Privacy policy

LMS Solutions (“we”, “us”) makes Shiftskill, a learning management system for workplace training. This policy explains what personal information we handle, why, and the choices you have. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles.

Who is responsible for what

Information inside a customer workspace (learners' names, work emails and training records) is collected by the organization that runs the workspace, usually your employer. That organization decides what is collected and why; we process it on its behalf and only to provide Shiftskill. If you are a learner, contact your organization first about your training records. We will help them answer your request.

Information about our own customers and visitors (account owners, people who contact us, and website visitors) is our responsibility under this policy.

What we collect

• Account details: name, work email address and a salted hash of your password. We never store your password itself.
• Workspace content: courses, lessons, quizzes and any documents an admin pastes in to draft a course.
• Training records: assignments, due dates, lesson progress, quiz answers and scores, completions and certificates.
• Contact requests: what you send us through the website form (name, email, company, company size, message).
• Billing details: handled by Stripe. Card numbers go directly to Stripe and never reach our servers; we receive the payer's name, email and payment status.
• Technical data: IP address, browser type and request logs, used for security, abuse prevention and fixing errors.

We do not ask for sensitive information such as health, financial or government ID details, and we ask customers not to put it in courses or training records.

How we use it

• To run the service: sign-in, delivering courses, tracking progress, issuing and verifying certificates and producing reports.
• To send service email, such as workspace invitations and account notices. We do not send marketing email to learners.
• To keep the service secure: rate limiting, detecting abuse and investigating incidents.
• To support customers, answer enquiries and handle billing.
• To improve Shiftskill using aggregated, de-identified usage patterns.

We do not sell personal information, we do not use it for advertising, and we do not use customer content or training records to train AI models.

AI course drafting

When an admin uses AI drafting, the text they submit is sent to our AI provider, Anthropic (United States), to generate a draft course. Under Anthropic's commercial terms, inputs submitted through its API are not used to train its models. Admins can switch AI off for their workspace in Settings; drafting then uses a built-in method that runs on our own servers.

Cookies and analytics

The Shiftskill app uses one essential cookie, wp_session, to keep you signed in. The app does not use advertising or tracking cookies.

Our public website, shiftskill.ca, uses Google Analytics to count visits and see which pages are useful, only if you choose “Allow analytics” in the cookie banner. Until you do, nothing from Google loads. With your permission, Google Analytics sets cookies (named _ga and _ga_…) and receives your IP address and browser details. Google processes this for us and may do so outside Canada, including in the United States. We don't use it for advertising. Visit-level data tied to the analytics cookie is deleted after 2 months; we keep only aggregate counts that don't identify you. Choosing “Decline” later also deletes the analytics cookies. Your choice itself is remembered in your browser's local storage (cc_cookie, only on shiftskill.ca) for 6 months. You can change your choice at any time with “Cookie settings” at the bottom of the website, or by clearing your browser's data for shiftskill.ca.

Where your information is stored

Shiftskill and its backups are hosted in the AWS US East (Ohio) region. Our service providers process information outside Canada, which means it may be accessible to authorities under the laws of those countries:

• Amazon Web Services (United States): hosting, backups and email delivery.
• Anthropic (United States): AI drafting, only when it is switched on.
• Stripe (Canada and United States): payments.
• Sentry (United States): error reports, which may include the page address and technical details of the error.
• Uptime monitoring: checks a public health page and receives no personal information.

Each provider is bound by contract to protect the information and use it only to provide its service to us.

How long we keep it

• Workspace data: while the workspace is active. After a workspace is closed, we delete it within 30 days, and it leaves our backups within a further 35 days.
• People removed from a workspace: their training records are kept for the period the workspace sets (1 to 10 years, 7 by default), then their progress is deleted and their completion records are anonymized. A workspace admin can erase someone sooner, for example when that person asks. Their account is deleted once no workspace holds it. Erased data leaves our backups within 35 days.
• Demo sandboxes: deleted automatically 7 days after they are created.
• Contact requests: up to 24 months, unless you become a customer.
• Server logs: up to 30 days.

Workspace admins can export all of their data at any time from Settings.

How we protect it

All traffic is encrypted with HTTPS. Passwords are hashed, each workspace's data is kept separate, the database is not reachable from the internet, and encrypted backups are taken every night. Access to production systems is limited to the people who need it.

Your choices and rights

You can ask to see the personal information we hold about you, ask us to correct it, or withdraw your consent (which may mean we can no longer provide the service). Email privacy@lmssolutions.ca and we will respond within 30 days. If your request is about records in an employer's workspace, we will pass it to that organization and help them respond.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

If something goes wrong

If a breach of security safeguards creates a real risk of significant harm, we will notify affected customers and individuals and report it to the Office of the Privacy Commissioner of Canada as PIPEDA requires. We keep a record of every breach.

Children

Shiftskill is built for workplace training and is not intended for children under 16.

Changes to this policy

We will post any changes here and update the date above. For material changes, we will also email workspace owners at least 30 days in advance.

Contact

Our privacy officer can be reached at privacy@lmssolutions.ca.