Minimal data.
Clear application path.
The public /start route includes the first-party application form; direct contact channels remain available.
What the form collects
The form may transmit the name of the adult applicant or adult arranging the learning, contact details, selected audience, learning goal, page locale and application source path. The service also creates a technical request ID and timestamp.
Where the application goes
The browser submits to same-origin /api/lead. Vercel proxies that path to the isolated AI Skill Lab ingress; the ingress checks Origin and input, signs the request and forwards it to the operator-configured HTTPS webhook. After confirmed storage, the service may send the operator a technical Telegram notification containing only the request ID, application time, selected audience and page locale. The applicant name, contact, learning goal, program and source path are not included in that notification. The signing secret is not stored in the public site.
Operator and retention
Operator: Dumanyan Robert. Jurisdiction: Thailand. Privacy contact: robert@aiskillab.work. Configured lead retention is 30 days.
AI routing and OpenRouter
If AI routing is enabled, it runs only after the user presses a button. /api/route receives either the selected audience, three matcher answers and the goal text, or the prompt text from Prompt Auditor. Before any model call, the server checks the input for secret and credential patterns; detected secrets are blocked before the model is called. For AI routing or Prompt Auditor, the server may send this data to the configured free model through the OpenRouter API. AI Skill Lab code does not write the goal text, matcher answers or Prompt Auditor text into its route-limit table.
AI-route abuse prevention
For exact rate limiting, the ingress receives the client network IP from the hosting platform and immediately converts it to an HMAC token. The raw IP is not written to AI Skill Lab's route-limit table. That table stores only a request ID, HMAC token and technical timestamp. Scheduled cleanup deletes rate-limit rows once they are older than 24 hours. The token is used only for rate limiting and AI-route protection, not for advertising profiling.
Direct channels
Telegram, email, WhatsApp and LINE remain alternative contact routes. After leaving this website, further data handling is governed by the external service and the information the user chooses to send.
Minors
We do not ask children to submit contact details independently. Youth applications and organizational communication use an adult contact only; parent/teen scenarios require adult confirmation in the form.
The site uses a first-party counter for application and contact-channel events without personal data or cookies: only the event type, page, locale and daily count are stored; names, contact details and form text are not sent to that counter.