Privacy notice
Version: 2026-11-15-v1
Terms and information for the May the Skills Be With You service. Paid ordering becomes available after activation of the payment service. The checkout always shows the current availability.
Service provider and controller: Vágó Péter János e.v., trading as Smart Square Productions (SSP). Registered address: 1124 Budapest, Lejtő út 4., Magyarország. Tax number: 41852718-1-43; sole trader registration number: 58098091. Contact: hello@smartsquareproductions.com. Telephone: +36706728020. You can also use the email or postal address above.
1. Scope
This notice covers the public, checkout and separate private application of May the Skills Be With You. It does not automatically cover other SSP products or the independent processing of your chosen AI provider. Exact provider contracts, data processing agreements, regions and international-transfer safeguards still require verification; these are paid-launch blockers, not completed compliance hidden behind placeholders.
2. Accounts, sign-in and access
Netlify Identity provides the email account and password authentication. The application uses email, account ID, verification/sign-in times, session and entitlement data. It stores hashes rather than its own issued session/OAuth codes and tokens; provider authentication data belongs to the authentication system separately. Access uses application sessions of up to 8 hours; annual entitlement is distinct.
Purpose and basis: registration at your request, entering into a contract and providing the service under GDPR Article 6(1)(b); necessary anti-abuse and access-security checks under Article 6(1)(f), serving the security interests of the provider and authorised users. Final documentation of the legitimate-interest assessment is a commercial-launch condition. Required account/order data is necessary to fulfil those functions; this does not make marketing mandatory.
3. Orders, payments, invoices and confirmations
Data may include necessary buyer/billing name, address, country, email and justified tax identifiers; order ID, price, currency and time; the complete accepted contract and early-start request; payment states/provider references; annual entitlement dates; invoice and message states. Purposes and bases are fulfilling the order/service (Article 6(1)(b)), legal invoicing, tax and consumer obligations (Article 6(1)(c)), and necessary, limited evidence for legal claims (Article 6(1)(f)). Financial retention must follow the sole trader’s actual tax profile rather than an invented universal period.
Barion provides payment processing. The library application does not request or store your card number or CVC; payment takes place on the payment provider’s interface. Számlázz.hu receives necessary invoicing data. A browser return or tracking event does not prove payment. Server checks determine price and state; marketing choice is not a purchase gate.
4. Library-serving logs and AI connections
Web/MCP starter, details and original-file serving logs record the signed-in account ID/email, skill ID/name, event, channel and server time. Purposes are access security, traceability of lawful serving and troubleshooting, based on a purpose-limited legitimate interest (Article 6(1)(f)). The owner can access the log. A served file is not proof of saving to disk; direct external GitHub downloads are not visible to this log. Infrastructure may keep separate technical logs; absence of IP addresses from an application table does not prove their absence from provider logs.
MCP client name, callback URL, requested scope, decision and expiry are needed to perform and secure the requested connection. Your chosen ChatGPT/Claude/Codex/Claude Code client receives only individually requested search results, details or starters. It receives no account list, log, original submitted community file or admin operation. Responses reach your own AI-account provider under its terms. Technical OAuth permission is not, by itself, a GDPR basis for every processing activity.
5. Community uploads and OpenAI audits
The full Markdown, filename, skill name, licence, source, contributor ID/email, audit and decision may be stored. Pending submissions are visible to their contributor and the owner. The basis for the expressly requested upload/audit feature is contract performance (Article 6(1)(b)); sharing rights and the stated AI processing are separately confirmed by the user. This does not legitimise unauthorised disclosure of another person’s data.
The AI audit may send the complete raw submission, name/licence and up to twenty selected metadata entries to the OpenAI API. The system does not add contributor email or account ID, but personal data inside the uploaded text may leave the application. The store:false setting does not prove Zero Data Retention or the absence of all provider retention. The actual contract, retention, processing role and international safeguards remain open checks.
Base/automatic own-skill imports share metadata and starters only. After community acceptance, active members may download the original SKILL.md on the website, not through MCP. This scope is disclosed before upload; withdrawing sharing rights and deleting personal data are separate cases.
6. Contact and rights requests
Name, reply address, case type, known order/contract reference, request text, receipt time and handling evidence are needed to respond and fulfil legal duties. Bases are contractual support (Article 6(1)(b)), consumer/data-protection obligations (Article 6(1)(c)), and limited legal-claim handling (Article 6(1)(f)). Passwords, tokens, full card details and identity-document copies are not requested by default. Identity clarification does not replace the original receipt time.
