eSkilled AI Course Creator

GDPR overview

GDPR compliance is claimed explicitly in the FAQ, and the privacy policy, last updated on 17 July 2025, devotes section 10 to residents and citizens of the EEA. eSkilled describes itself as "a 'data controller' of the Personal Information we collect and with respect to our student and learning management systems, a 'data processor' acting on authority of our customers". The rights listed are the standard set: portability, erasure, restriction, objection and withdrawal of consent, together with the right to lodge a complaint with the supervisory authority of your country of residence, place of work or of the alleged infringement. Two limits are worth noting: no EU representative under Article 27 is named, and no data processing agreement is published. As an Australian company, eSkilled applies the Australian Privacy Principles alongside the GDPR.

Who owns the data?

Ownership sits with the customer. The eSkilled AI policy states that clients "retain full ownership of all input data (e.g. prompts, submissions) and output data (e.g. AI-generated responses) they have created through use of eSkilled's AI services", and that "eSkilled does not claim ownership over any Client content". Material entered into the platforms is stored on behalf of customers, who remain the controllers of that content. For the learning and student management systems, eSkilled describes itself as a data processor acting on the authority of its customers, which restricts what it may do with the content to delivering the service the customer has asked for.

Reuse rights

Because inputs and outputs belong to the customer, generated courses can be edited, rebranded, exported and delivered to learners without asking eSkilled for permission, and the vendor claims no ownership over client content. On the vendor side, eSkilled states that it does not use client data to train AI models and does not take part in any provider data-sharing or model-training programme; generation runs through enterprise API access rather than a consumer chatbot account, and data from the enterprise API is not used to train the model. OpenAI may securely retain API inputs and outputs for up to 30 days to provide the service and identify abuse, after which they are deleted. Two nuances remain in the privacy policy: clause 4.1(f) mentions the training of learning models internal to the LMS and SMS, described as statistical correlations rather than raw data, and clause 4.3 allows de-identified data to be shared with partners.

Data retention & training

Hosting summary

eSkilled AI Course Creator is hosted on Amazon Web Services in Sydney, Australia, and the privacy policy states plainly that "Our systems are located in Australia". Australian jurisdiction therefore governs the core infrastructure, with offshore transfers framed by the Australian Privacy Principles. Two flows leave the country. AI processing may be handled temporarily by offshore systems depending on the provider used, which the AI policy says may include regions such as the United States or Europe. Administrative subcontracting also takes place in the Philippines and India, under clause 7.2 of the privacy policy. On the security side, eSkilled reports ISO 27001-2022 certification, encryption in transit and at rest, multi-factor authentication, access controls and password authentication, with annual third-party testing and monthly scans. Announced uptime is 99.9%. No hosting region other than Australia is specified for the core infrastructure.