Last updated: 7 October 2026

Privacy notice

This page covers every LMSable tool: the H5P Generator, Course Builder, PowerPoint to SCORM, the quiz generator, the certificate generator, the newsletter and the blog. The full privacy policy of the controller, covering our website and other services, is at https://etechnologie.pl/en/privacy-policy/. Where the two differ on these tools, this page is the more specific one.

Who is responsible

eTechnologie Sp. z o.o., ul. Cyfrowa 6, 71-441 Szczecin, Poland (KRS 0000426059, NIP 8513164366, REGON 321247410). Contact: info@etechnologie.pl, +48 91 351 03 00. We have not appointed a Data Protection Officer.

What we send to AI services, and when

This is the part people ask about first, so it comes first. LMSable's tools don't send your material to AI services on their own. You copy a prompt, paste it into the chat you already use (ChatGPT, Claude, Gemini, Copilot) and paste the answer back here. Whatever you type into that chat is governed by the terms of its provider, not ours, and we never see it unless you bring it back. We hold no AI API key on your behalf.

There are three exceptions, and each happens only when you choose it:

AI connector (MCP). If you connect an AI assistant such as ChatGPT (OpenAI) or Claude (Anthropic) to your LMSable account, the assistant can request information about your courses and, if you granted edit access, make changes to them on your instruction. When you ask it to read a course, LMSable sends through the connection the course data needed for that request (for example, the full text of a lesson you asked about). When you ask it to make a change, LMSable receives the requested action and applies it within the permissions you granted. The connection is optional: you authorise it explicitly on LMSable's connection screen, you choose its access level, and you can revoke it at any time. We send this data on your instruction, to perform our service (Art. 6(1)(b) GDPR). The provider of the assistant then processes it under the terms and privacy settings of your account with that provider; it is not our processor, and we do not control how it stores conversations or uses what it receives through connected apps. What we keep about the connection itself is listed in "What we collect" and "How long we keep it".
Transcribe a recording (Pro). Only the audio track is uploaded. We pass it to our speech-to-text provider and delete it from our server right after transcription; only the text is kept. With a link, the provider fetches the file directly.
Generate narration (every plan, within its limit). The text you choose to narrate is sent to our text-to-speech provider, which returns the audio recording that we add to your course.

What actually leaves your browser

The tools differ, and the difference matters more than any general assurance. Two of them do their work entirely on your device.

Tool	What reaches our servers	What stays on your device
Certificate generator	Nothing. The page is a static form.	Names, the logo you pick and the finished PNG or PDF. They are produced in your browser and never uploaded.
PowerPoint to SCORM	The rendered slide images, plus the title, language and aspect ratio.	The PDF itself. It is converted to images in your browser; the source file is never uploaded.
H5P Generator	Your brief (type, topic, language, tone, level, item count) and the structured answer you paste back.	Your conversation with the AI assistant. There is no file upload in this tool.
Quiz generator	Your brief and the quiz (questions, answers, feedback) you paste back or edit here. It goes into the package and is kept alongside it for as long as the download link lives, so the quiz can be reopened or saved to an account.	Your conversation with the AI assistant.
Course Builder	Your email address, the course structure and lesson content, any source text you paste, and the images, PDFs, audio or video you attach to a lesson.	Nothing in particular. This tool saves your project on our servers so you can come back to it.

What we collect

Data	Why	Legal basis
Email address, Course Builder	To send the sign-in code and to keep your projects attached to you. It is required here, because the tool cannot return your work to you without it. Marketing consent is a separate, optional tick box.	Performance of a contract, Art. 6(1)(b) GDPR
Email address, downloads and newsletter (optional)	To send occasional updates about our e-learning tools. Files download without it. We store the address only if you tick the consent box; type one, leave the box unticked, and it is discarded with the request.	Consent, Art. 6(1)(a) GDPR
The content you paste or attach	To validate it and build the package or the course. This covers the H5P answer, the quiz questions, the slide images, and Course Builder lessons, source text and attachments.	Performance of a contract, Art. 6(1)(b) GDPR
AI chat connection, only if you connect one: the connection name, the connected app's name, the access level you granted, a one-way hash of the access token (never the token itself), the time of each use, and a log of the actions performed (which tool, on which course or lesson, and whether it worked; never the content read or written)	To let the AI chat you connected work on your courses, to show you what is connected so you can revoke it, and to investigate misuse.	Performance of a contract, Art. 6(1)(b) GDPR; the action log: legitimate interest, Art. 6(1)(f) GDPR
Generation metadata (tool, interaction type, topic, content language, whether validation passed, package size)	To see which parts of the tools are used and where people get stuck.	Legitimate interest, Art. 6(1)(f) GDPR
Product usage events in Course Builder (for example "course created" or "SCORM export finished"), linked to a pseudonymous account ID, with your plan, country, language and the campaign that brought you	To understand which features help people finish a course and where they give up. Details in "Product analytics" below.	Legitimate interest, Art. 6(1)(f) GDPR. You can object with one switch.
Pro purchase: your email address, the plan, currency and billing period, the status and dates of your subscription, and the customer and subscription IDs from Stripe. Card details never reach us. If you order Pro with a Polish VAT invoice: company name, tax ID (NIP), billing address and the contact you give us.	To sell and provide Pro, switch it on and off with your subscription, and issue invoices.	Performance of a contract, Art. 6(1)(b) GDPR; invoices and accounting records: legal obligation, Art. 6(1)(c) GDPR
Error reports from your browser when a page fails: the error message and the place in our code where it happened, the page address without its parameters, the browser type and app version, and your account ID if you are signed in. Never the content of your courses, what you typed, your IP address or cookies.	To find and fix errors in our service. Identical errors are grouped and counted.	Legitimate interest, Art. 6(1)(f) GDPR
IP address, country (from the Cloudflare header), referring page	Rate limiting, abuse prevention and export limits.	Legitimate interest, Art. 6(1)(f) GDPR

