Skill Locker
Home

Privacy Policy

Last updated: 18 July 2026

This policy explains what personal data Skill Locker collects, why we collect it, who we share it with, and the rights you have over it. We’ve written it in plain English rather than legalese.

Skill Locker (“we”, “us”, “our”) is a trading name of Novarly Ltd, the company that operates the site and is the data controller for the personal data described here. Novarly Ltd is registered in England and Wales (company number 17344298), with its registered office at 117 Western Avenue, Market Harborough, LE16 9PN, and is registered with the UK Information Commissioner’s Office (ICO) under reference ZC200545. If you have any questions, email [email protected].

What we collect, and why

  • Your email address— when you sign up, buy a skill pack, or request a magic-link sign-in. We use it to log you in, deliver the skills you’ve purchased, and send you transactional emails such as sign-in links and purchase receipts. You don’t need to give us any personal data to browse the site, but we need your email address to create your account and deliver what you buy — without it we can’t provide the product. Legal basis: performance of our contract with you; and, before any contract exists, our legitimate interest in responding to you.
  • Purchase information — when you buy, our payment processor Stripehandles your card details directly. We never see or store your full card number. We keep a record of the purchase itself (which product, the amount and currency, the Stripe references, the status, and the date). If you buy without already having an account, we create one for you automatically using the email address Stripe collected, so you can access what you’ve bought. Legal basis: performance of our contract with you, and our legal obligation to keep accounting records.
  • Usage analytics — we use Ahrefs Web Analytics, a privacy-focused, cookieless analytics tool, to understand aggregate traffic (pages viewed, the site you came from, approximate country). It does not set cookies, does not track you across other websites, and does not identify you personally. Legal basis: our legitimate interest in understanding and improving the site.
  • Technical data — our hosting provider (Vercel) and our security and content-delivery provider (Cloudflare) automatically process technical information such as your IP address and browser type in order to serve and protect the site. Legal basis: our legitimate interest in the security and reliable delivery of the site.

Cookies

We keep cookies to a strict minimum. We do not use advertising cookies or cross-site tracking, and our analytics is cookieless. The only cookies in use are strictly necessary ones set by the services that run the site:

  • Supabase authentication cookies — keep you signed in after you use a magic link.
  • Stripecookies — set only when you reach checkout, to take the payment you’ve asked us to process and to prevent fraud on that transaction.
  • Cloudflare security cookies (such as __cf_bm) — protect the site from bots and abuse.

Because these cookies are strictly necessary and our analytics uses none, UK law (the Privacy and Electronic Communications Regulations) does not require a cookie-consent banner, so we don’t show one. If that ever changes — for example if we add non-essential cookies — we’ll ask for your consent first.

Who we share data with

We do not sell your personal data. We share it only with the service providers that operate the site. Vercel, Cloudflare, Supabase and Ahrefs act as our processors under a data-processing agreement. Stripe acts as an independent controller for the payment and fraud-prevention data it handles, under its own privacy policy. The providers we use are:

When you email us, your message is routed and stored by our email provider so that we can receive and reply to it.

Sending data outside the UK

Some of these providers are based outside the UK, including in the United States. Where your data is transferred internationally, it is protected by appropriate safeguards — such as the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), or the provider’s certification under the UK extension to the EU–US Data Privacy Framework.

How long we keep it

  • Account data— while your account is active. If you ask us to delete your account, we remove your personal data, except anything we’re legally required to keep.
  • Purchase records — kept for six years to meet UK tax and accounting obligations.
  • Technical data— server and security logs (including IP addresses) held by our hosting and security providers (Vercel and Cloudflare) are kept only as long as needed to serve and secure the site, in line with those providers’ own log-retention policies, for security, abuse-prevention and troubleshooting, after which they are deleted or aggregated.
  • Analytics— aggregate and non-identifying, so it isn’t tied to you.

Your rights

Under UK GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to how we use it;
  • receive your data in a portable format.

To exercise any of these, email [email protected]. You also have the right to complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to help first.

Because our analytics and our technical and security processing rely on legitimate interests, you have a specific right to object to that processing at any time — email [email protected]and we’ll stop unless we have compelling legitimate grounds to continue.

We don’t make decisions about you by solely automated means, and we don’t profile you.

Children

Skill Locker isn’t intended for anyone under 16, and we don’t knowingly collect their personal data.

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows when it last changed, and we’ll flag any material changes on this page.

Contact

For any privacy question or request, email [email protected]. Our full trading details are on the contact and terms pages.