Privacy policy

What data Spilno LMS processes, why, who else has access to it, and your rights under the GDPR.

Updated: October 21, 2026

In short

• Spilno LMS is a service for training employees. Data about the people in your organization belongs to your organization: we process it only to make the service work.
• We don't sell data, show ads, or use trackers, cookies or third-party analytics on the website or in the app.
• Data is stored in the EU (Germany, Finland).
• AI quiz generation sends the Claude model (Anthropic) only the learning material you chose; the system doesn't add people's profile data (names, emails, results) to the request. Anthropic doesn't use this data to train its models. An organization can switch AI off.

Who we are

Operator of the Spilno LMS service: [TO FILL: full legal name, registration number, registered address, country].

Questions about data and requests about your rights: privacy@spilnolms.com. General questions: hello@spilnolms.com. Security vulnerabilities: security@spilnolms.com.

Two roles: processor and controller

• Data a customer organization puts into Spilno LMS (people, their job titles and departments, assignments, learning results, learning materials): the controller is your organization, and we are the processor under Article 28 GDPR. We process this data only on the organization's instructions, as set out in the data processing agreement in the Terms of use.
• Data of admins who sign up an organization and people we correspond with, and website visitors' data: we are the controller.

If you are an employee of an organization that trains you in Spilno LMS, the best place for requests about your data is that organization. We'll help it respond.

What data we process

• Account: name, email, role, interface language and theme, last sign-in time. Passwords are stored only as an irreversible hash (bcrypt). If the organization turned on Google or Microsoft sign-in, we receive a confirmed email and name from them.
• Work details the organization adds: department, job title, manager, start date, groups.
• Learning: assigned courses and learning paths, deadlines, progress, ticks in lesson checklists, quiz answers and scores, SCORM course data (status, score, time), certificates, notifications and reminder emails.
• Learning materials: lesson texts, quizzes, uploaded files and SCORM packages. They may contain personal data if the organization put it there.
• Usage records: the days a person used the service (for billing by active users), records of AI requests (without their content).
• Technical data: IP address, time and address of a request in server logs, for security and troubleshooting. Kept for a limited time.
• A demo request from the website: name, work email, company, team size, message, language, and the IP address, only to fight spam (no more than a few requests per address per hour). Here we are the controller.
• spilnolms.com statistics: we keep anonymous daily counters: page views, clicks on the “Start trial” and “Book a demo” buttons, the page language and the domain people came from. No cookies, IP addresses, or browser or device identifiers: this data can't tell who visited. For an organization's signup we only note which website button it came from (for example, “pricing”).
• Cookies: the website sets none. The app keeps in the browser only what it can't work without: the sign-in token and interface settings.

Why and on what basis

• Providing the service (accounts, courses, assignments, reminders, reports, certificates): performance of the contract with the organization (Art. 6(1)(b) GDPR); for employee data, on the instructions of the organization as controller.
• Security, preventing abuse, backups: legitimate interest (Art. 6(1)(f)).
• Invoicing and accounting: legal obligation (Art. 6(1)(c)).
• Demo requests: your request and our legitimate interest in answering it (Art. 6(1)(b) and (f)); we don't use request data for mailings.
• Service emails (invitations, reminders, password resets) are part of the service. We don't send marketing emails.

AI generation

When an admin generates quiz questions, the server sends the Claude model by Anthropic, PBC (USA) only learning material: the text of the selected lessons, an uploaded document or pasted text. The system doesn't add people's profile data (names, emails, learning results) to the request. But if personal data is in the material itself (for example, in a document), it is sent along with it. Anthropic doesn't use data sent through its API to train its models and keeps it for a limited time under its commercial API terms.

AI generation can be switched off for the whole organization in settings. Don't put personal or confidential data into material for generation if you can't share it with an AI provider.

Who else processes data (sub-processors)

• Hetzner Online GmbH (Germany): servers and data storage in the EU.
• Namecheap, Inc. (USA): the domain and hosting of the spilnolms.com website: server logs with website visitors' IP addresses and, until the app launches, sending demo requests by email, the website's anonymous counters and a copy of the requests (up to 90 days, not reachable from the web); @spilnolms.com mail is Namecheap Private Email. Hosting data centre: [TO FILL: country].
• Anthropic, PBC (USA): AI generation; learning material only, if the organization uses AI.
• [TO FILL: email delivery provider, e.g. Brevo, France]: delivering emails (invitations, reminders).
• Google, Microsoft: only if the organization turned on sign-in with them; they process sign-in data as independent controllers under their own terms.

We notify organizations about new sub-processors in advance (see the Terms).

Transfers outside the EU

Data is stored in the EU. The exceptions are learning material for AI generation, processed by Anthropic in the USA, and, if the website's hosting data centre is outside the EU, the website logs and demo requests at Namecheap. This transfer is based on Anthropic's data processing agreement, which includes the EU Standard Contractual Clauses (SCCs).

How long we keep data

• An organization's data: while its account is active.
• After the contract ends, the organization can get an export of its data within 30 days; then the data is deleted.
• Backups are kept for 14 days and deleted automatically.
• Demo requests: 12 months, then deleted automatically; earlier on request.
• Results of deleted courses stay in the organization's reports until it deletes them or stops using the service.
• Files nothing uses any more are deleted automatically.

How we protect data

• HTTPS for every connection; passwords only as a hash.
• Each organization's data is isolated: every request checks which organization the person belongs to.
• Third-party SCORM courses open from a separate address and can't reach accounts.
• Our team accesses the system through a separate console with two-factor sign-in, with a log of every action.
• Daily backups.

Your rights

Under the GDPR you have the right to: get a copy of your data; correct inaccurate data; have it erased; restrict processing; receive your data in a machine-readable format; object to processing based on legitimate interest; and lodge a complaint with the data protection authority in your country.

We respond to requests within one month. If your organization put the data in, we pass the request to it as controller and help it respond.

Security breaches

If a personal data breach happens, we notify the organization without undue delay and, where we are the controller, the supervisory authority within 72 hours, as the GDPR requires.

Children

Spilno LMS is meant for training employees and isn't intended for children under 16.

Changes

The current version is always on this page with its date. We notify organization admins about significant changes in advance.