Privacy policy

LMS Solutions (“we”, “us”) makes Shiftskill, a learning management system for workplace training. This policy explains what personal information we handle, why, and the choices you have. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles.

Who is responsible for what

Information inside a customer workspace (learners' names, work emails and training records) is collected by the organization that runs the workspace, usually your employer. That organization decides what is collected and why; we process it on its behalf and only to provide Shiftskill. If you are a learner, contact your organization first about your training records. We will help them answer your request.

Information about our own customers and visitors (account owners, people who contact us, and website visitors) is our responsibility under this policy.

What we collect

• Account details: name, work email address and a salted hash of your password. We never store your password itself.
• Workspace content: courses, lessons, quizzes and any documents an admin pastes in to draft a course.
• Training records: assignments, due dates, lesson progress, quiz answers and scores, completions and certificates.
• Contact requests: what you send us through the website form (name, email, company, company size, message).
• Free trial sign-ups: your name, work email and company name, and whether you ticked “Send me product news and tips” (with the date you did). We keep these as a sales contact so we can follow up about your trial.
• Billing details: handled by Stripe. Card numbers go directly to Stripe and never reach our servers; we receive the payer's name, email and payment status.
• Technical data: IP address, browser type and request logs, used for security, abuse prevention and fixing errors.

We do not ask for sensitive information such as health, financial or government ID details, and we ask customers not to put it in courses or training records.

How we use it

• To run the service: sign-in, delivering courses, tracking progress, issuing and verifying certificates and producing reports.
• To send service email, such as workspace invitations, sign-up confirmation links and account notices. We do not send marketing email to learners.
• To send product news and tips, only to people who ticked the box for it when signing up. You can withdraw that consent at any time with the unsubscribe link or by emailing us.
• To keep the service secure: rate limiting, detecting abuse and investigating incidents.
• To support customers, answer enquiries and handle billing.
• To improve Shiftskill using aggregated, de-identified usage patterns.

We do not sell personal information, we do not use it for advertising, and we do not use customer content or training records to train AI models.

AI course drafting

AI course drafting is a planned feature and is not switched on. If we release it, we will tell workspace owners the terms first, and it stays off until an admin turns it on in Settings. When it is on, the text an admin submits is sent to our AI provider, Anthropic (United States), to generate a draft; under Anthropic's commercial terms, API inputs are not used to train its models. Otherwise drafting uses a built-in method that runs on our own servers.

Cookies and analytics

The Shiftskill app uses one essential cookie, __Host-shiftskill.session, to keep you signed in. The app does not use advertising or tracking cookies.

Our public website, shiftskill.ca, uses Google Analytics to count visits and see which pages are useful, only if you choose “Allow analytics” in the cookie banner. Until you do, nothing from Google loads. With your permission, Google Analytics sets cookies (named _ga and _ga_…) and receives your IP address and browser details. Google processes this for us and may do so outside Canada, including in the United States. We don't use it for advertising. Visit-level data tied to the analytics cookie is deleted after 2 months; we keep only aggregate counts that don't identify you. Choosing “Decline” later also deletes the analytics cookies. Your choice itself is remembered in your browser's local storage (cc_cookie, only on shiftskill.ca) for 6 months. You can change your choice at any time with “Cookie settings” at the bottom of the website, or by clearing your browser's data for shiftskill.ca.

Where your information is stored

Shiftskill and its backups are hosted in the AWS US East (Ohio) region. Our service providers process information outside Canada, which means it may be accessible to authorities under the laws of those countries:

• Amazon Web Services (United States): hosting, backups and email delivery.
• Anthropic (United States): AI drafting, only if it is released and an admin turns it on.
• Stripe (Canada and United States): payments.
• Sentry (United States): error reports, which may include the page address and technical details of the error.
• Cloudflare (United States): domain name service, hosting of the shiftskill.ca website, which processes visitors' IP addresses to deliver pages, and Turnstile, a bot check on the sign-up form, which processes your IP address and browser signals to tell people from automated sign-ups.
• Google (United States): our business email (Google Workspace), which holds messages you send to our addresses, and website analytics on shiftskill.ca, only with your consent.
• healthchecks.io and an uptime monitor: check that backups ran and that a public health page responds; they receive no personal information.

Each provider is bound by contract to protect the information and use it only to provide its service to us.

How long we keep it

• Workspace data: while the workspace is active. When a workspace closes or its plan ends without renewal, it stays available read-only for 30 days so it can be exported; we then delete it, and it leaves our backups within a further 35 days.
• People removed from a workspace: their training records are kept for the period the workspace sets (1 to 10 years, 7 by default), then their progress is deleted and their completion records are anonymized. A workspace admin can erase someone sooner, for example when that person asks. Their account is deleted once no workspace holds it. Erased data leaves our backups within 35 days.
• Free trial workspaces: when the 14-day trial ends without a paid plan, the workspace stays available read-only for 30 days so it can be exported, then it is deleted like any other closed workspace.
• Sign-ups whose email address is never confirmed: the account is deleted 7 days after sign-up.
• Contact requests and free trial sign-up details, including emails to our addresses: up to 24 months, unless you become a customer.
• Workspace audit log (admin and billing actions, sign-ins and failed sign-ins, exports, and who viewed training reports): 24 months (7 years on Business), and deleted with the workspace.
• Server logs: up to 30 days.
• Service usage counts per workspace (people active per day and at once, seats, storage), used to plan capacity: up to 400 days, and deleted with the workspace.

We may keep a copy longer only when it is needed to investigate a security incident or for a legal claim, and we delete it when that ends.

Workspace admins can export all of their data at any time from Settings.

How we protect it

All traffic is encrypted with HTTPS. Passwords are hashed, each workspace's data is kept separate, the database is not reachable from the internet, and encrypted backups are taken every night. Access to production systems is limited to the people who need it.

Your choices and rights

You can ask to see the personal information we hold about you, ask us to correct it, or withdraw your consent (which may mean we can no longer provide the service). Email privacy@lmssolutions.ca and we will respond within 30 days. If your request is about records in an employer's workspace, we will pass it to that organization and help them respond.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

If something goes wrong

If a breach of security safeguards affects information inside a customer workspace, we will tell that organization without undue delay, share what we know, and help it assess the risk and notify affected people and the Office of the Privacy Commissioner of Canada, as PIPEDA requires of the organization in control of the information. For information we are responsible for ourselves, if a breach creates a real risk of significant harm we will notify the people affected and report it to the Commissioner. We keep a record of every breach either way.

Children

Shiftskill is built for workplace training and is not intended for children under 16.

Changes to this policy

We will post any changes here and update the date above. For material changes, we will also email workspace owners at least 30 days in advance.

Contact

Our privacy officer can be reached at privacy@lmssolutions.ca.