Cookie Policy
Effective: 24 July 2026 · Version 2.3.0 Supersedes: Cookie Policy v2.2.0 dated 14 July 2026
This Cookie Policy explains what cookies are, which cookies the Skilly platform sets, and what choices you have. It is published by Skillscan Limited (trading as Skilly) and forms part of our Privacy Policy.
In one sentence: inside the signed-in platform we set only strictly-necessary cookies and run no analytics of any kind. On our public marketing pages we use Google Analytics to understand how visitors and campaigns find us, Contentsquare session analytics to understand how those pages are used, and HubSpot to see how prospective schools find us and follow up on enquiries — but only after you accept them on our cookie banner; if you decline, none ever load. We run no advertising or behavioural-tracking cookies anywhere.
1. Who we are
| Field | |
|---|---|
| Legal entity | Skillscan Limited |
| Trading name | Skilly |
| Company registration (CRO) | 565995 |
| Registered office | 5 Kinross, Fey Yerra Lane, Leopardstown Road, Foxrock, Dublin 18, Ireland |
| Data protection contact | legal@skillysolutions.com |
2. What is a cookie?
A cookie is a small text file placed on your device by a website you visit. Most modern web applications use cookies to keep you signed in, to protect forms from cross-site request forgery, and to remember preferences. Cookies are sent back to the website that set them on each subsequent request.
Cookies are governed in Ireland and the EU by the ePrivacy Regulations 2011 (which implement Directive 2002/58/EC) and, where the cookie also processes personal data, by the General Data Protection Regulation 2016/679.
The ePrivacy framework distinguishes between:
- Strictly necessary cookies — required to deliver a service the user has explicitly requested. These do not require consent.
- Non-essential cookies — including analytics, advertising, social-media plugins, and behavioural tracking. These require informed prior consent before being set.
3. The cookies we currently set
On the signed-in platform we set only the three strictly-necessary cookies below — never analytics. On the public marketing pages we additionally set Google Analytics, Contentsquare and HubSpot cookies, but only if you accept them on the cookie banner; decline, and they are never set.
| Cookie | Purpose | Lifetime | Type | Consent required? |
|---|---|---|---|---|
skilly-session | Authenticated user session — only set after you sign in. HttpOnly, Secure, SameSite=Strict. Without this cookie you cannot stay signed in between pages. | Per role: 8 hours for admins, 24 hours for coordinators, 3 days for teachers and pupils | First-party · session token | No (strictly necessary) |
skilly-csrf | Cross-site request forgery protection token, used to verify form submissions originate from the platform itself. Without this, any state-changing action would be vulnerable to CSRF attacks. | Session (deleted when you close your browser) | First-party · security token | No (strictly necessary) |
skilly-consent | Records your accept / decline response to the cookie banner on our marketing pages so we do not ask again. Set the moment you choose on the banner. | 1 year | First-party · preference | No (strictly necessary) |
On the public marketing pages only — and only after you accept on the cookie banner — we additionally set Google Analytics 4, Contentsquare and HubSpot cookies:
| Cookie | Purpose | Lifetime | Type | Consent required? |
|---|---|---|---|---|
_ga, _ga_<id> | Google Analytics 4 — tells how many people visit our public pages and which sources / campaigns bring them, using an anonymous visitor id. Set only on marketing pages and only with your consent; never on the signed-in platform where pupils are. | up to 2 years | Third-party (Google) · analytics | Yes — set only with your consent |
_cs_id | Contentsquare (which also owns Hotjar) — session analytics that shows us, in aggregate and per anonymous session, how visitors use our public marketing pages so we can improve them. This cookie holds the anonymous visitor id. Set only on marketing pages and only with your consent; never on the signed-in platform where pupils are. | 13 months | Third-party (Contentsquare) · analytics | Yes — set only with your consent |
_cs_s | Contentsquare — tracks the current page-view session (number of pages seen this visit). | 30 minutes | Third-party (Contentsquare) · analytics | Yes — set only with your consent |
_cs_c | Contentsquare — stores whether the tool is permitted to run for this visitor. | 13 months | Third-party (Contentsquare) · analytics | Yes — set only with your consent |
__hstc | HubSpot — main tracking cookie, records when a visitor first and last came to our marketing pages and how many times, tied to an anonymous visitor id, so we can see how prospective schools find us. Set only on marketing pages and only with your consent; never on the signed-in platform where pupils are. | 6 months | Third-party (HubSpot) · analytics / CRM | Yes — set only with your consent |
hubspotutk | HubSpot — stores the anonymous visitor id used to de-duplicate contacts and link an enquiry form to the visitor's page views. | 6 months | Third-party (HubSpot) · analytics / CRM | Yes — set only with your consent |
__hssc | HubSpot — tracks the current visit session (pages seen this visit). | 30 minutes | Third-party (HubSpot) · analytics / CRM | Yes — set only with your consent |
__hssrc | HubSpot — records whether the visitor restarted their browser, used to count sessions correctly. | Session | Third-party (HubSpot) · analytics / CRM | Yes — set only with your consent |
We set no other cookies anywhere on the platform.
