Privacy notice
Last updated 20 September 2026
In short: we keep your email address and a record of your purchase so we can let you into the course. We run no analytics, no ad pixels and no tracking cookies. Payment details never reach us — Paddle handles them.
1. Who is responsible
Skool42 is the data controller for the website and the course platform. Contact: support@skool42.com. Paddle.com, our Merchant of Record, is an independent controller for the payment itself — see Paddle's privacy policy.
2. What we collect and why
- When you buy: Paddle sends us your email address, the transaction id and your Paddle customer id. We use them to create your licence, link it to your email, and send the purchase email with your sign-in link. Legal basis: performing the contract with you.
- When you sign in: the email address you type. If it owns a licence we email it a single-use link, stored on our side only as a hash that is deleted on use or after it expires. We deliberately give the same response whether or not an address has bought, so the form cannot be used to find out who our customers are.
- While you are signed in: one cookie,
skool42_session, containing your email address and an expiry, cryptographically signed so it cannot be forged. It is HttpOnly, sent only to our site, and lasts up to 180 days or until you sign out. It is strictly necessary to keep you signed in, so no consent banner is needed and none is shown. - When you write to us: your email and whatever you tell us, kept for as long as needed to help you.
Payment card or PayPal details are collected by Paddle inside the checkout and are never sent to, stored by, or visible to us.
3. What stays in your browser
Your course progress and anything you type into the course's tools are saved in your browser's local storage on your device. They are not sent to our servers — which also means they don't follow you to another device or browser, and clearing site data removes them.
4. Who processes data for us
We use a small number of providers, each only for the purpose listed:
- Paddle (Paddle.com Market Ltd, UK / Paddle.com Inc., US) — checkout, payment, tax, receipts and refunds. Paddle's checkout script loads on the sales page and may set Paddle's own cookies when the checkout opens.
- Vercel (US) — hosting for the website and the course. Standard server logs (IP address, requested page, time) are kept briefly for security and debugging.
- Upstash (US) — the database that stores licence records and pending sign-in links.
- Resend (US) — delivers our emails: the purchase email and sign-in links.
Where these providers process data outside your country, they do so under standard contractual clauses or an equivalent lawful transfer mechanism. We do not sell personal data and we do not share it with anyone else, except if the law requires it.
5. How long we keep it
- Licence records (email, transaction id, customer id, dates) — for as long as the licence exists, so you can sign in years later. If a purchase is refunded we keep the record marked as revoked, because Paddle and tax rules require a purchase history.
- Sign-in links — until used, or 15 minutes (24 hours for the purchase link).
- The processed-webhook log — the ids of the Paddle events we have handled, kept so a repeated event cannot create a second licence.
- Support emails — until your question is resolved, then no longer than needed.
6. Your rights
Depending on where you live (including under the GDPR and UK GDPR) you can ask us for a copy of the data we hold about you, to correct it, to delete it, to restrict or object to its processing, or to receive it in a portable form. Email support@skool42.com from the address in question; we answer within 30 days and never charge for it. Deleting your email address also deletes your access to the course. You also have the right to complain to your local data-protection authority.
7. Security
The site is served over HTTPS only. Access to the course is checked against the licence store on every request, sign-in links are single-use and stored hashed, and the session cookie is signed with a secret that lives only on the server. No password means there is no password of yours for us to lose.
8. Children
The course is for people running or marketing a business and is not directed at children under 16. We do not knowingly collect data from them.
9. Changes
If this notice changes in a way that matters, we update the date at the top and, for significant changes, email existing customers.