Privacy Policy

Microskills operates the online skills marketplace at microskills.io (the “Platform”), where learners book short lessons and tutor sessions and independent trainers publish lessons and answer tutor requests. Microskills (“we”, “us”, “our”) is the data controller for the personal data described in this policy. We are based in Kenya.

For any privacy question or request, contact us at support@microskills.io.

This policy applies to:

• visitors to our website;
• learners, including parents or guardians who arrange lessons for a child;
• trainers (instructors);
• prospective trainers we invite to join the Platform; and
• anyone who contacts us.

Trainers are independent. When a trainer receives your details to deliver a lesson, they must use them only for that purpose. Third-party services you use through the Platform, such as Stripe, PayPal, or a trainer’s chosen meeting tool, have their own privacy policies.

Depending on how you use the Platform, we collect the following categories of personal data:

• Account data: name, username, email address, password (stored only as a one-way hash), account role (learner or trainer), and security settings such as two-factor authentication method and recovery questions (answers are stored hashed).
• Profile data: profile photo, bio, skills and teaching experience, teaching proof and gallery media, and the city, region, and country you choose to show.
• Verification data: phone number, identity document images you upload for review, and location details (address and map coordinates) you choose to verify.
• Lessons and bookings: lessons you create, buy, book, or complete; availability, schedules, and session details; delivery confirmations; learning progress; certificates; favourites; and reviews and ratings.
• Tutor requests and proposals: the skill, level, format, timeline, budget, notes, and location preferences you enter, and any preferences about the trainer (for example gender or age). If a request is for a child, the child’s age and gender as entered by the parent or guardian.
• Messages and files: chats between learners, trainers, and our support team, and files and session resources shared through the Platform.
• Disputes and support: dispute reasons, statements, evidence, messages, and outcomes, and your communications with our support team.
• Payment and payout data: purchase amounts, fees, coin and wallet balances and transactions, refunds, and payment references from Stripe or PayPal. We do not receive or store full card numbers. For trainer payouts we store the payout details you provide, such as a PayPal email, bank name, account holder name, IBAN, SWIFT/BIC, routing or sort code, the last four digits of an account number, bank country and currency, or a Stripe account ID.
• Device and usage data: IP address; approximate location derived from it (country, region, and city); browser, device, screen size, and language; referring page and campaign (UTM) parameters; pages viewed and time on page; and on-page interactions such as scroll depth and click positions.
• Cookies and similar technologies: see section 6.
• Prospective trainers: if we invite you to teach, your name, professional contact details (such as an email address or LinkedIn profile URL), skills, and location, collected from public sources or referrals, and notes about our outreach.

We do not ask for special categories of personal data (such as health or religious information). Please do not include such data in your profile, requests, or messages unless it is needed for your lesson.

• From you, when you sign up, complete your profile, book or publish lessons, post requests, send messages, verify your details, request a payout, or contact us.
• From other users, for example when a trainer shares session details, a learner leaves a review, or either side submits dispute evidence about you.
• From payment providers (Stripe and PayPal), which confirm whether a payment or refund succeeded and give us transaction references.
• Automatically, from your browser or device through cookies, local storage, and server logs.
• From service providers, such as IP-location and map services that turn an IP address or address into an approximate location.
• From public sources and referrals, for prospective trainers.

We process personal data in line with Kenya’s Data Protection Act, 2019 and, where they apply to you, the EU General Data Protection Regulation (GDPR) and UK GDPR. For each purpose we rely on one or more legal bases:

• Creating and securing your account (sign-up, email verification, sign-in, two-factor authentication, password recovery). Basis: performance of our contract with you; legitimate interests in keeping accounts secure.
• Running the marketplace (listing and reviewing lessons, search and ranking, tutor requests and proposals, scheduling, messaging, delivering content, confirming delivery, and issuing certificates). Basis: contract.
• Payments, fees, coins, refunds, and trainer payouts. Basis: contract; legal obligations (accounting and tax).
• Service emails and in-app notifications about bookings, payments, disputes, and security. Basis: contract; legitimate interests.
• Support, disputes, and enforcing our Terms. Basis: contract; legitimate interests in resolving problems fairly and keeping the Platform safe.
• Safety, fraud prevention, and security (rate limiting, suspicious-activity checks, verification badges, investigating reports). Basis: legitimate interests; legal obligations.
• Analytics and improving the Platform with our own first-party analytics. Basis: legitimate interests; consent where the law requires it.
• Advertising measurement on Meta (Facebook and Instagram) and X, through their pixels. Basis: your consent, given by choosing “Accept all” in our cookie banner.
• Inviting prospective trainers to join. Basis: legitimate interests in growing the marketplace. You can ask us to stop at any time.
• Complying with the law, responding to lawful requests, and establishing or defending legal claims. Basis: legal obligations; legitimate interests.

Where we rely on legitimate interests, we balance them against your rights, and you can object (see section 11). Where we rely on consent, you can withdraw it at any time without affecting processing that already took place. We rank trainers and lessons in search using signals such as ratings, number of reviews, and lessons published. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

We use cookies and similar technologies such as your browser’s local storage. When you first visit, a banner at the bottom of the screen asks you to choose Accept all or Essential only. The advertising pixels below are loaded only if you choose Accept all; with Essential only, or until you choose, they are not loaded and nothing is sent to Meta or X.

• Essential: the microskills-session cookie keeps you signed in and protects your account, the ms_consent cookie (kept for 12 months, with a copy in local storage) remembers your cookie-banner choice, and other settings needed for checkout and security. The Platform cannot work without these.
• Preferences and recommendations: a cookie (skillup-viewed-categories, kept for 30 days) and local storage that remember recently viewed categories and lessons so we can suggest relevant skills.
• Analytics: a random visitor identifier in local storage (ms_va_vid) used by our own first-party analytics to count visits and understand how pages are used, including click and scroll heatmaps. It is not shared with advertisers and runs whichever banner option you choose. If your browser sends a “Do Not Track” signal, our analytics does not record your visit.
• Advertising (only if you choose Accept all): when enabled, the Meta Pixel (Meta Platforms) and the X pixel (X Corp.). They are not loaded on our admin pages. These tools set or read their own cookies and send events to Meta and X, such as page views and completed sign-ups (including whether you signed up as a learner or a trainer). Meta and X use this to measure and improve our ads and may combine it with other information they hold about you, under their own privacy policies.

How to opt out

• Change your choice at any time with Cookie settings (also in the site footer). Choosing Essential only stops the advertising pixels from loading from then on.
• Block or delete cookies and local storage in your browser settings, or use private browsing. Blocking essential cookies will stop you signing in.
• Turn on your browser’s tracking protection, or block third-party cookies, to stop the advertising pixels.
• Manage ad preferences in your Meta ad settings and X privacy settings. See Meta’s Privacy Policy and X’s Privacy Policy.
• Use industry opt-out tools such as Your Online Choices (EU/UK) or YourAdChoices.
• Turn on “Do Not Track” in your browser to stop our first-party analytics.
• Email support@microskills.io if you want to object to analytics or advertising processing.

We do not sell your personal information. We share it only as needed to run the Platform:

• Other users. Your public profile, lessons, and reviews are visible to everyone. When you book or teach, the learner and trainer see what they need to deliver the lesson, such as name, username, profile photo, messages, schedule, tutor-request details, and, for in-person sessions, the meeting location. Dispute statements and evidence are shared with the other party to the dispute.
• Payment providers. Stripe and PayPal process payments, refunds, and payouts as independent controllers under their own terms and privacy policies.
• Service providers acting on our instructions: website and database hosting, caching, email delivery through our SMTP email providers, map and geocoding services (Google Maps and OpenStreetMap Nominatim) for in-person locations, and IP-based location lookup (ip-api.com).
• Advertising partners. Meta and X, through the pixels described in section 6, when enabled and only if you choose Accept all in our cookie banner.
• Our team. Authorised staff can access account, booking, message, and dispute information where needed to provide support, review verification documents, resolve disputes, and keep the Platform safe.
• Legal and safety. Courts, regulators, law-enforcement agencies, professional advisers, or other parties where the law requires it, to enforce our Terms, or to protect the rights, property, and safety of users and the public.
• Business transfers. A buyer, successor, or investor if all or part of our business is sold, merged, or reorganised, who will be bound by this policy.