4. What we do NOT use
Aside from the cookieless Vercel Web Analytics and the consent-gated Google Analytics, Contentsquare and HubSpot on our marketing pages (Sections 3 and 6), we do not set any of the following on either skilly.ie or app.skilly.ie:
- Analytics on the signed-in platform — none, ever. The only analytics we run is on our public marketing pages: cookieless Vercel Web Analytics, plus Google Analytics 4, Contentsquare and HubSpot that load only after you accept on the cookie banner. We use no Plausible (cookie-mode), no Fathom, no Mixpanel, no FullStory, and no analytics of any kind on the signed-in platform.
- Advertising / retargeting pixels — no Google Ads, no Meta / Facebook Pixel, no LinkedIn Insight Tag, no TikTok Pixel.
- Social media widgets — no Facebook Like buttons, no embedded Twitter timelines, no YouTube auto-embeds with cookies (we use privacy-enhanced embed mode where video is shown).
- Session-replay on the signed-in platform — none, ever. Contentsquare session analytics runs only on our public marketing pages, only with your consent, and records nothing where anyone is signed in — no pupil, teacher, or admin screen is ever recorded.
- Third-party fonts — fonts are self-hosted; no Google Fonts cookie.
- Third-party CDNs setting cookies — beyond the two consent-gated analytics tools above, we do not embed any third-party scripts that set cookies.
If you inspect cookies while using the signed-in platform you should see only the three strictly-necessary cookies above and no others. On our public marketing pages, if you have accepted on the cookie banner, you will additionally see the Google Analytics cookies (_ga, _ga_<id>), the Contentsquare cookies (_cs_id, _cs_s, _cs_c) and the HubSpot cookies (__hstc, hubspotutk, __hssc, __hssrc). If you ever see a cookie not on this list, that is a defect — please tell us at legal@skillysolutions.com.
5. Other browser storage
Some web applications use technologies similar to cookies — local storage, session storage, IndexedDB. The Skilly platform uses session storage sparingly to cache role-specific UI state (for example, your preferred filter on a page) for the duration of a single tab session. Nothing in session storage is shared with any third party, persists between browser sessions, or carries personal identifiers. It is cleared when you close the tab.
6. Marketing-site analytics, and product analytics in future
We draw a hard line between two different things:
- Marketing-site traffic analytics — understanding how many people visit our public marketing pages and which pages they read. This is provided by Vercel Web Analytics, which is cookieless and aggregate-only: it sets no cookies, stores no personal data, does no cross-site tracking or fingerprinting, and never identifies an individual visitor. Because nothing is stored on or read from your device, it falls outside the consent requirement of the ePrivacy Regulations. We also run Google Analytics 4 on these marketing pages to attribute visits to the sources and campaigns that bring people to us, Contentsquare session analytics to see how visitors actually use the pages (where they scroll, what they click) so we can improve them, and HubSpot — our marketing CRM — to see how prospective schools find us and to follow up on enquiries made through our forms. Unlike Vercel, all three set cookies — so each loads only after you accept on the cookie banner (decline and none ever loads), and never on the signed-in platform. All of these run only on our public marketing pages.
- Product analytics on the signed-in platform — understanding feature usage inside the app. We have made a deliberate choice not to ship third-party analytics here, and we run none today.
When the time comes to understand in-app product usage in more depth (for example, which features teachers use most often, where coordinators get stuck), the route we will take is self-hosted, privacy-first analytics — not a third-party tracker on pupil-facing screens. Concretely:
- A self-hosted instance of a privacy-respecting analytics tool such as Umami or PostHog Community Edition, deployed on our own infrastructure inside the EU
- Configured to not set cookies (these tools support an anonymous-visitor mode using hashed identifiers, with no tracking across sessions)
- Configured to not collect personal data — no IP address retention beyond what is needed for spam filtering, no cross-site tracking, no fingerprinting
- Aggregate metrics only, never individual user behaviour
Properly configured along these lines, the resulting analytics typically falls outside the consent requirement of the ePrivacy Regulations, because nothing is being stored on or accessed from your device.
