Data protection notice

Privacy policy

Last updated: 9 September 2026

1. Controller

Fabian Faraz Farid, Friedrich-Ebert-Straße 65, 41236 Mönchengladbach, Germany. Contact: fabianfarid+skillsstack@live.de.

2. What SkillsStack processes

  • Technical request data such as IP address, time, browser information, requested URL, and security logs.
  • Your email, billing details, subscription status, and Stripe customer and subscription identifiers when you purchase or manage access.
  • The YouTube URL you submit, public video metadata, transcript text, and the generated Markdown returned to you.
  • A signed subscription cookie containing Stripe customer and subscription identifiers. It does not contain card details.

3. Purposes and legal bases

We process billing, subscription, submitted-video, and output data to provide the paid service and perform our contract with you (Article 6(1)(b) GDPR). We process records required for accounting, tax, and consumer-law compliance under Article 6(1)(c) GDPR. We use proportionate technical logs to secure and operate the service under Article 6(1)(f) GDPR.

4. Service providers and recipients

  • Vercel hosts the application and processes request and infrastructure data.
  • Stripe processes checkout, payments, invoices, customer records, and subscriptions. SkillsStack never receives complete card details.
  • YouTube/Google supplies public video metadata and available transcripts.
  • youtube-transcript.ai may be used as a transcript fallback when YouTube does not return an accessible transcript.
  • OpenAI receives the submitted video transcript and instructions to generate the requested Markdown or skill.

Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses.

5. Cookies and local storage

SkillsStack uses one strictly necessary cookie named skillsstack_subscription. During the rebrand, an existing legacy yt2md_subscription cookie may also be accepted. These cookies keep paid access connected to the browser, are inaccessible to client-side JavaScript, are sent only over secure connections in production, and expire after 30 days. We do not currently use advertising, analytics, or cross-site tracking cookies. The cookie is necessary to provide the expressly requested service within the meaning of § 25(2) no. 2 TDDDG.

6. Storage periods

SkillsStack does not maintain an application database of submitted URLs, transcripts, or generated files. They are processed to answer the request. Infrastructure providers may retain technical logs under their configured security and operational retention periods. Stripe retains billing and transaction records as required to provide payment services and meet legal obligations. The browser access cookie expires after 30 days unless removed earlier.

7. Your rights

Subject to the GDPR’s conditions, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may also complain to a competent data-protection supervisory authority. Contact us at fabianfarid+skillsstack@live.de to exercise your rights.

8. Required data and automated decisions

Payment and subscription data are required to enter into and perform the subscription. Without them, paid access cannot be provided. SkillsStack does not make decisions producing legal or similarly significant effects through automated profiling.

9. Changes

We update this notice when the service, providers, or legal requirements change. If analytics, advertising, or other non-essential browser storage is introduced, it will remain disabled until any legally required consent has been obtained. The current version is always available on this page.