Learners and trainers use the Platform from many countries, and our service providers (including payment, hosting, email, map, and advertising providers) may process data outside Kenya and outside your country. When we transfer personal data abroad we do so in line with the Data Protection Act, 2019 and, where it applies, the GDPR, relying on appropriate safeguards such as the standard contractual clauses offered by our providers, or on another lawful transfer basis, such as the transfer being necessary to perform our contract with you (for example, sharing booking details with a trainer in another country).

We keep personal data only for as long as we need it for the purposes in this policy:

• Account and profile data: while your account is open. After you ask us to close your account, we delete or anonymise it within a reasonable period, except as below.
• Purchases, payments, payouts, and coin and wallet records: as long as needed for accounting, tax, and legal requirements.
• Disputes, reviews, and messages linked to transactions: as long as needed to resolve disputes, prevent fraud, and establish or defend legal claims.
• Analytics data (including IP addresses and visitor identifiers): for as long as needed to understand how the Platform is used and keep it secure; aggregated statistics that do not identify you may be kept longer.
• The recommendations cookie expires after 30 days, and the cookie-banner choice after 12 months (we then ask again); local storage stays until you clear it.
• Prospective-trainer contact details: until you ask us to stop contacting you, or when they are no longer needed for outreach.

We protect personal data with measures such as encrypted connections (HTTPS), passwords and recovery answers stored as one-way hashes, optional two-factor authentication by email code or authenticator app, role-based access controls, ownership checks on uploaded files, and rate limiting. No online service is completely secure, so please use a strong, unique password and turn on two-factor authentication. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities where the law requires.

Under Kenya’s Data Protection Act, 2019, and the GDPR or UK GDPR where they apply to you, you have the right to:

• Be informed about how your personal data is used (this policy).
• Access the personal data we hold about you and get a copy.
• Correct inaccurate or incomplete data. You can update most account and profile details yourself in your dashboard.
• Delete your data, or have false or misleading data deleted, where there is no overriding reason for us to keep it.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Restrict processing in certain circumstances.
• Data portability: receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller where technically feasible.
• Withdraw consent at any time where we rely on consent.
• Not be subject to decisions based solely on automated processing that significantly affect you.

To use any of these rights, including to close and delete your account, email support@microskills.io from the email address on your account. We may need to verify your identity, and we will respond within the time the law requires. Some data may be kept where the law requires or allows it, for example payment records.

Complaints

If you are unhappy with how we handle your data, please contact us first so we can try to fix it. You also have the right to complain to Kenya’s Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke, or, if you live in the EU, EEA, or UK, to your local data-protection authority (in the UK, the Information Commissioner’s Office at ico.org.uk).

Accounts are for adults aged 18 or over, and the Platform is not directed at children. A parent or guardian may post a tutor request for a child (aged 3 to 17) from their own account; in that case we process the limited information about the child that the parent or guardian provides (such as age and gender) to arrange the lesson, and the trainer who takes the request can see it.

Parents and guardians should share only what is needed. If you believe a child has created an account or given us personal data without a parent’s or guardian’s involvement, contact us at support@microskills.io and we will delete it.

We may update this policy as the Platform or the law changes. We will post the new version on this page with a new “Last updated” date and, for significant changes, notify signed-in users by email or in the app.

Questions or requests about privacy? Email support@microskills.io with “Privacy” in the subject line, or visit our Contact page. Microskills is based in Kenya. See also our Terms of Service.