If we ever introduce anything that does require consent (a non-essential cookie, a third-party tracker, anything fingerprintable), we will:
- Display a clear consent banner before any non-essential storage is accessed
- Default to reject — non-essential cookies are off until you opt in
- Update this Cookie Policy with the new tool, the new cookie, the lawful basis, and the retention period
- Notify the school admin by email for material changes
We will not roll out tracking technology silently behind a "by continuing to use this site you agree" notice. That model does not meet the GDPR consent standard and we will not use it.
7. How to control cookies in your browser
Even though our own first-party cookies are strictly necessary and do not collect personal data, you remain in full control. You can:
- Block all cookies — your browser will let you do this in its privacy settings. The platform will not work because you cannot stay signed in. We mention this for completeness; we do not recommend it for the Skilly platform itself.
- Clear cookies — your browser will sign you out of the platform immediately. Useful on a shared school device.
- Use private / incognito mode — cookies live only for the duration of the private window and are deleted when you close it.
Browser-specific instructions:
8. Children's privacy
The Skilly platform is used by pupils aged 12 to 18. We have deliberately limited the cookie footprint to the absolute minimum necessary so that pupils — including those below the Digital Age of Consent (16 in Ireland; 13 in the UK; varies elsewhere in the EU) — are not subject to any tracking or profiling on the platform.
For more on how we protect pupils' data generally, see Section 9 of our Privacy Policy.
9. Where this fits
This Cookie Policy sits inside our broader data-protection commitments:
- Privacy Policy — what personal data we hold, why, and your rights
- Sub-processors — the third parties we engage to deliver the platform
- Terms of Service — the contract under which schools subscribe
10. Changes to this policy
When we make a material change — adding a new cookie, introducing analytics, changing a retention period — we will:
- Publish the updated policy at skilly.ie/cookies
- Update the version-history table below with the date and a description
- Surface a notice on the next sign-in for affected users where the change directly affects them (for example, the appearance of a consent banner)
Non-material changes (typographical fixes, link updates) are published with a bumped version number but without notification.
11. Contact
For questions about this Cookie Policy or about how we handle data more generally:
📧 legal@skillysolutions.com 📞 +353 87 418 8829 📮 Data Protection · Skillscan Limited · 5 Kinross, Fey Yerra Lane, Leopardstown Road, Foxrock, Dublin 18, Ireland
You also retain the right to lodge a complaint with the Data Protection Commission (Ireland) at www.dataprotection.ie or with the Information Commissioner's Office (UK) at ico.org.uk.
Version history
| Version | Date | Summary |
|---|---|---|
| 2.3.0 | 24 July 2026 | Disclosed HubSpot marketing CRM + website tracking on the public marketing pages, loaded only after consent on the cookie banner (the same gate as Google Analytics and Contentsquare) — adds the __hstc, hubspotutk, __hssc and __hssrc cookies to Section 3 and updates Sections 4 and 6. Never on the signed-in platform. |
| 2.2.0 | 14 July 2026 | Disclosed Contentsquare session analytics on the public marketing pages, now loaded only after consent on the cookie banner (the same gate as Google Analytics) — adds the _cs_id, _cs_s and _cs_c cookies to Section 3 and updates Sections 4 and 6. Never on the signed-in platform. |
| 2.1.0 | 9 June 2026 | Added consent-gated Google Analytics 4 on the public marketing pages only — the _ga / _ga_<id> cookies, set only after you accept on the new cookie banner. Added the skilly-consent preference cookie. Never on the signed-in platform. |
| 2.0.1 | 7 June 2026 | Enabled Vercel Web Analytics on the public marketing pages only — cookieless, aggregate-only, no personal data, no consent banner, never on the signed-in platform. Updated Sections 4 and 6 accordingly. No new cookies; the cookie tables are unchanged. |
| 2.0.0 | 22 April 2026 | First standalone Cookie Policy. Replaces the cookie language that was embedded in the 1 October 2019 Privacy Policy. Documents the three currently-set cookies, confirms the no-tracking baseline, and commits to a self-hosted privacy-first analytics path if and when the time comes. |
| 1.0.0 (in Privacy Policy) | 1 October 2019 | Original cookie language (within Privacy Policy) — superseded. |