Privacy Policy

1. Introduction

Ventures in the Meadows ("we," "our," or "us") operates SkillsDecoder, a set of AI-assisted tools for workforce development staff: the application package (resume, cover letter and interview preparation), Business Brief, Fly on the Wall, Case Notes, Success Stories and Career Pathways.

This Privacy Policy explains what information SkillsDecoder handles, where it goes, what is kept and for how long. SkillsDecoder is used by the staff of organizations that serve participants. It is not used by participants directly, except for the public Career Pathways page, which asks for no name.

2. What Information We Handle

Participant information that staff enter:

• Name and contact information (email, phone, city and state)
• Work history, education, skills, certifications and volunteer experience
• Justice involvement and other background a staff member chooses to include (sensitive information)
• The job being applied for and the text of the job posting
• Messages, case note details and success story text typed, pasted, dictated or uploaded into a tool

Case Notes and Success Stories are designed to work without a participant's name. Both check what is about to be sent for names, phone numbers, email addresses and Social Security number patterns, and the server removes email addresses, phone numbers and Social Security number patterns again before any text goes to the AI provider.

Organization information:

• Organization name, primary contact name, email and phone
• The organization key used to sign in, with its status and trial dates
• Program descriptions and program contacts an organization saves under Our Programs
• Case Notes settings an organization saves
• Billing records (invoice identifiers, amounts and dates)

Usage information:

• For each document generated: the organization key, the type of document, the time, and counts such as the number of AI tokens used
• For the application package only: a keyed, one-way hash of the participant's name, used to count repeat use. The name itself is not stored.
• For a Business Brief: the name of the employer researched
• A record that an organization accepted the Terms of Service, with the version, the time and the browser type

3. How We Use Information

• To produce the document, note, story or research a staff member asks for
• To check that an organization key is valid and to limit misuse
• To count usage for billing, support and capacity planning
• To keep the service working and secure

We do not sell information, use it for advertising, or use participant information to train AI models.

4. What Is Stored and What Is Not

SkillsDecoder does not keep a database of participant information.

Not stored by SkillsDecoder:

• The participant details staff enter, and the documents, notes and stories produced from them. They are processed to answer the request and returned to the browser.
• Uploaded intake forms. The file is read on our server and deleted as soon as it has been read.
• Success story files (PDF or Word). They are read inside the browser and are never uploaded; only the text the staff member chooses to send leaves the device.
• Audio. See Dictation below.

Stored on our systems:

• The organization and usage information listed in section 2
• Server logs, which hold counts and labels and no participant text. Our hosting provider's request logs may include IP addresses.

Stored in your browser:

• Saved profiles. When a staff member saves a participant profile, it is kept in that browser on that computer only, so the participant can be picked up again later. It is not sent to us for storage.
• Shared computer mode. On a computer more than one person uses, tick "This is a shared or public computer" at sign-in or turn on Shared computer mode in Settings. Saved profiles and the sign-in are then removed at sign-out and when the browser is closed. On a staff member's own work computer the mode can be left off, and saved profiles stay until they are deleted.
• Organization display settings (name, logo, color) and the organization key while signed in.

Saved profiles can be deleted at any time from the Saved profiles page, with "Clear All Saved Profiles" in Settings, or by clearing the browser's site data.

5. Service Providers That Receive Information

We use the providers below to run SkillsDecoder. Each receives only what its part of the service needs.

Anthropic (AI provider):

• Receives the participant information and text a staff member submits to a tool, in order to generate the result. For a Business Brief it receives the employer's name and runs web searches about that employer.
• Under Anthropic's commercial terms, information sent through its API is not used to train its models.
• Anthropic states that it deletes API inputs and outputs within 30 days, except where a longer period is required to enforce its usage policies or comply with law. See Anthropic's data retention page and its privacy policy.

Hosting and data storage:

• Railway hosts the application. Requests pass through its servers and it holds the server logs.
• Supabase stores the organization and usage information listed in section 2.
• Netlify hosts our internal administration site.

Labor market data (Career Pathways):

• O*NET Web Services, CareerOneStop (both sponsored by the U.S. Department of Labor) and the U.S. Census Bureau receive interest scores or a Holland code, a ZIP code or location, and occupation codes. No name or contact information is sent.

Billing:

• Stripe processes subscription payments from organizations. It receives no participant information.

Dictation:

• The Record button in Case Notes and Success Stories uses the speech recognition built into your browser. The browser sends the audio to its maker's speech service (Microsoft for Edge, Google for Chrome) to turn it into text. SkillsDecoder never receives or stores the audio; it receives only the resulting text when the staff member submits it. Staff who prefer that no audio leave the device can type or paste instead.

We do not sell participant information, share it with marketing companies, or use it for advertising. We may disclose information if required by law.

6. Security Measures

• Encryption in transit: all connections to SkillsDecoder and from SkillsDecoder to its providers use HTTPS (TLS).
• Access control: every tool that uses the AI provider checks the organization's key on our server. Keys can be suspended or set to expire.
• Data minimization: participant content is not stored on our systems, logs carry no participant text, and likely identifiers are removed from case notes and stories before they are sent.
• Rate limits on sign-in, uploads, downloads and AI requests.
• Browser protections: a Content Security Policy and related headers; all scripts, fonts and styles are served from our own site.
• Restricted administration: organization records can be read or changed only by named administrators.

No system is perfectly secure. If we learn of a security incident that affects an organization's information, we will notify that organization's primary contact without undue delay.

7. Retention

• Participant content: not retained by SkillsDecoder. See section 5 for the AI provider's retention.
• Usage and billing records: kept while an organization is a customer and for as long afterward as needed for accounting and legal purposes.
• Organization records: kept while an organization is a customer. An organization can ask us to delete its records when it leaves.
• Saved profiles in a browser: kept until deleted by the staff member, or removed automatically in Shared computer mode.

8. Your Choices and Rights

Access and deletion:

Because we do not store participant content, we hold no participant record to provide or delete. Organizations can ask what organization and usage information we hold about them, and ask us to correct or delete it, by writing to the address below.

Accuracy:

Staff are responsible for the accuracy of the information they enter and for reviewing everything SkillsDecoder produces before it is used.

Browser data:

Saved profiles and settings in a browser can be removed at any time as described in section 4.

9. Participant Consent

IMPORTANT: Organizations using SkillsDecoder are responsible for obtaining appropriate consent from participants before entering their personal information.

We recommend organizations:

• Tell participants that their information will be processed by an AI service to prepare documents
• Obtain written or documented consent, and a signed release before any success story is used publicly
• Leave names and other identifiers out of case note and success story text wherever the tool does not need them
• Give participants copies of the documents prepared for them

10. Youth

SkillsDecoder accounts are for adult staff of organizations. Where an organization serves participants under 18, the organization is responsible for obtaining any consent the law requires, including from a parent or guardian, before entering a young person's information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Effective Date." If a change materially affects how participant information is handled, we will notify each organization's primary contact.

12. Contact Us

For questions about this Privacy Policy or data handling practices, please contact:

Ventures in the Meadows
Email: info@skillsdecoder.com

13. Compliance

SkillsDecoder is designed to minimize data retention and protect sensitive information. Organizations using SkillsDecoder remain responsible for their own compliance with:

• State and federal privacy laws
• Industry-specific regulations
• Organizational policies, including any policy on the use of AI
• Grant or funding requirements