Privacy and personal data

Who is the controller

SkillLens is a product of Lite AI Labs, established in Morocco.

Contact, for any question or request about your data: contact@liteailabs.com. We answer any request to exercise your rights within one month.

You may also lodge a complaint with your competent supervisory authority: the CNDP in Morocco, or the data protection authority of your country of residence if you are established in the European Union.

Who is responsible for what

The training organisation running the session decides what is asked and who is invited: they are the controller towards the attendees. Lite AI Labs acts as a processor on their behalf.

If you are an attendee and want to exercise your rights, you can do it from your own screen, without going through your coach.

What we collect

Coaches: email address, name, password (hashed, never readable), and the workspace the account belongs to.

Attendees: email address, display name, answers, self-declared confidence, files uploaded where a step asks for them, and end-of-session feedback where enabled.

When an account is created we also record the IP address and browser used. It is used only to spot one person opening free accounts in series, and for nothing else: no advertising, no profiling, no resale. It is deleted with the account.

We collect no special-category data within the meaning of GDPR Article 9, and set no advertising trackers.

Audience measurement

We count visits with our own tool, hosted by us. No third-party analytics, no session recording, no advertising pixel.

Two things are stored in your browser. A random identifier per tab, erased when the tab closes, whose only job is to avoid counting one visit twice. And, if you arrived through a campaign link, that campaign's labels (never the full address, never the content of a page) kept for 90 days and then erased automatically.

None of it identifies you, none of it is combined with anything, none of it follows you between sites, and none of it is passed to anybody. The day we set an advertising tracker, your consent would be asked for first, and this page would say so.

Your course material

Material you upload to have an assessment drafted is sent to an AI model provider for that generation, then deleted. We keep no copy: not to train a model, not for another client, not for you.

So the material is not stored by us, but it is transmitted to the model provider for the duration of the call. We would rather write that plainly than imply it never leaves our servers.

What the room sees

Nothing projected ever contains an identity: no name, no email, no ranking, no winner. The room sees distributions and overall trends.

That guarantee comes from the shape of the data sent to the projector, not from a checkbox someone could forget.

The client report

The report shared with a sponsor or an L&D team contains no personal data at all: no names, no emails, no individual rows. It is aggregate, by competency and by phase.

The share link is revocable and expires automatically after 30 days.

How long we keep it

Detailed results stay in the coach's workspace while the account is active, so before/after comparisons and the weeks-later follow-up remain possible.

When an attendee erases their data it disappears from the coach's screens immediately and is permanently purged after 30 days. That window exists only to allow an unlucky click to be undone.

Artificial intelligence

AI is used for three things: drafting an assessment from your material, analysing written answers and uploaded files, and producing the summaries. MCQ scoring, the projected distributions and the numeric reports are deterministic and use no model at all.

No automated decision producing legal effects is taken: the analyses are teaching feedback, reviewed by a coach.

Content sent to the model provider is not used to train its models under our terms for its API.

Your rights

Any attendee can, from their own screen and without asking permission: download everything we hold about them as an Excel file, or erase all of it.

You also have the rights of access, rectification, objection, restriction and portability under the GDPR. Write to the contact address at the top of this page.

Security

Passwords are hashed. Coach access uses an httpOnly cookie, sent over HTTPS only in production. Every workspace is isolated: an account sees only the data of the workspace it belongs to, which is verified by automated tests.

No system is infallible. In the event of a data breach presenting a risk, we will notify the competent authority and the people concerned within the deadlines set by the GDPR.

Hosting and transfers

The application is hosted with professional cloud infrastructure providers, and the database with a specialised managed provider. Artificial intelligence processing is carried out by a language model provider acting as our processor.

Online payments are processed by our reseller Paddle.com, the Merchant of Record for our orders: it collects the data needed for the payment (name, email address, country, payment method) under its own responsibility and its own privacy policy. We never receive your card number.

Some of these providers operate from countries outside the European Union, including the United States. Those transfers are covered by the European Commission's standard contractual clauses, alongside the technical safeguards described above: course material is not kept after generation, and no data is used to train a model.

The named, current list of our subprocessors and the corresponding hosting countries is provided on request at contact@liteailabs.com. It is also annexed to the data processing agreement (DPA) we sign with organisations that ask for one.

We inform you of any change of subprocessor liable to affect your data, and you may object to it under the terms of that agreement.