Privacy Policy
This Privacy Policy explains how [Legal entity name] (“SCORM Craft”, “we”) handles personal data when you use the SCORM Craft website, application and course conversion service.
Two roles. For account, payment and website data, we are the controller. For personal data contained in a customer’s uploaded course, the customer is the controller and we are the processor under our Data Processing Addendum. If you are a learner whose data appears in a course, please contact the organization that provided the course first.
1. Data we collect
| Category | Examples | Why we use it | Legal basis | Retention |
|---|---|---|---|---|
| Account and authentication | Email address, user ID, magic-link tokens, session and guest cookies | Create and secure your account, sign you in, associate guest uploads with you | Contract; legitimate interests (security) | Account life + 30 days; magic-link tokens expire quickly |
| Course content and branding | Uploaded ZIP, extracted text, images, video, audio, quizzes, logo, colors, author credit | Convert, rebuild, preview, store and deliver your course | Contract; processing on your instructions | Until you delete the course + 30 days |
| Payments | Dodo Payments customer and payment IDs, amount, currency, status, billing/tax details | Process one-time payments, prevent fraud, comply with tax and accounting law | Contract; legal obligation; legitimate interests (fraud prevention) | Up to 7 years for tax/accounting records |
| Technical and security logs | IP address, user agent, timestamps, requested URLs, error and build logs | Operate, secure, debug and protect the service | Legitimate interests (security and reliability) | Up to 30 days, unless needed for an investigation |
| Communications | Support emails and messages you send us | Respond to requests and maintain records | Contract; legitimate interests | Up to 24 months |
| Cookies and local storage | Session, guest and preference data; course progress stored in your browser | Keep you signed in, associate guest courses, remember progress | Essential/contract; see Cookie Policy | See Cookie Policy |
We do not intentionally collect special-category data (such as health, biometric, political or religious data) or data of children. Customer courses may contain such data if the customer chooses to upload it; the customer is responsible for having a lawful basis and appropriate safeguards.
2. How we use personal data
- Provide, operate, secure and improve the service, including converting and rebuilding courses.
- Authenticate you, send magic links, and associate guest uploads with your account.
- Process payments, invoices, refunds and fraud prevention through Dodo Payments.
- Respond to support, legal and data-protection requests.
- Monitor reliability, debug errors, prevent abuse and protect the service.
- Comply with legal, tax, accounting and regulatory obligations.
- Create aggregated or de-identified statistics that do not identify you.
We do not sell personal data, share it for cross-context behavioural advertising, or use Customer Content to train generative AI models. We send transactional emails (magic links and service notices), not marketing emails, unless you separately opt in.
3. Legal bases
Where GDPR or UK GDPR applies, we rely on: performance of a contract (providing the service you request); legitimate interests (security, fraud prevention, reliability, support and improving the service, balanced against your rights); legal obligation (tax, accounting and lawful requests); and consent where required (for example, non-essential cookies or optional communications). You may withdraw consent at any time without affecting prior processing.
4. Sharing and subprocessors
We share personal data only as needed with:
- Infrastructure and storage: Cloudflare, Inc. (Workers, Containers, R2 object storage, email sending, security).
- Payments: Dodo Payments (checkout, payment processing, fraud prevention). We do not store full card numbers.
- Email delivery: Cloudflare Email Sending.
- Professional advisers (lawyers, accountants, auditors) under confidentiality obligations.
- Authorities or courts where required by law, or to protect rights, safety and security.
- A successor in a merger, acquisition, financing or sale of assets, subject to appropriate confidentiality.
Our current subprocessors and their locations are listed in the Subprocessors page. We require processors to protect personal data with appropriate contractual and security commitments.
5. International transfers
SCORM Craft uses a global infrastructure. Personal data may be processed in countries other than your own, including the United States and the European Union, where our providers operate. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss addendum, or another lawful transfer mechanism. You can request more information at privacy@scormcraft.app.
6. Retention
We keep personal data only as long as needed for the purposes described above. Account data is kept while your account is active and for up to 30 days after deletion. Course content is kept until you delete the course and for up to 30 days afterward, unless a longer period is required for legal claims or backup integrity. Payment and tax records may be kept for up to 7 years. Security logs are kept for up to 30 days unless needed for an investigation. Magic-link tokens are short-lived and single-use. Guest cookies last up to 30 days.
When data is no longer needed, we delete or de-identify it. Deletion from active systems may not immediately remove residual copies from provider backups or legal archives; those copies are isolated and deleted on the provider’s schedule.
7. Security
We use technical and organisational measures designed to protect personal data, including TLS in transit, encryption at rest at our infrastructure provider, access controls, secret management, isolated containers, logging and vendor review. No method of transmission or storage is completely secure. Our current practices and limitations are described in Security & Data Handling.
8. Your privacy rights
Depending on your location, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- delete your data, subject to legal retention obligations;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent where processing is based on consent;
- lodge a complaint with a supervisory authority.
To exercise a right, email privacy@scormcraft.app. We may need to verify your identity and will respond within the time required by applicable law (generally 30 days under GDPR and 45 days under CCPA). You may use an authorised agent where the law allows. If your request concerns learner data inside a customer’s course, we will refer you to the customer as controller and assist them as needed.
9. California and U.S. state privacy rights
If you are a California resident (CCPA/CPRA) or a resident of another U.S. state with a comprehensive privacy law, you may have the right to know, access, correct, delete, obtain a copy, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against for exercising your rights. We do not sell personal data or share it for cross-context behavioural advertising. We collect the categories described in section 1 for the business purposes described. To exercise your rights, email privacy@scormcraft.app. You may designate an authorised agent with written permission.
10. Other jurisdictions
We are based in Chile and design our practices to support compliance with applicable data-protection laws, including the GDPR and UK GDPR, the Brazilian LGPD, Canada’s PIPEDA, Japan’s APPI, Australia’s Privacy Act and Australian Privacy Principles, Singapore’s PDPA, India’s DPDP Act, South Africa’s POPIA, Mexico’s LFPDPPP and Chile’s data-protection legislation. Local mandatory rights are not excluded by this Policy. If you believe your local law gives you a right not described here, contact us.
11. Children
The service is intended for organizations and professional users and is not directed to children under 18. We do not knowingly create accounts for children. A customer’s course may include learner data; the customer is responsible for obtaining any parental or guardian consent and for complying with child-protection laws.
12. Cookies and local storage
We use essential cookies and browser storage to keep you signed in, associate guest uploads and remember course progress. We do not currently use advertising or analytics cookies. See the Cookie Policy for names, purposes and durations.
13. Changes and contact
We may update this Policy to reflect changes in the service, law or our practices. Material changes will be communicated by email or a notice in the service before they take effect. The “Last updated” date above shows the current version. Controller: [Legal entity name], [Registered address], [City], Chile. Privacy contact: privacy@scormcraft.app. Legal contact: legal@scormcraft.app.