Privacy policy

Micro (microlms.com) helps Litmos administrators manage people and courses in bulk and understand how learning is going. It's run by Lupchoo Ltd, a company registered in New Zealand ("we", "us"). This policy explains what we collect, why, and the choices you have. Questions go to team@microlms.com.

The short version

• Micro is a business tool. The people who sign in are Litmos administrators at our customers.
• When an organisation connects its Litmos site, we keep a copy of its Litmos data (people, teams, courses and progress) so Micro can report on it and make changes. That data belongs to the organisation, and we only use it to run Micro for them.
• We never sell personal information, show ads, or use advertising or analytics cookies.
• Nothing changes in Litmos unless an administrator reviews it and presses Apply.

Two kinds of information

About the people who use Micro

When you sign in, we keep your email address and name, which workspace you belong to, and your role. We don't have a password for you: we email a one-time sign-in code, store only a scrambled (hashed) version of it, and it expires after 15 minutes. We set a single cookie that keeps you signed in, and with each session we store the IP address and browser it came from, so we can spot misuse.

We also keep a history of the changes each person makes in Micro, so your team can see who did what.

From your Litmos site

When an Account Owner connects their organisation's Litmos site, Micro uses its API key to copy in and regularly refresh:

• people: names, email addresses and usernames, job titles, company or department, manager, city and country, access level, whether they're active, when they joined and when they last logged in, and any custom fields;
• teams and who is in them;
• courses, modules and learning paths;
• assignments and progress, including completion dates, scores and attempts.

For this information, the organisation that connected Litmos is in control. It decides what's in Litmos and what Micro does with it, and we process it on their behalf. Learners never use Micro and we don't contact them. If you're a learner and have a question about your information, please contact your employer or training provider. We'll help them answer it.

The Litmos API key is encrypted before it's stored and is only ever used on our servers to talk to Litmos.

How we use information

• To run Micro: showing reports and insights, and making the changes administrators approve.
• To sign people in and send the emails Micro needs to send: sign-in codes, invitations, and the weekly access review summary (which owners and admins can turn off).
• To keep Micro secure and working, and to fix problems.
• To contact account holders about their account and billing. We don't send marketing email without asking.

AI assistants

Administrators can connect an AI assistant, such as Claude or ChatGPT, to their workspace. It's an optional connection that they approve and can disconnect at any time. When they ask the assistant a question, the answer Micro gives it can include information from their Litmos data, and the assistant's provider handles that under the administrator's own agreement with them. Assistants can only draft changes; a person still has to approve them.

Who we share it with

We don't sell personal information. We use a few providers to run Micro, and they process data only on our behalf:

• Hetzner Online hosts our servers and database, in Germany.
• Cloudflare stores encrypted database backups.
• Postmark sends our emails.
• New Relic monitors Micro's performance and errors, which includes request and log details.
• Simple Analytics counts page views for us without cookies and without collecting personal information.
• Google Fonts serves the typeface on our pages, so your browser asks Google for the font files.
• Our payment provider handles billing for subscriptions.

We also exchange data with each customer's own Litmos site, at their request. We may disclose information if the law requires it, or to protect people from harm.

Information is stored and processed outside New Zealand. We use providers whose privacy and security safeguards are comparable to those required by New Zealand's Privacy Act 2020.

Keeping and deleting data

We keep a workspace's data while it has an active subscription, refreshing it from Litmos as it changes. If an organisation stops using Micro, or asks us to delete its workspace, we delete its Litmos data and API key within 30 days. Copies can remain in backups for up to 30 days after that, until those backups expire. Sign-in codes are deleted once used or expired.

The demo workspace contains only a fictional company.

Your rights

You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it. Email team@microlms.com and we'll reply within 20 working days. Where the information came from an organisation's Litmos site, we'll work with that organisation to respond. If you're not happy with how we handle your request, you can complain to the New Zealand Privacy Commissioner, or to your local data protection authority.

Security

Everything goes over encrypted connections. Litmos API keys are encrypted at rest. Sign-in uses one-time codes, and access to our servers is restricted. No system is perfectly secure. If a breach puts information at risk, we'll tell affected customers and the Privacy Commissioner as the law requires.

Changes

If we change this policy, we'll update the date above. If a change is significant, we'll tell account holders before it takes effect.

Contact

Lupchoo Ltd (operator of Micro), New Zealand. team@microlms.com