Privacy Policy

Effective November 14, 2026 ·Grindstone Labs, LLC

This Privacy Policy describes how Grindstone Labs, LLC(“we,” “our,” or “us”) collects, uses, and shares information when you use the Scormbusters hosted service (“Service”). It applies only to the hosted Service — not to on-premises Enterprise deployments, which are entirely under your control.

1. What we collect

Account information

When you sign up: your email address, password (hashed — we never see it in plaintext), and your organization name.

Content you create

Courses, lessons, images, videos, and other content you upload or generate through the Service — whether in the editor, through the REST API, or through an AI agent connected via MCP. This content belongs to you (see Section 3 below).

Learner data

If you use the Service to deliver courses to learners, we store their enrollment records, lesson progress, quiz scores, and completion status on your behalf. As the organization owner, you are the data controller for your learners' data.

The free accessibility scan needs no account and keeps nothing: the package you scan is read for the scan and deleted immediately. If you then ask us to email you the report, we store your email address, the consent sentence you agreed to, when you agreed, and a summary of the scan — the course title, the tool that made it, and the counts (screens, images and findings by severity). Never the package, and never the report's text. We use the address to send that report and at most two follow-ups about migrating that course; every email has an unsubscribe link, and unsubscribing stops them. We delete the record 12months after our last email, or sooner on request; after you unsubscribe we keep only a one-way hash of your address so we don't email you again.

The free import preview

When you upload a package to see it rebuilt without an account, we keep the rebuilt course (its text, images and media) for 7 days at a private link only the uploader receives, so you can play it and, if you start a trial, add it to your workspace. The uploaded package itself is deleted as soon as it has been read. After 7 days the rebuilt course and its media are deleted automatically; adding it to a workspace copies it there and deletes the preview at once. The preview record (title, tool and counts) is deleted 30 days after that.

Usage data

Standard server logs: IP addresses, browser type, pages visited, and timestamps. We use this to operate the Service, diagnose errors, and understand aggregate usage patterns.

Payment data

We use Stripe to process payments. We never see or store your full credit card number. Stripe's privacy policy governs how they handle payment data.

2. How we use your data

• To operate the Service — account management, course delivery, analytics, email notifications
• To improve the Service — aggregate, anonymized usage patterns (never individual course content)
• To communicate with you — service updates, invoices, security alerts, and (with your consent) product announcements
• To comply with legal obligations — if required by law or valid legal process

We do not sell your data. We do not use your course content to train AI models.

2A. Legal bases and transfers

We process account and billing data to perform our contract with you (GDPR Art. 6(1)(b)) and to meet tax duties (6(1)(c)); logs, security, abuse prevention and cookieless page counts for our legitimate interest in a secure service (6(1)(f)); analytics cookies, outside the EEA, UK and Switzerland, for our legitimate interest in understanding which pages help visitors (6(1)(f)); and scan-report emails on your consent (6(1)(a)), withdrawn by unsubscribing. For course content and learner data we are your organization's processor under our Data Processing Agreement. Data is stored in the United States; transfers from the EEA, UK and Switzerland rely on the EU-US Data Privacy Framework where the recipient is certified and otherwise on Standard Contractual Clauses.

3. Your content is yours

You own all content you create. We store it to operate the Service. You can export or delete it at any time. We retain deleted content in backups for up to 30 days before permanent deletion.

4. Data sharing

We share data only with these subprocessors, also listed at /subprocessors:

Exported packages load the Inter font from Google Fonts in the learner's browser, which sends the learner's IP address to Google.

We email each organization's owner at least 30 days before adding a subprocessor.

If you connect an AI assistant (for example over MCP), it reads and edits your courses with your permissions. You choose and pay its provider; it is not our subprocessor, and its provider's terms and privacy policy govern that processing.

We do not share your data with any other third parties for marketing or advertising.

5. Your rights

You have the right to:

• Access — request a copy of your personal data
• Correction — update inaccurate data via your account settings
• Deletion — delete your account and all associated data. Go to Settings → General → Delete organization.
• Portability — export your courses as SCORM packages or JSON at any time
• Objection — opt out of non-essential communications from your account settings

For requests or questions, contact hello@scormbusters.com. We will respond within 30 days.

6. GDPR

If you are in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local supervisory authority.

For organizations using Scormbusters to process data about EU learners: you are the data controller and we are the data processor. Our Data Processing Agreement is available to every paying customer on request from hello@scormbusters.com; once signed, it forms part of the Terms of Service.

7. Data retention

• Account data is retained as long as your account is active
• Course content is retained until you delete it or close your account
• Learner progress and completion records are retained for the lifetime of your organization
• Server logs are retained for 90 days
• Import previews: the rebuilt course and media are deleted 7 days after upload, or at once when added to a workspace; the preview record (title, tool, counts) is deleted 30 days later.
• Scan-report email records: deleted 12months after our last email. After you unsubscribe we keep only a one-way hash of your address so we don't email you again.
• Lapsed organizations: may be deleted after the read-only period in Terms §5, with 30days' notice.
• Deleted content is removed from backups within 30 days

8. Security

We use industry-standard practices: encrypted connections (TLS), bcrypt password hashing, row-level security in the database, and access controls that limit who on our team can access production data.

No system is 100% secure. If you discover a security issue, please report it to hello@scormbusters.com rather than disclosing it publicly (see our Security Policy).

9. Cookies and analytics

We use session cookies for authentication (managed by Supabase Auth). We do not use advertising cookies, and we do not share data with advertisers. You can disable cookies in your browser, but this will prevent you from logging in.

We count visits to our public pages (the home page, pricing, guides and documentation) in two ways. Vercel Web Analytics sets no cookies and does not identify you; it counts unique visits with a daily-rotating, non-reversible hash. Google Analytics 4 sets first-party cookies (_ga, _ga_<ID>) that last up to 13 months, so we can see which pages lead people to try the free scan or preview. Google Analytics is not loaded for visitors in the European Economic Area, the United Kingdom or Switzerland, or for browsers that send a Global Privacy Control signal. Google signals and advertising features are off, and we keep Google Analytics data for 14 months.

Pages inside the application, courses, previews and shared links are never reported as pages to either service, and only campaign tags (utm_*) are kept from web addresses. You can block Google Analytics with Google's opt-out browser add-on or any content blocker.

10. Children

Author accounts are not directed at children under 13, and we do not knowingly collect personal data from children under 13 through account signup. If your organization delivers courses to learners under 13 (for example, in a school), your organization is the data controller and is responsible for obtaining any consent required by law (such as COPPA) before enrolling them. If you believe a child has provided us with personal data directly, contact hello@scormbusters.com.

11. Changes to this policy

We will notify you of material changes by email and/or in-app notice at least 14 days before they take effect. The current version is always at scormbusters.com/privacy.

12. Contact

Grindstone Labs, LLC
1111B South Governors Avenue, Dover, DE 19904, USA
hello@scormbusters.com