Privacy Policy | All-in-One LMS

Last updated: 4 October 2026

This Privacy Policy explains how All-in-One LMS ("we", "us", "our"), based in India, collects, uses, shares and protects personal data when you visit allinonelms.com (the "Website"), contact us, request an estimate, subscribe to our newsletter or create a contributor account. It does not cover the learning platforms we build or operate for clients; those are governed by our agreement with each client.

1. Who is responsible for your data

All-in-One LMS is the data controller (under the GDPR and UK GDPR) and the data fiduciary (under India's Digital Personal Data Protection Act, 2023) for personal data processed through this Website.

For any privacy question, request or grievance, contact us at privacy@allinonelms.com. This mailbox is monitored by the person responsible for data protection and grievance redressal at All-in-One LMS.

2. Personal data we collect

2.1 Information you give us

Enquiry, quote and audit forms: your name, business email, and optionally your phone number, company, country, website URL, the LMS you use, project details, budget range, timeline and any file you attach.
Cost calculator: the options you select and the resulting estimate. If you ask for a detailed estimate, also your name, email and company.
Newsletter: your email address and your confirmation (we use double opt-in).
Contributor (guest author) accounts: your name, email, password (stored only as a secure one-way hash), profile details such as job title, bio, links and photo, and the articles and files you submit.
Communications: emails and messages you exchange with us, including meeting notes about your project.

Please do not send us sensitive personal data (for example health or financial account details) or other people's personal data through our forms unless you are entitled to share it.

2.2 Information collected automatically

Security and anti-spam data: when you submit a form or sign in, we record your IP address, browser user-agent and the time, and we use rate limits, a hidden honeypot field and time checks to block abuse. Rate-limit records are stored only as one-way hashes and expire automatically.
Our own (first-party) analytics, only if you accept analytics cookies: the pages you view, the referring website, campaign parameters in the link you followed (UTM tags and ad click IDs such as gclid, fbclid, msclkid), your approximate location (country, region and city, worked out from your IP address at the moment of your visit using a database kept on our own server; the address itself is not saved), device type, browser and operating system, scroll depth, where you click on a page (used in aggregated heatmaps), actions such as CTA clicks and form submissions, and page-speed measurements. We use a random visitor identifier stored in your browser, not your name or email. Our analytics does not store your IP address.
Your journey to an enquiry: if you have accepted analytics cookies and then submit a form, we link your enquiry to that browser identifier so we can see which pages and campaigns led to it.
Third-party tools, only with your consent: Google Analytics and Google Tag Manager (analytics) and the Meta Pixel and LinkedIn Insight Tag (marketing). These providers collect data such as your IP address, browser identifiers and the pages you visit. See our Cookie Policy.
Bot protection: our forms may use Cloudflare Turnstile, which processes signals such as your IP address, TLS fingerprint and user-agent to tell humans from bots. Cloudflare states that it cannot directly identify individuals from these signals.

2.3 Information from other sources

We may receive your business contact details from a colleague who introduces you, from a partner, or from public professional sources such as your company website or LinkedIn profile when you have contacted us or we are preparing for a meeting you requested.

3. How and why we use your data

Purpose	Data used	Legal basis (GDPR / UK GDPR)
Responding to your enquiry, preparing estimates and proposals, and providing our services	Form, calculator and communication data	Steps at your request before entering a contract, and performance of a contract
Prioritising and following up on business enquiries (including an internal lead score based on the details you provide and, if you accepted analytics cookies, the pages you visited)	Form data, analytics journey	Legitimate interests in running our business
Keeping the Website secure and preventing spam, fraud and abuse	Security data, Turnstile signals	Legitimate interests; legal obligations
Understanding and improving the Website and our content	First-party analytics; Google Analytics	Consent
Measuring and improving our advertising	Meta Pixel, LinkedIn Insight Tag, campaign parameters	Consent
Sending our newsletter	Email address	Consent (you can unsubscribe at any time)
Running the contributor programme: reviewing, editing and publishing articles with author credit	Account and submission data	Performance of our agreement with you (the contributor terms)
Meeting legal, tax and accounting obligations and defending legal claims	Relevant records	Legal obligation; legitimate interests

Under India's DPDP Act, we process digital personal data either with your consent or for legitimate uses permitted by the Act, such as when you voluntarily provide data for a specific purpose, for example to receive a reply to your enquiry.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. The internal lead score only helps us decide which enquiries to answer first.

