Privacy Policy

1. Our role

Controller. We act as a controller for personal information we collect directly to operate our website, Marketplace fulfilment, licensing, catalogue, accounts, support, communications, security, and business operations.

Processor or service provider. Where we process information on a customer's behalf—for example, support files, configuration records, prompts, report drafts, or technical metadata the customer chooses to submit—we act under the customer's instructions and applicable agreement. The customer remains responsible for its LMS environment and notices to LMS users.

2. Information we collect

Depending on how you use the services, we may collect:

• Contact and organisation data: name, work email address, telephone number, organisation, country, role, and communications.
• Marketplace and transaction data: Moodle Marketplace customer, order, plugin, price, and purchaser identifiers; price option; currency; invoice, refund, payment, and subscription status; and relevant timestamps.
• Licence and site data: licence key, active plan, trial or paid entitlement status and expiry, Moodle site URL, Moodle and plugin versions, configured licence mode, and identifiers of installed lenArys reports or apps.
• Support data: messages, screenshots, exports, report definitions, prompts, SQL snippets, logs, and other files or technical details you choose to provide.
• Website and security data: IP address, browser and device information, requested pages, timestamps, referral data, consent preferences, session data, and logs used for delivery, reliability, rate limiting, and abuse prevention.

Please do not send personal or sensitive LMS data in a support request unless it is necessary and you are authorised to do so. Redact learner information, credentials, and secrets whenever possible.

3. Sources of information

We collect information directly from you; automatically from your browser or a connected site running Moodle; from your organisation's authorised users; from Moodle Marketplace and Stripe in connection with a purchase; and from service providers that help us operate, secure, and support the services.

4. How we use information

We use personal information to:

• provide and manage the included 30-day post-installation trial, activate paid entitlements, and maintain and secure the services;
• fulfil Marketplace purchases and manage plans, entitlements, updates, invoices, cancellations, and refunds;
• validate licences and determine available catalogue items and feature flags;
• respond to support, contact, and implementation requests;
• monitor reliability, troubleshoot errors, prevent fraud and abuse, and enforce our Terms of Use and Sale;
• communicate service, security, billing, support, and product information; and
• comply with legal, tax, accounting, audit, and dispute-resolution obligations.

Where applicable law requires a legal basis, we rely on performance of a contract, legitimate interests in operating and securing the services, compliance with legal obligations, consent, or the customer's documented instructions, depending on the context.

5. LMS learning data

The plugin may process user, course, activity, completion, grade, visit, learning-time, report, schedule, access, audit, and configuration data inside the customer's LMS environment. Reports and schedules are intended to run inside that environment. Customers control their LMS site, users, permissions, data sources, report access, exports, AI settings, and retention.

The lenArys licence API does not need LMS learner records, course content, grades, report result rows, scheduled-report attachments, or learning-time records to create or validate a trial or paid entitlement. The API may receive the limited site, software, licence, plan, and catalogue metadata described above.

6. AI-assisted features

AI-assisted report generation is available on Moodle 4.5 or later and requires a Moodle AI provider configured and controlled by the customer with the Generate text action enabled. Information submitted to that provider is governed by the customer's agreement with the provider. lenArys does not select the customer's provider or require LMS learner data for licence validation.

Generated definitions, SQL, explanations, or insights should be reviewed by authorised users before installation, distribution, or reliance.

7. Moodle Marketplace and Stripe

Moodle Marketplace provides the listing, checkout, subscription-management, invoicing where enabled, and download-access platform. Stripe processes payments through the connected lenArys Stripe account. Moodle and Stripe process information under their own terms and privacy notices.

lenArys may receive purchaser contact details, Marketplace identifiers, the selected price option, billing status, currency, transaction references, invoice and refund status, subscription dates, and related event data needed for fulfilment, support, accounting, tax, fraud prevention, and dispute handling. We do not receive or store full payment-card numbers.

8. How we disclose information

We may disclose information to service providers that support hosting, content delivery, security, email, support, payment processing, accounting, monitoring, licensing, Marketplace fulfilment, and customer communications. They may process information only to provide services to us or as otherwise permitted by law.

We may also disclose information when required by law; to protect rights, safety, and security; to investigate abuse or fraud; in connection with a merger, financing, acquisition, reorganisation, or sale of assets; or at your direction or with your consent.

We do not sell personal information or LMS learning data. We do not use LMS learning data for cross-context behavioural advertising.

9. Cookies and local storage

The website uses browser storage to remember cookie preferences. It may also use strictly necessary session or security technologies to deliver forms, retain language and consent choices, protect the site, and prevent abuse.

Optional analytics, functional, or marketing technologies will be used only where configured and permitted by your consent or applicable law. You can reject optional categories in the cookie controls and can clear stored preferences through your browser. Blocking necessary technologies may prevent parts of the site from working correctly.

10. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy. Retention depends on the type of information and may include the active customer relationship plus periods required for support, security, backup, audit, tax, accounting, legal claims, and dispute resolution.

When information is no longer required, we delete or de-identify it where reasonably practicable. Customer-controlled LMS data remains subject to the customer's own retention settings and processes.

11. Security

We use administrative, technical, and organisational safeguards designed to protect information, including access controls, transport security, logging, and data minimisation. No method of transmission or storage is completely secure. Customers must also maintain appropriate LMS, hosting, credential, backup, access-control, and security practices.

12. International processing

Information may be processed in the United States and other countries where we or our service providers operate. Where required, we use contractual protections or another lawful transfer mechanism for international transfers.

13. Your choices and rights

Depending on your location, you may have rights to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or information about how your personal information is processed. You may also have the right to appeal a decision or complain to a privacy regulator.

If your request relates to LMS learning data controlled by a customer, contact that customer first. We may direct the request to the customer because it controls the LMS environment and determines how those records are processed.

To exercise a right, email [email protected]. We may need to verify your identity and authority before completing the request. Authorised agents may submit requests where permitted by law.

14. Children and learners

Our website, Marketplace listing, licensing services, and support resources are intended for organisations and authorised administrators, not for children to use directly. Customers are responsible for learner notices, permissions, legal bases, parental consent where required, and use of LMS data in their environment.

15. Changes to this Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new effective date. We may also provide notice of material changes through the website, service, or another reasonable channel.

16. Contact

Privacy contact: Lenarys, LLC, trading as lenArys
Email: [email protected]
Web: Contact Us