Allure LMS Privacy Policy

1. Who we are

“Allure”, “we” and “us” means Vig Solutions LLC, a Florida limited liability company, based in Lake Nona, Orlando, Florida. We make these products:

• Allure Account: sign-in, organisation and subscription management at allureplatform.com.
• Allure Connect: course hosting, delivery and learning measurement for organisations.
• Allure LMS: a learning management system for schools, employers and training providers.
• Allure Create: a course authoring tool.
• Allure Training OS: portfolios and course sharing for instructional designers and trainers.

This policy covers Allure LMS and its website, www.allurelms.com. Part 2 adds detail specific to Allure LMS. If Part 2 and Part 1 differ, Part 2 wins.

2. Our roles

If you are a learner in an organisation’s workspace, that organisation controls your learning records. Send most requests to it first. We will help it respond. For the Allure Skill Graph you can also come to us directly (section 9).

3. What we collect

You give us: name, email, password or sign-in provider details, organisation and role, billing contact and address, tax ID if you give one, messages to support, and the content you upload or create.

Created when you use the products: course launches, sessions, progress, scores, completions, xAPI statements, assessment results, teacher-approved evidence, skill tags, role requirements, reports, webhook and integration records, and API usage.

Organisations give us about learners: identifiers they choose to send (such as an email or an internal id), roles, cohort and class membership and, in Allure LMS, the learner’s age band and any authorisation evidence reference.

Collected automatically: IP address, device and browser details, pages used, error logs, cookies (section 11) and, if you turn on notifications in a mobile app, a push notification token for your device.

Derived by us: skills a course teaches (partly by AI; section 5), skill scores, and, from 9 November 2026, the pseudonymised and aggregated data in the Allure Skill Graph.

We ask organisations not to send special-category data (such as health data) unless we have agreed it in writing.

4. How we use data and our legal bases

The legal bases below apply under EU and UK law. Other laws may use different terms.

We do not use learning records or course content to train general-purpose AI models. We do not use them for advertising. We do not sell personal information.

5. AI in our products

• Skill indexing. When a course is uploaded to or published through Allure Connect, an AI model suggests which skills it teaches. It sees only activity titles and activity types, not learner data. We use Anthropic’s Claude through Vercel AI Gateway. If the AI route is unavailable or restricted, a keyword method on our own platform is used instead.
• AI features in Allure LMS. Some builder features use AI. Part 2 and section 7 say which provider each feature uses.
• Our AI providers may not train their models on your data.
• AI output can be wrong. Check it before you rely on it.

6. Who we share data with

• Service providers who run parts of our products for us, under contracts that limit their use (section 7).
• Your organisation, if you are a learner or team member in its workspace.
• Platforms your organisation connects, such as the learning platform that launched a course, at the organisation’s direction.
• Other Allure products, where you or your organisation use more than one. For example, Allure LMS delivers courses and sends skill evidence through Allure Connect.
• Other organisations, only as benchmarks built from at least 5 learners and at least 3 organisations. Never identifiable data.
• Authorities or others when the law requires it, or to protect rights, safety and our products.
• A buyer or successor if we are involved in a merger or sale. This policy keeps applying to the data.

7. Service providers (subprocessors)

Organisations can ask for our full register, with regions and transfer terms, at info@allurelms.com. We give organisations 30 days’ notice before adding a subprocessor that handles their workspace data.

Data processing addendum. Business customers can ask for our data processing addendum (DPA), including Standard Contractual Clauses for EU, EEA and UK data, at info@allurelms.com.

8. International transfers

We are based in the United States. Our main systems run there. When we move personal data from the EU, EEA, UK or Switzerland, we use approved safeguards, such as Standard Contractual Clauses, the UK Addendum, or a provider’s certification under the EU-US Data Privacy Framework. Some organisations can ask for EU data storage under separate terms.

9. Your rights

Depending on where you live, you can ask to:

• see the personal data we hold about you and get a copy;
• correct it;
• delete it;
• restrict or object to how we use it;
• move it to another service; and
• withdraw consent, where we rely on consent.

Objecting to the Allure Skill Graph (EU, EEA, UK). From 9 November 2026, when the Allure Skill Graph starts, we honour every objection. We stop adding your records and delete your learner-level records. Anonymous totals already published stay.

US state rights. Residents of California and other US states with privacy laws can ask to know what personal information we collect, use and disclose, and to get a copy, correct it or delete it. We collect the categories in section 3, from the sources and for the purposes in sections 3 and 4, and disclose them only as section 6 describes. We keep them for the periods in section 12.

