Privacy
Last updated 2026-10-13. Covers provenskills.ai, app.provenskills.ai, mcp.provenskills.ai, and seller storefronts on *.provenskills.ai. What changed since 2026-10-10: each seller is now the merchant for their own sales, and payments go to the seller's Stripe account, so sections 2, 3 and 5 describe billing data that way.
1. Who we are
ProvenSkills is operated by Lisby Holdings LLC (doing business as ProvenSkills) ("we", "us"), a California business. This policy says what we collect when you use ProvenSkills, why, who we share it with, and what you can do about it. It applies to sellers, to buyer organizations and their members, and to visitors of seller storefronts.
Contact: support@provenskills.ai.
2. Our role
The seller is the merchant. When an organization subscribes to a pack, it buys from the seller, and the payment goes to the seller's own Stripe account. Stripe processes that payment under its own privacy policy, and the seller is responsible for the purchase and billing records on their account. We never receive card numbers.
We run the software the purchase goes through, so for buyer accounts, their connections and their entitlements we decide how the data is used. We also see the subscription and payment status Stripe reports from the seller's account, because we need it to turn access on and off and to collect our fee. The seller whose pack the organization subscribes to receives the organization's name, admin email, tier, status and start date to support their buyers, and the Seller Terms limit what the seller may do with it.
3. What we collect
Account data. Your email address and the one-time login codes we send to it. Sellers also give us a business name, a postal address for email footers, and the id of the Stripe account they sell through.
Organization data. The organization name, its members, and the values an org admin fills into per-organization variables so skills can refer to them (for example, a CRM pipeline id). Variables are stored as the admin entered them and served inside skill content to that organization only.
Connection data. When you connect an AI app, the app registers itself with our login service (OAuth). We store the registration (client name, redirect address), the tokens we issue, and when each token was last used.
Billing data. From the seller's Stripe account we receive subscription and invoice status (active, past due, unpaid, or canceled), the Stripe customer id on that account, the tier, the amounts, our fee, and any refund or dispute. We keep the event records Stripe sends us as they arrive, and those can carry the billing name and address given at checkout, any tax id entered, and a card summary (brand, last four digits, expiry). We use them to decide whether your organization can use a pack, to record our fee, and to show the seller their sales.
Delivery logs. Each time an AI app fetches a skill, we record the organization, the member, the skill, its version, the tool used, and the time. The text we serve carries a watermark unique to your organization, so a copy that leaks can be traced to the organization it was served to. We do not receive the conversation the skill was used in.
Audit logs. Actions taken by sellers, org admins, and our own staff in the dashboard (for example publish, promote, revoke or refund), with who did it and when.
Acceptance records. When a seller accepts the Seller Terms or this policy, we record the version, the time, the accepting account, its IP address and browser. A buyer organization's subscription records the version of the buyer terms in force and the time. A buyer's acceptance of a seller's license records the account, the organization, the version and the time.
Seller content. Sellers upload skill packs. Packs are the seller's content, and the Seller Terms forbid including personal data that is not the seller's to publish.
Website visits. Standard server logs from our hosting provider (IP address, browser type, pages requested, timestamps), kept for security and debugging. Seller storefront hosts set no cookies. app.provenskills.ai uses a session cookie needed for login.
4. What we never collect
- Your conversations with your AI app. The connector returns skill content when the app asks for it. It cannot read what you typed or what the model replied.
- Your credentials for Anthropic, OpenAI, Cursor, or any other AI vendor. Your own app calls our server, and you log in to ProvenSkills with an email code.
- Card numbers or bank details. Stripe holds those.
We do not run advertising, do not use tracking pixels, and do not place third-party analytics on storefronts. Nothing you give us is used to train AI models, and our subprocessors' terms say the same for the data we send them.
5. Why we use it
- Running the service: log you in, decide which packs your organization holds, deliver the current skill version, and keep the connection working.
- Billing: set up the checkout and subscription on the seller's Stripe account, turn access on or off as Stripe reports payment, and record our fee. The seller collects and remits sales tax and handles refunds and disputes on their account.
