate competency evidence
    • • Assessment Integrity: Use behavioral interaction data to detect and prevent cheating or automated bot activity during assessments
    • • Credential Integrity: Generate cryptographic session hashes embedded in ArcProof credentials to enable tamper-evident, independently verifiable proof of genuine human assessment completion.
    • • Employer Marketplace: Display your verified skill data to employers only when you have explicitly opted in
    • • Improve Quality: Analyze aggregated, anonymized usage patterns to improve courses, assessments, and AI accuracy
    • • Communication: Send essential service emails, course updates, credential notifications, and security alerts
    • • Security: Detect fraud, prevent abuse, and protect platform integrity
    • • Legal Compliance: Fulfill legal obligations and respond to lawful requests

    4. What We Do Not Do

    • ✗
      Sell Your Data: We never sell, rent, or trade your personal information to third parties.
    • ✗
      Train AI on Your Submissions: Your User Content is not used to train AI models without your explicit, informed consent.
    • ✗
      Track You Across the Web: We do not use third-party tracking pixels, cross-site advertising, or sell data to ad networks.
    • ✗
      Share Without Permission: Learning records and skill data are never shared with employers, universities, or third parties unless you explicitly authorize it.

    5. ArcProof & Employer Visibility

    Your ArcProof credential and competency scores are private by default. You control whether employers can discover your profile through the employer marketplace.

    When you opt in:

    • • Only verified skill scores and evidence types are visible — never raw submissions
    • • Employers see aggregated competency data, not personal information
    • • Your identity is revealed only when you choose to connect with a specific employer
    • • You can revoke marketplace visibility at any time

    6. When We Share Information

    We share your information only in the following limited circumstances:

    • • Service Providers: Third-party processors (e.g., Stripe for payments, cloud infrastructure for hosting) under strict data processing agreements
    • • At Your Direction: When you share your ArcProof credential, connect with employers, or authorize LMS integration
    • • Credential Verification: Public credential verification URLs display only the information shown on the credential itself
    • • Legal Obligations: When required by law, regulation, legal process, or enforceable governmental request
    • • Safety: To protect the rights, safety, or property of ArcProof, our users, or the public
    • • Business Transfer: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users

    7. Authorized Third-Party AI Agents (MCP Integration)

    ArcProof operates an agent integration built on the Model Context Protocol ("MCP"). It allows external AI assistants — for example Claude, ChatGPT, or another MCP-compatible client — to read certain ArcProof data on your behalf. This integration is off unless you turn it on.

    7.1 Explicit Authorization Required

    An external AI agent can only reach your data after you sign in to ArcProof and complete an OAuth authorization flow granting that specific client access. We do not grant agent access on your behalf, and no agent can connect using a shared or platform-level credential.

    7.2 What an Authorized Agent Can Access

    An authorized agent can call four read-only tools:

    • • Identity: your ArcProof user ID and the email address on your account
    • • Your credentials: the ArcProof credentials issued to your account
    • • Your skill statistics: your verified skill scores and competency summary
    • • Catalog search: the public ArcProof Skill Foundations catalog (contains no personal data)

    These tools are read-only. They cannot create, alter, or delete credentials, scores, assessment results, payment data, or account settings.

    7.3 Scoped to Your Own Data

    Every agent request runs under your own authenticated session and is enforced by database row-level security (RLS). An agent authorized by you can only return records that you could see yourself in the ArcProof interface — never another user's data.

    7.4 Third-Party Handling

    Once data is returned to an external AI assistant, that assistant's own privacy policy and retention practices govern what happens to it. SkillUpArc LLC does not control how a third-party AI provider stores, logs, or processes information you direct it to retrieve. Review the provider's policy before authorizing access.

    7.5 How to Revoke Access

    You can revoke an agent's access at any time by removing the ArcProof connection inside the third-party assistant, or by emailing hello@skilluparc.com to have the authorization revoked on our side. Revocation invalidates the agent's tokens; a new OAuth authorization is required before it can access your data again.

    Your use of this integration is also governed by the MCP/API clause in our Terms of Service.

