Privacy
Last updated 2026-09-06. Covers provenskills.ai, app.provenskills.ai, mcp.provenskills.ai, and seller storefronts on *.provenskills.ai.
1. Who we are
ProvenSkills is operated by Lisby Holdings LLC (doing business as ProvenSkills) ("we", "us"), a California business. This policy says what we collect when you use ProvenSkills, why, who we share it with, and what you can do about it. It applies to sellers, to buyer organizations and their members, and to visitors of seller storefronts.
Contact: jake@adjustleads.com.
2. Our role
For buyer accounts, their connections, and their entitlements, we decide how the data is used. For a seller's subscriber list and buyer contact data, the seller decides and we act on the seller's instructions (in CCPA terms, we are the seller's service provider). The Seller Terms cover that relationship. Stripe collects payment data under its own privacy policy as the seller's payment processor. We never receive card numbers.
3. What we collect
Account data. Your email address and the one-time login codes we send to it. Sellers also give us a business name, a postal address for email footers, and a Stripe connected account id.
Organization data. The organization name, its members, and the values an org admin fills into per-organization variables so skills can refer to them (for example, a CRM pipeline id). Variables are stored as the admin entered them and served inside skill content to that organization only.
Connection data. When you connect an AI app, the app registers itself with our login service (OAuth). We store the registration (client name, redirect address), the tokens we issue, and when each token was last used.
Subscription data. From Stripe's webhooks we receive subscription and invoice status (active, past due, unpaid, or canceled), the Stripe customer id, the tier, and the amounts. We use them to decide whether your organization can use a pack.
Delivery logs. Each time an AI app fetches a skill, we record the organization, the member, the skill version, the time, and a hashed fingerprint of the client. We do not receive the conversation the skill was used in.
Audit logs. Actions taken by sellers, org admins, and our own staff in the dashboard (publish, promote, revoke, refund a fee, and the like), with who did it and when.
Terms acceptance. When you accept our terms or a seller's license, we record the version accepted, the timestamp, your IP address, and the accepting account.
Seller content. Sellers upload skill packs. Packs are the seller's content, and the Seller Terms forbid including personal data that is not the seller's to publish.
Website visits. Standard server logs from our hosting provider (IP address, browser type, pages requested, timestamps), kept for security and debugging. Seller storefront hosts set no cookies. app.provenskills.ai uses a session cookie needed for login.
4. What we never collect
- Your conversations with your AI app. The connector returns skill content when the app asks for it. It cannot read what you typed or what the model replied.
- Your credentials for Anthropic, OpenAI, Cursor, or any other AI vendor. Your own app calls our server, and you log in to ProvenSkills with an email code.
- Card numbers or bank details. Stripe holds those.
We do not run advertising, do not use tracking pixels, and do not place third-party analytics on storefronts. Nothing you give us is used to train AI models, and our subprocessors' terms say the same for the data we send them.
5. Why we use it
- Running the service: log you in, decide which packs your organization holds, deliver the current skill version, and keep the connection working.
- Billing, on the seller's behalf: match Stripe events to your organization and turn access on or off.
- Transactional email: login codes, receipts and renewal reminders, release notes for packs you subscribe to, and account notices. Marketing email from a seller goes only to admins who opted in at checkout, and every such email carries an unsubscribe link.
- Protecting the service and sellers' content: detect abuse, rate limit, investigate a leaked pack (the fingerprint and delivery log let us match a copy to the organization it was served to), and respond to takedown notices.
- Legal obligations, and enforcing our terms.
6. Who we share it with
Our subprocessors:
| Provider | What it does | Where | |---|---|---| | Vercel | Hosting and server logs | United States | | Supabase | Database, login, file storage | AWS us-west-1 (Northern California) | | Stripe | Payments and subscription status | United States | | Resend | Transactional email | United States | | GitHub | Release ingestion, only for sellers who connect a repository | United States |
Sellers. The seller whose pack your organization subscribes to can see your organization name, admin email, tier, subscription status, and start date, and can export that list. When we add per-skill usage counts, sellers will see those too, never conversation content.
Your AI vendor. The app you connect (claude.ai, Cursor, or another) receives the skill content and knows your app is connected to ProvenSkills. Its privacy policy governs what it does with that.
Legal. We disclose data when the law requires it, to enforce our terms, or to protect someone's safety. We will tell you when the law allows us to.
Business transfer. If ProvenSkills is sold or merges, data moves with it under this policy.
We do not sell personal information, have not sold any in the preceding 12 months, and do not share it for cross-context behavioral advertising.
7. How long we keep it
- Account and organization data: while the account is open, then 90 days after deletion, except where we must keep records longer.
- Delivery logs: 13 months, then deleted or aggregated.
- Audit logs: 3 years.
- Terms acceptance records: 3 years, or one year past the end of the subscription, whichever is later.
- Subscription and fee records: 7 years for tax and accounting.
- Server logs: up to 30 days.
- Email delivery logs at Resend: Resend's own retention period, which we do not extend.
8. Security
Encryption in transit and at rest, access controls with least privilege, MFA for seller accounts, and delivery through one audited code path. We notify affected sellers within 72 hours of confirming a security incident that affects their data, and affected individuals as California law requires [Cal. Civ. Code 1798.82]. No system is perfectly secure, and we do not promise otherwise.
9. Your choices and rights
- See, correct, or export. Org admins see and edit their organization's data on app.provenskills.ai. Email us for anything else.
- Delete. Email us. We delete what we can and tell you what we must keep (billing records, tax records, acceptance records, audit logs).
- Disconnect. An org admin can revoke any member's connection from the org page. Removing the connector in your AI app also stops it.
- Email. Unsubscribe link on marketing mail. Transactional mail continues while you have an account.
California residents (CCPA and CPRA). We may be below the law's thresholds today, and we honor these rights regardless: to know what personal information we collect and why (this policy), to delete, to correct, to opt out of sale or sharing (we do neither), to limit use of sensitive personal information (we collect none of the listed categories beyond login credentials), and not to be discriminated against for exercising them. Categories collected in the last 12 months: identifiers (email, IP address, organization name), commercial information (subscription records), internet activity (delivery and server logs), and professional information (business name and role). Submit requests by email to the address above. We verify a request by sending a code to the account email. An authorized agent may submit a request with your written permission.
Other states. Residents of other states with privacy laws (Colorado, Connecticut, Virginia, Texas, Oregon, Utah, among others) have similar rights. Use the same contact.
10. Members of a buyer organization
Our buyers are organizations. If you are a member, your admin invited you and can see your connection status and your use of skills. Questions about how your employer handles that data go to your admin.
11. Children
The service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children. Email us if you think we have.
12. Outside the United States
We sell to US buyers only in v1 and store data in the United States. If you use the service from outside the US, your data is processed here.
13. Changes
The version date is at the top. Material changes go out by email to account holders 30 days before they take effect, and the admin console prompts sellers and org admins to accept the new version.