- Email: login codes from us. Receipts and invoices come from the seller's Stripe account where the seller has switched them on. We do not send marketing email, and no seller can email you through us.
- Protecting the service and sellers' content: detect abuse, rate limit, investigate a leaked pack (the fingerprint and delivery log let us match a copy to the organization it was served to), and respond to takedown notices.
- Legal obligations, and enforcing our terms.
6. Who we share it with
Our subprocessors:
| Provider | What it does | Where | |---|---|---| | Vercel | Hosting and server logs | United States | | Supabase | Database, login, file storage | AWS us-west-1 (Northern California) | | Stripe | Payments on the seller's account, sales tax, subscription status, our fee | United States | | Resend | Transactional email | United States | | GitHub | Release ingestion, only for sellers who connect a repository | United States |
Sellers. The seller whose pack your organization subscribes to can see your organization name, admin email, tier, subscription status, and start date, and can export that list. Usage is visible to them too: how often their pack is used, and which organization and member fetched which skill and when. Never conversation content.
Your AI vendor. The app you connect (claude.ai, Cursor, or another) receives the skill content and knows your app is connected to ProvenSkills. Its privacy policy governs what it does with that.
Legal. We disclose data when the law requires it, to enforce our terms, or to protect someone's safety. We will tell you when the law allows us to.
Business transfer. If ProvenSkills is sold or merges, data moves with it under this policy.
We do not sell personal information, have not sold any in the preceding 12 months, and do not share it for cross-context behavioral advertising.
7. How long we keep it
- Account and organization data: while the account is open, then 90 days after deletion, except where we must keep records longer.
- Delivery logs: 13 months, then deleted or aggregated.
- Audit logs: 3 years.
- Terms acceptance records: 3 years, or one year past the end of the subscription, whichever is later.
- Billing and fee records, including the Stripe event records above: 7 years for tax and accounting.
- Server logs: up to 30 days.
- Email delivery logs at Resend: Resend's own retention period, which we do not extend.
8. Security
Encryption in transit and at rest, access controls with least privilege, MFA available for seller accounts, and delivery through one audited code path. We notify affected sellers within 72 hours of confirming a security incident that affects their data, and affected individuals as California law requires [Cal. Civ. Code 1798.82]. No system is perfectly secure, and we do not promise otherwise.
9. Your choices and rights
- See, correct, or export. Org admins see and edit their organization's data on app.provenskills.ai. Email us for anything else.
- Delete. Email us. We delete what we can and tell you what we must keep (billing records, tax records, acceptance records, audit logs).
- Disconnect. You can revoke your own connected apps from the org page. Removing the connector in your AI app also stops it.
- Email. Transactional mail continues while you have an account.
California residents (CCPA and CPRA). We may be below the law's thresholds today, and we honor these rights regardless: to know what personal information we collect and why (this policy), to delete, to correct, to opt out of sale or sharing (we do neither), to limit use of sensitive personal information (we collect none of the listed categories beyond login credentials), and not to be discriminated against for exercising them. Categories collected in the last 12 months: identifiers (email, IP address, organization name), customer records (billing name and address), commercial information (subscription and billing records), internet activity (delivery and server logs), and professional information (business name and role). Submit requests by email to the address above. We verify a request by sending a code to the account email. An authorized agent may submit a request with your written permission.
Other states. Residents of other states with privacy laws (Colorado, Connecticut, Virginia, Texas, Oregon, Utah, among others) have similar rights. Use the same contact.
10. Members of a buyer organization
Our buyers are organizations. If you are a member, your admin invited you, and the admin and the other members of your organization can see your connection status and your use of skills. Questions about how your employer handles that data go to your admin.
11. Children
The service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children. Email us if you think we have.
12. Outside the United States
We sell to US buyers only in v1 and store data in the United States. If you use the service from outside the US, your data is processed here.
13. Changes
The version date is at the top. We may update this policy. Each new version is posted here with its date, and by continuing to use ProvenSkills after it is posted you accept it. We ask sellers to confirm the new version at their next sign-in.