    8. Data Security

    • • End-to-end encryption for data in transit (TLS 1.3)
    • • Encrypted data storage at rest (AES-256)
    • • Passwords hashed using bcrypt — never stored in plain text
    • • Role-based access controls with multi-factor authentication for staff
    • • Ongoing dependency and application security review
    • • Automated backups with geographic redundancy

    For more details, see our Data Protection & Security page.

    9. Data Retention

    • • Free Skill Gap Scan (no account): Resume text submitted through the free, no-signup scan is transmitted to our AI processing provider to generate your report and is not written to your ArcProof account or stored in our database. We retain only an abuse-prevention record (a rate-limiting entry derived from your IP address and the endpoint called). If you create an account and choose to save a scan, the resulting report is then stored under your account.
    • • Active Accounts: Data is retained as long as your account remains active
    • • Account Deletion: All personal data is permanently deleted within thirty (30) days of account closure
    • • Credential Verification: Minimal credential data may be retained for public verification URLs until revoked
    • • Backups: Encrypted backups are purged within ninety (90) days of deletion
    • • Legal Holds: Data subject to legal proceedings or regulatory requirements may be retained as required by law

    10. Your Rights & Choices

    Depending on your jurisdiction, you may have the following rights:

    Access: Request a copy of the personal data we hold about you.
    Correction: Request correction of inaccurate or incomplete data.
    Deletion: Request permanent deletion of your account and associated data.
    Data Portability: Download your learning records, skill scores, and credentials in a machine-readable format.
    Opt Out: Unsubscribe from marketing emails. Control employer marketplace visibility. Withdraw consent for optional data processing.
    Restriction: Request restriction of processing in certain circumstances.
    Objection: Object to processing based on legitimate interests.

    To exercise any of these rights, contact hello@skilluparc.com. We will respond within thirty (30) days.

    11. Children's Privacy

    ArcProof is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If we learn that we have collected data from a minor, we will promptly delete it. If you believe a minor has provided us with personal data, please contact us at hello@skilluparc.com.

    12. International & Regulatory Compliance

    • • GDPR (EU/UK): Full compliance for EEA and UK users, including lawful basis for processing, data subject rights, and data protection impact assessments
    • • Education records (US): Any institution-specific education-record obligations must be defined in a written agreement before such data is processed
    • • CCPA/CPRA (California): California residents have enhanced privacy rights including the right to know, delete, and opt out of sale (we do not sell personal information)
    • • PIPEDA (Canada): Compliance with Canadian privacy law for Canadian users
    • • LGPD (Brazil): Compliance with Brazilian data protection requirements

    Data Transfers: If your data is transferred outside your jurisdiction, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses for EU data transfers).

    13. Cookies & Similar Technologies

    We use essential cookies to operate the Service (e.g., authentication, session management). We do not use advertising or cross-site tracking cookies.

    • • Essential Cookies: Required for login, security, and core functionality. Cannot be disabled.
    • • Analytics Cookies: Used to understand usage patterns and improve the Service. Can be disabled.

    14. Changes to This Policy

    We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-platform notice at least thirty (30) days before taking effect. The "Last Updated" date at the top reflects the most recent revision.

    Questions About Privacy?

    Privacy Inquiries: hello@skilluparc.com

    Data Protection Officer: hello@skilluparc.com

    Address: SkillUpArc LLC, a Delaware Limited Liability Company, Wilmington, Delaware, USA

    Trademark & claims notice

    "ArcProof"™ and related product names are unregistered trademarks used by SkillUpArc LLC to indicate intent of common-law trademark rights. The ™ symbol denotes intent of use and does not represent a registered trademark with the USPTO or any other trademark office. Nothing on this site constitutes legal, financial, or compliance advice. Product descriptions, verification methods, and outcome claims are marketing summaries and may evolve. For authoritative information about credentials, integrity protocols, or licensing, contact us directly.

    Founding member pricing — ArcProof Pro at $29/month or $199/year (≈$17/mo). Your founding rate stays the same for as long as your subscription stays active.

    See pricing