Privacy Policy

This policy explains what personal data we collect when you use the Site, why we collect it, and what rights you have. It should be read alongside our Terms and Conditions, Acceptable Use Policy and Cookie Policy.

We are the data controller for the personal data described in this policy. We collect the minimum needed to run an account-gated directory. We do not use analytics cookies, we do not run advertising, we do not build profiles, we do not sell personal data, and we do not use your data or your uploaded content to train machine learning models.

We are not required to appoint a statutory Data Protection Officer. Privacy enquiries about eventskills.ai are handled by our legal contact above; you may also use the Intros.at group privacy address.

2.1 Account data

• Email address
• Password hash, created and stored by our authentication provider. We never see or store your plaintext password.
• Display name
• Timestamps and version records confirming that you accepted our Terms and this policy
• Authentication metadata such as email verification status, last sign-in time, and session tokens

2.2 Optional profile data

Bio, website URL and avatar. You choose whether to provide these, and they are public if you do.

2.3 Activity data

• Skills you upload, including the skill file, its metadata, description, version history and the licence you select
• Skills you download, including the version, the timestamp, and the record that you accepted the risk disclaimer
• Skills you star, so we can show accurate counts and stop double counting
• Reports you file about other users' skills, and any moderation correspondence
• Support or abuse-report messages you send us

2.4 Technical and security data

• Server logs, including IP address, user agent, request path and timestamp
• Rate-limit counters and abuse-prevention signals
• Bot-mitigation and DDoS-protection data generated by our hosting provider

2.5 What we do not collect

We do not collect payment data, the Directory is free. We do not collect special category data as defined in Article 9 UK GDPR, and you should not upload it. We do not receive or store any data that a skill processes on your machine or in your AI agent, see section 12.

We do not send marketing email from eventskills.ai and we will not add you to Grip marketing lists on the basis of an eventskills.ai account. If we ever introduce an optional newsletter it will be opt-in, separately consented, and unsubscribable at any time.

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interest in running a safe, functional directory does not override your rights. You can object at any time, see section 8.

Public to everyone, including search engines:

• Your display name, bio, website and avatar
• Every skill you publish, its metadata, description, version history, licence, star count and download count

Never shown publicly:

• Your email address
• Your download history
• Any report you file. We tell the author that a report was made, but not who made it.
• Your IP address and server logs

Anything you place inside a skill file, a description or a profile field becomes public the moment you publish it. Do not put personal data, credentials, API keys, attendee lists or client-confidential information into an uploaded skill. Once downloaded by others, published content cannot be recalled.

We do not sell personal data and we do not share it for advertising. We share it only with:

Processors acting on our instructions

Each processor is bound by a written data processing agreement requiring them to process data only on our instructions and to apply appropriate security measures.

Other recipients

• Law enforcement, regulators or courts where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims
• Professional advisers under duty of confidence
• An acquirer, in the event of a merger, acquisition or sale of assets. We will notify you before your data becomes subject to a different privacy policy.

Some of our processors operate outside the UK and EEA, including in the United States. Where personal data is transferred outside the UK or EEA we rely on one or more of:

• UK adequacy regulations or an EU adequacy decision for the destination country
• The UK International Data Transfer Addendum to the EU Standard Contractual Clauses
• The EU Standard Contractual Clauses

You can request a copy of the relevant safeguards by emailing legal@eventskills.ai.

Account deletion. Deleting your account starts a 14-day reversible grace period. During that period your profile and skills are unlisted. After 14 days, your profile and personal data are erased, your download history is anonymised, and your skills are permanently unlisted.

A note on copies already downloaded. Unlisting a skill removes it from the Directory. It does not and cannot retrieve copies that other users have already downloaded. We have no ability to delete files from a third party's computer.

Under UK GDPR and, where applicable, EU GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (the "right to be forgotten")
• Restrict processing in certain circumstances
• Port your data in a structured, machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent where we rely on it, without affecting prior processing
• Not be subject to solely automated decision-making with legal or similarly significant effects. We do not carry out any such decision-making.

Most of these you can exercise yourself from Settings, and deletion is self-service. For anything else, email legal@eventskills.ai. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension.

Complaints. If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or to the supervisory authority in your EU member state of residence.

We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, hashed passwords, row-level access controls, principle-of-least-privilege access for staff, rate limiting, bot mitigation, and file type and size validation on upload. Uploaded skills also pass through an automated static check for common red flags. That check is an anti-abuse hygiene measure, not a security review or a guarantee.

No system is completely secure and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required and notify you without undue delay where the risk is high.

Essential cookies only: session and authentication cookies, a CSRF token, a cookie recording your cookie preference, and security cookies set by Cloudflare for bot and DDoS mitigation. No analytics, no advertising, no cross-site tracking. We show a short cookie notice for transparency and to let you record a preference. Full detail is in our Cookie Policy.

The Directory is not intended for anyone under 18. We do not knowingly collect personal data from under-18s. If you believe a minor has created an account, email legal@eventskills.ai and we will delete it promptly.

This is the most important thing to understand about privacy on this Site.

eventskills.ai distributes files. When you download a skill and run it in your AI agent, coding tool, event platform or any other environment, that execution happens entirely under your control and outside our systems. We do not see, receive, host, process or log:

• any data the skill reads, writes, transmits or deletes
• any credentials, API keys or tokens the skill uses
• any attendee, exhibitor, delegate or customer data the skill touches
• any output the skill produces

If you run a skill against event data, you, not Intros.at Ltd, are the data controller for that processing. You are responsible for having a lawful basis, for your own privacy notices, for any data processing agreement with your event clients, for any international transfer that results, and for any breach that results. A skill you found here is not a processor we have vetted, contracted with or assessed on your behalf.

Skills are instructions executed by AI agents that may have access to your files, credentials and connected systems. A skill can be written, deliberately or by mistake, to exfiltrate data, delete records, send messages on your behalf, or take irreversible actions. Review any skill's contents before you run it, run it with the narrowest credentials that will work, test in a sandbox or non-production environment first, and never run a skill against live attendee data you have not first satisfied yourself is safe.

Intros.at Ltd also operates the Grip event platform. eventskills.ai is a separate service with its own account system. An eventskills.ai account is not a Grip account, and creating one gives us no access to any Grip data and gives you no rights under any Grip agreement. Skills in the Directory are not built, reviewed, tested, certified or endorsed by Grip, including any skill that mentions, integrates with or claims compatibility with Grip. If you are a Grip customer, your Grip contract and Grip's own privacy policy govern your Grip data, this policy does not.

We may update this policy. Material changes will be notified by email to registered users and reflected in the "last updated" date. Continued use after the effective date constitutes acceptance. Previous versions are available on request.

Questions, requests or complaints: legal@eventskills.ai

Intros.at Ltd, 2 Leman Street, London, United Kingdom, E1W 9US. Registered in England and Wales, company number 09343609.