The blog collects nothing. Its posts are files, not database records, and reading one does not create any entry about you beyond the ordinary server and Cloudflare logs described below.

How long we keep it

H5P content you paste: 30 days, then it is erased automatically. After that only the metadata above remains, and it no longer contains your material.
Exported ZIP packages (PowerPoint to SCORM, quiz): 30 days, then the file is deleted and its download link stops working. Keep your own copy. If you choose "Save to my account" on the result panel, the content that package was built from (the quiz you edited, or the slide images) is copied into a new Course Builder project owned by your account, and from then on it follows the Course Builder rows of this table.
Course Builder projects you never exported: 90 days from your last activity on the Free plan, then the project and its uploaded files are removed. On Pro they are not removed on a timer. If your account had Pro before, they are kept for at least 12 months without sign-in or course activity; then we email you, and they are removed no earlier than 30 days after that email.
AI chat connections: a connection works until you revoke it. A personal access token also expires after 90 days without use, and a connector sign-in after 30 days without use. We delete the connection record 30 days after it expires or you revoke it. The action log: 12 months, then it is deleted.
Course Builder projects you did export: kept until you ask us to delete them. We do not remove them on a timer, so that returning to an exported course still works. Delete a course in Course Builder, delete your whole account on the Account page, or write to us.
Your email address: kept while your Course Builder projects exist, or, for marketing, for as long as you want the updates. Withdraw consent or ask us to delete the address and we remove it without undue delay. If we created your account by sending you an invitation and you never opened it, we delete the account 30 days after the invitation expires.
Product usage events: up to 24 months at our analytics provider. When you delete your account, we also delete your analytics profile and its events there.
Purchase and invoice records: 5 years from the end of the year of payment, as required by tax law. If you delete an account that has a payment history, we remove your courses and anonymise the account, but the accounting documents stay with Stripe, Link and our invoicing service for that period.
Data exports you request on the Account page: 48 hours, then the file is deleted and its download link stops working.
Your IP address: 30 days, then we remove it from our records.
Server and proxy logs: short-lived operational records kept by us and by our hosting provider.
Error reports from your browser: 30 days after the error last occurred, then they are deleted.
Backups: the hosting platform takes a daily copy of files and the database and keeps it for 30 days. When we delete something at your request, it disappears from the live service immediately and ages out of the backups within that window.

Who else sees it

Our hosting provider JDM, whose servers for this service are in Germany, and Cloudflare, which sits in front of the site as a proxy and anti-abuse layer, runs the Turnstile anti-bot check, and stores videos you upload to a course in Cloudflare R2 within the EU (EU jurisdiction). Both act as processors under contract. In addition:

Our email provider delivers the Course Builder sign-in code and other account messages (for example the Pro welcome e-mail or a notice before unused courses are removed), so it processes your address to send them.
The eTechnologie CRM receives newsletter sign-ups (address, consent time, country and IP) when you subscribe. It is our own system, operated by the same controller.
Stripe and Link. When you buy Pro by card, the sale is made through Link (Stripe's merchant-of-record service), which takes the payment, handles tax and sends receipts and invoices; Stripe processes the payment. They receive your email address and the payment details you enter at checkout, and they act as independent controllers for the payment, under their own privacy policies. We receive the status of your subscription, never your card details.
Our invoicing service (Fakturownia) holds the invoice data when you order Pro with a Polish VAT invoice.
Google Fonts serves a typeface only when a course uses a Google font (in its theme or branding). Your IP address then reaches Google while that course is shown. The site itself uses fonts served from our own servers.
Google (Google Analytics and advertising measurement) receives visit data from your browser only if you allow Statistics or Marketing cookies; see the cookie table below.
YouTube serves the tutorial videos embedded in the Help Center and in lessons that use a YouTube video, when you play them.
Pixabay and Pexels are used when you search for stock photos inside Course Builder. The search itself goes through our servers, but the thumbnails you see are loaded from those providers, so your IP address and browser details reach them while the results are on screen. We do not send them your email address, and we do not pass on what you searched for beyond the search word itself. Once you pick a photo, our server downloads a copy and the course uses that copy, so nothing further is requested from the provider.
PostHog Inc. analyses the product usage events described below, with the data hosted in the European Union (Frankfurt).
Deepgram, Inc. (USA) converts audio to text when you use Transcribe a recording. We use its EU endpoint, so the audio is processed in the EU, and we have opted out of its model improvement programme.
ElevenLabs (USA) turns text into speech when you use Generate narration. Our account is set so that the texts we send are not used to train its models.