7. Barion Base, marketing and browser storage
The public www document and private app use separate origins. Private library, authentication, case handling and request documents contain no Barion SDK or noscript hit. Public Barion Base serves fraud prevention; Full marketing separately serves measurement/personalised advertising. They are different data flows. Final verification of Base necessity, cookie/processing basis and actual partner roles is a launch condition; the project’s own Pixel ID and provider approval are not yet evidenced.
Full marketing can be enabled only through a separate, initially unchecked, optional consent (Article 6(1)(a)). Reject or withdraw it at any time in measurement settings, without losing the service and without affecting prior lawful processing. This consent is not a newsletter subscription; purchasing is not marketing consent. Public purchase actions and the SHA-1 identifier of the verified account email may enter Barion’s marketing flow. The hash is pseudonymous personal data, not anonymisation. Private library searches, auth URLs, tokens and case text are not marketing events. Details and planned storage: /sutik?lang=en; Barion notice and partners: https://www.barion.com/en/privacy-notice/.
8. Retention rules and actual state
The approved operational plan proposes 90 days for content-serving and closed audit-delivery logs; 30 days after closure for rejected/withdrawn community submissions and audits, and 30 days after last validity/revocation for expired/revoked session/OAuth security records. This is a plan, not an operating general automatic purge. Pending audits, linked outbox data, DCR protection history and disputes cannot be blindly deleted by age. Execution and relationship handling remain open; this text starts no production deletion.
Accounts and accepted community entries are needed while the service/lawful sharing continues. Closed case data must be reviewed; deletion of unnecessary data and restriction of lawfully retained records require separate documentation. Consumer complaints and substantive responses must be kept for 3 years. Limited contract/claim evidence is retained according to the actual claim, limitation starting point and dispute; the general civil limitation period is not an automatic five-year licence to keep every item.
Invoices and necessary financial records remain until the applicable tax/accounting retention condition is met. Final periods depend on the sole trader’s actual tax profile, the right to assess tax, its starting year and extensions. No universal eight-year period or simple five years from the invoice date is promised. Pending invoice, refund or email tasks are not subject to operational age-based deletion.
The selected rolling recovery plan of no more than 30 days for production personal-data database backups lacks provider evidence. It cannot be described as completed and does not replace separate preservation of necessary financial/legal records. Restores must reapply prior deletions and revocations. A local secret-free project archive is different from a production personal-data database backup.
9. Providers and international transfers
Netlify supplies hosting, functions, Identity and the database connection used. OpenAI API supplies the optional raw-text audit. Barion supplies payments and, when separately configured, Base/Full flows. Számlázz.hu issues invoices. The support mailbox and planned transactional sender may process messages. Your external AI-account provider processes the content you request.
Exact legal contracting entities, controller/processor roles, DPAs, subprocessors, regions, retention and actual contractual safeguards for transfers outside the EEA still require documentation. Provider names alone do not establish EU-only storage or compliant international transfers. Paid commercial launch stays closed until these checks are resolved.
10. Rights and response time
You may request access, rectification and, where applicable, erasure, restriction and portability; object to legitimate-interest processing and withdraw consent. Applicability depends on the basis and circumstances. Your data export may include your order, contract, payment, entitlement, invoice and message data without other people’s information or server secrets. An AI audit is a skill recommendation subject to owner decision. Server payment and entitlement checks apply predefined contractual conditions rather than building a consumer profile from private library behaviour; disputed results can be referred to support for human review.
A response is generally due within one month of receipt. Where the GDPR permits a necessary extension by up to two further months, the extension and reasons must be communicated within the first month. Proportionate identification may be needed to avoid disclosure to the wrong person. Erasure is not unlimited: records necessary for a specific legal duty or claim may be retained within scope; reasons and remedies must be given for refusal or partial fulfilment. Unnecessary profile/marketing data has no general exemption.
Contact: hello@smartsquareproductions.com, or https://app.skillswithyou.com/ugyintezes?lang=en without signing in. You may complain to Hungary’s National Authority for Data Protection and Freedom of Information (NAIH) and seek a judicial remedy. Current authority submission methods: https://www.naih.hu/ugyfelszolgalat-kapcsolat. Emailing the provider and initiating a formal authority procedure are distinct processes.
11. Sources and version
GDPR Articles 5–6, 12–13 and 15–22: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 Consumer complaints: https://njt.jog.gov.hu/jogszabaly/1997-155-00-00 Tax-record retention: https://njt.jog.gov.hu/jogszabaly/2017-150-00-00 This full text forms part of the order snapshot; substantive changes require a new version.