We do not sell your personal data for money. We share it only with:

Service providers who process data on our behalf, under contracts that require them to protect it: our web hosting provider, our email delivery provider, our backup storage provider (backups are encrypted before they leave our server), Cloudflare (network services and Turnstile bot protection), and, where you have consented, Google (Analytics / Tag Manager), Meta and LinkedIn.
Professional advisers such as lawyers and accountants, under confidentiality duties.
Authorities where the law requires it, or to protect our rights, users or the public.
A buyer or successor if our business is reorganised, merged or sold, subject to this Policy.

Meta and LinkedIn may use data from their tags for their own purposes as independent controllers, as described in their privacy policies. These tags load only if you accept marketing cookies.

5. International transfers

We are based in India, and some of our service providers operate in other countries, including the United States and the European Union. When we transfer personal data from the EEA, UK or elsewhere to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum) offered by our providers. Transfers of personal data from India are made in line with the DPDP Act and any restrictions notified under it.

6. How long we keep data

Enquiries that do not become projects: deleted automatically 24 months after the last activity, including any files you attached. Enquiries flagged as spam are deleted after 30 days.
Client and contract records: for the duration of the relationship and afterwards for as long as tax, accounting and legal limitation periods require.
Raw analytics data: 13 months. Click positions used for heatmaps: 6 months. After that only aggregated statistics that do not identify anyone are kept.
Newsletter: until you unsubscribe, after which we keep only a suppression record so we do not email you again.
Contributor accounts: until you ask us to close your account. Published articles stay online under the licence you granted, unless we agree to remove them.
Security data: the IP address and browser details recorded with form submissions are removed after 90 days. Records of sign-in attempts are deleted after 90 days, and application error logs after 30 days.
Backups: encrypted database backups are rotated automatically and kept for up to 12 months.

7. How we protect data

We use encryption in transit (HTTPS), encrypted backups, encryption of stored secrets, one-way hashing of passwords, least-privilege access, two-factor authentication for staff accounts, audit logs and regular updates. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify affected people and the authorities where the law requires it.

8. Your rights

You can contact us at privacy@allinonelms.com to exercise your rights. We will verify your request and reply within one month (or sooner where the law requires). You will not be charged, and we will not treat you differently for exercising your rights.

Everyone

Ask for a copy of the personal data we hold about you, or ask us to correct, update or delete it.
Withdraw consent at any time, for example with "Cookie preferences" in the footer or the unsubscribe link in any newsletter. This does not affect processing that took place before you withdrew.

You also have the right to restrict processing, to data portability, and to object to processing based on legitimate interests, including profiling, and to direct marketing at any time. You may lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to resolve your concern first.

India (Digital Personal Data Protection Act, 2023)

As a data principal, you have the right to obtain a summary of the personal data we process and the processing activities, to correct, complete, update and erase your data, to have your grievances addressed, and to nominate another person to exercise your rights in the event of your death or incapacity. Please send grievances to privacy@allinonelms.com. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

United States, including California

If and to the extent the California Consumer Privacy Act, as amended by the CPRA (or a similar US state law), applies to us:

Categories collected in the last 12 months: identifiers (name, email, IP address, online identifiers), commercial and professional information (company, role, project details), internet or network activity (pages viewed, interactions), and approximate geolocation (country, region and city). We do not collect sensitive personal information for the purpose of inferring characteristics about you.
Sources and purposes: as described in sections 2 and 3.
Sale or sharing: we do not sell personal information for money. When you accept marketing cookies, the Meta Pixel and LinkedIn Insight Tag may be considered "sharing" for cross-context behavioural advertising. You can opt out at any time by turning off marketing in "Cookie preferences" in the footer. We honour Global Privacy Control (GPC) signals as an opt-out of sharing for that browser.
Your rights: to know, access, correct and delete your personal information, to opt out of sale or sharing, and not to be discriminated against for using these rights. An authorised agent may submit a request for you with your signed permission. We will ask for information to verify the request.

9. Children

This Website is intended for businesses and professionals. It is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.

10. Links to other websites

Our Website links to other websites, including our related sites LMS Advisor and LifterLMS Expert and third-party documentation. Their privacy practices are their own. Please read their policies.

11. Changes to this Policy

We may update this Policy when our practices or the law change. We will change the "Last updated" date above and, for significant changes, show a notice on the Website or ask for your consent again where required.

12. Contact

All-in-One LMS, India
Email: privacy@allinonelms.com
Website: allinonelms.com/contact