PostHog, Deepgram, ElevenLabs and Fakturownia act as our processors. Transfers of data outside the EEA rely on the standard contractual clauses in their data processing agreements.

If you connect an external AI assistant:

OpenAI (ChatGPT) may receive course content and other information requested through the LMSable connection when you instruct ChatGPT to work with your courses.
Anthropic (Claude) may receive the same kind of information when you connect Claude and instruct it to work with your courses.
The same applies to the provider of any other AI assistant you connect.

These providers receive the data at your request and act under the terms and privacy settings of your account with them, not as our processors. Revoking the connection stops the assistant from making further requests to your LMSable account.

We do not sell data. Google receives advertising measurement signals only if you allow Marketing cookies; otherwise we share nothing with advertising networks.

Product analytics

When you use Course Builder, our server records what happened, such as "a course was created", "a lesson was added" or "a SCORM export finished", and sends these events to PostHog, our analytics provider, with the data hosted in the European Union (Frankfurt). This helps us see which features help people finish a course and where they get stuck.

What PostHog receives:

a pseudonymous ID of your account (for example usr_01j8zk…), never your email address or name,
technical details of each event: the feature used, counts and durations, the language code, your plan, your country and the campaign that brought you to us,
none of your content: course and lesson titles, lesson text, quiz questions, prompts, uploaded files and their names stay in LMSable.

We do not send your IP address, and IP storage is switched off on the PostHog side. These events are sent from our server and do not depend on cookies. You can stop them at any time with the Product analytics switch in your account, without giving a reason; from then on none of your events leave LMSable.

Analytics and cookies

The consent banner has three categories. Necessary cookies are always on, because the site cannot work without them, and they are not used for tracking. Statistics and Marketing stay off until you switch them on: before that no cookies from those categories are stored and no browser analytics identifier is sent.

Cookie or storage	Set by	Purpose	Category	Kept for
Session cookie and `XSRF-TOKEN`	LMSable	Keeps you signed in and protects forms against cross-site request forgery.	Necessary	Until the session ends
`lmsable_owner`	LMSable	Keeps you signed in to Course Builder on this device, when "Keep me signed in" is ticked.	Necessary	30 days
`et_consent`	LMSable	Stores your choice in the consent banner, so we do not ask again on every visit.	Necessary	1 year
`et_consent_id`	LMSable	A random ID of the anonymous record of your choice. We keep that record (the choice, the banner version and the time, without your IP address or account) for 3 years to be able to show what was agreed.	Necessary	1 year
`_ga`, `_ga_*`	Google Analytics	Counts visits and which pages and tools are used. IP anonymisation is on.	Statistics	13 months
`ph_*` cookie and local storage	PostHog (EU hosting)	Product analytics in your browser: which pages you open and which tool features you use, under a pseudonymous ID (the same account ID described above when you are signed in). Web addresses are shortened before they are sent: IDs in them are removed, and page titles, course content and file names are never sent.	Statistics	Up to 1 year
Google advertising signals	Google	Lets Google measure our advertising campaigns. Used only if you allow Marketing.	Marketing	Per Google's settings, only with consent

You can change or withdraw your choice at any time with Cookie settings in the footer of every page. Withdrawal takes effect straight away: statistics stop and the ph_* cookie and storage are deleted from your browser. If you are signed in and have turned off the Product analytics switch in your account, PostHog does not run in your browser at all, whatever you chose in the banner.

Some tools also keep a small amount of state in your browser's local storage to remember what you were doing; that data stays on your device and never reaches us.

Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest (for product analytics, the switch in your account is enough). Consent can be withdrawn at any time without affecting processing carried out before withdrawal. If you have a Course Builder account, you can download a copy of your data and delete your account yourself on the Account page. For anything else, write to hello@lmsable.com - an email address is enough for us to find and delete your record. You may also lodge a complaint with the Polish supervisory authority (Prezes Urzedu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

Transfers outside the EEA

Your account and course data is stored in the European Economic Area. Cloudflare, Google, Stripe and Link may process data outside the EEA under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. PostHog keeps the analytics data in the EU; some of its subprocessors may process it outside the EEA under the same clauses, and PostHog Inc. participates in the EU-US Data Privacy Framework. Deepgram processes the audio in the EU; Deepgram, Inc. and ElevenLabs are based in the USA, and any transfer to them relies on the standard contractual clauses in their data processing agreements.

If you connect an external AI assistant such as ChatGPT or Claude, the information you ask it to access may be transferred to and processed by that provider outside the EEA, under its own terms, privacy policy, account settings and data-residency arrangements. Where and for how long that provider keeps the data may therefore differ from the rules that apply to data stored by LMSable.