We do not sell or share personal information. We do not sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information to infer characteristics about you. So there is nothing to opt out of, but we still treat a Global Privacy Control signal as a request to opt out. We do not knowingly sell or share the personal information of anyone under 16.

You can use an authorised agent; we may ask the agent for proof of authority and ask you to confirm your identity. If we turn down your request, you can appeal by replying to our decision or emailing info@allurelms.com with the subject line “Appeal”. We answer appeals within the time the law sets. We will not treat you differently for using your rights.

How to ask. Email info@allurelms.com or use our privacy request form at www.allurelms.com/privacy/request. We may need to confirm who you are. We answer within the time the law sets. If your organisation controls the data, we will pass your request to it and help it respond.

You can also complain to your data protection authority.

10. Children

• Allure Account, Allure Connect, Allure Create and Allure Training OS are for adults aged 18 or over.
• Allure LMS can be used by schools and other organisations with learners under 18. The organisation must record each learner’s age band. Learners under 13 can only be invited with recorded parental consent evidence, in a school-managed workspace. See section B4 and our Terms, section A3.
• Learners under 18, or with no recorded age band, count only in totals in the Allure Skill Graph.
• If you think a child has given us data without the right permission, email info@allurelms.com and we will delete it.

11. Cookies and similar technologies

Allure LMS uses only cookies and browser storage it needs: to sign you in and keep your session secure (set by Clerk, our sign-in provider), to remember your workspace and display preferences, and to keep unsaved course drafts safe in your browser. Allure LMS does not use advertising cookies or third-party analytics cookies. Courses delivered through Allure Connect may set their own first-party cookie so a course keeps your place. Blocking needed cookies may stop sign-in or courses from working.

12. How long we keep data

• Account and workspace data: while the account is active.
• When you delete your account: see section B5.
• After a workspace closes: the organisation has 30 days to export. Then we delete or anonymise, apart from records the law requires us to keep (such as invoices) and encrypted backups that expire on schedule. If a backup is restored, we re-apply deletions.
• Allure Skill Graph, from 9 November 2026: pseudonymous learner-level records for up to 5 years from the event, then reduced to totals; learner-level records from a closed workspace reduced to totals and deleted within 12 months of it closing; learner-level records deleted within 30 days of an erasure request or objection; our record of which terms applied when data entered the graph for 6 years, as legal evidence. Anonymous totals and benchmarks are kept indefinitely.
• Allure LMS sets a shorter period for learners under 13 (section B5).

13. Security

We use encryption in transit, access controls that keep each organisation’s workspace separate, scoped API keys, redacted logs and audit trails. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

14. Changes

We will post changes here and update the date. For material changes, we will tell account holders and organisations by email or in the product at least 30 days before the change applies.

B1. What Allure LMS collects

B2. How it is used

To run the service for the customer: deliver courses, record progress, let teachers review work, produce reports, keep the service secure and answer support requests. Also, from 9 November 2026 and within the limits in Terms, section A6, to feed the Allure Skill Graph.

We do not use learner data for advertising. We do not sell it. We do not use it to train general-purpose AI models.

B3. Who sees it

• The customer’s authorised staff, by role. Private community groups are visible only to their members.
• Allure Connect, for course delivery and skill evidence.
• Our service providers (see section 7).
• Other organisations: only benchmarks, never identifiable data.

B4. Children

See Terms, sections A3 to A6. In short: every learner has an age band. Under-13s need parental consent evidence in a school-managed workspace. Everyone under 18, and anyone with no age band, counts only in totals in the Allure Skill Graph.

B5. Retention

We keep workspace data for as long as the customer’s contract runs, or as the customer’s retention settings say. Then the customer has 30 days to export, after which we delete or anonymise it. For under-13 data we follow a written retention policy: we delete it within 90 days of the learner leaving the workspace or the authorisation expiring, unless the school instructs otherwise.

Deleting your account. You can delete your account yourself, including from inside a mobile app. When you do, we erase it from every Allure LMS workspace you belonged to. We delete your profile, preferences, devices and notifications, private documents, coach notes about you and your blocks. We keep learning records such as completions and certificates only under a random code, with free text removed, so the organisation’s reports stay correct without identifying you. Your posts, comments and messages lose their text and your name. Security audit logs keep only an internal account code. If a legal hold applies, we stop your access at once and keep the data only for as long as the hold requires.

B6. Rights

Learners and parents should contact the customer, or use the request form. We help the customer respond. From 9 November 2026, learners in the EU, EEA and UK can object to the Allure Skill Graph directly with us at info@allurelms.com.