Privacy Policy

Last updated: October 3, 2026

MentoringU ("we," "us," or "our") operates LMS Genie™, part of the Genie Suite™ — browser-based tools for LMS administrators and instructional designers, available at lmsgenieapp.com and the LMS Genie™ subscriber web app. This policy explains what data we handle, how it is used, and how it is protected.

      The short version: Your LearnUpon API key is encrypted and used only for the few seconds a tool is actively running — never kept in readable form and never visible to us. We don't retain the rows you process or your LMS content; we keep only a metadata activity log so you can see your run history. Our free browser tools run entirely on your device.
    

1. What Data We Handle

Free browser tools (lmsgenieapp.com)

Tools such as Embed Genie, SCORM Genie, Button Creator, and Email Customizer run entirely in your browser. What you enter never leaves your device and is not transmitted to us or any third party.

The subscriber web app

When you subscribe, you sign in to the LMS Genie™ web app (hosted on Supabase and Netlify). Here is what the app handles:

Data	How it's used	Where it lives
Your email address	Passwordless sign-in and account management	Stored in our database (Supabase) while your account is active
Your LearnUpon API key & subdomain	Authenticate requests to your LMS while a tool runs	Encrypted at rest; decrypted only inside a secure server function for the duration of a run; never stored in your browser and never visible to MentoringU staff
Rows you submit to a tool (e.g. course IDs, emails)	Sent to your LMS to perform the operation you requested	Processed transiently during the run; not retained afterward
Activity log	Show your run history and help with troubleshooting	Metadata only — tool name, run mode, row counts, and per-row status labels (such as a course name or email). No credentials or full payloads. Retained about 90 days
LMS API responses	Compute the per-row results shown to you during a run	Not stored — used transiently

2. What We Do NOT Do

We do not retain the rows you process or your LMS course/user content.
We do not keep your LearnUpon API key in readable form, and our staff cannot view it.
We do not build advertising profiles or show ads.
We do not sell, rent, or share your data.
We never see or store your payment card details — those go directly to Stripe.

3. Service Providers

We rely on a small set of trusted providers to run the service. Each processes data only to provide its function to us:

Supabase — authentication, database, and the secure server functions that run each tool (US-hosted). Privacy policy.
Netlify — hosting for our site and web app. Privacy policy.
Stripe — subscription billing and payment processing; we never store card data. Privacy policy.
Sentry — error monitoring to help us fix bugs; personal data (emails, IDs, row content) is scrubbed before it reaches Sentry. Privacy policy.
Google Fonts — web-font delivery.
Your LMS (LearnUpon) — tools send requests directly to your LMS instance using your own API key; we do not proxy or log the contents of those requests.

4. Security

Your LearnUpon API key is encrypted at rest (AES-256-GCM) and decrypted only inside a secure server function for the duration of a run.
All communication is over HTTPS.
Sign-in is passwordless (email magic link), and database access is protected by row-level security so each organization can reach only its own data.
Payments are handled entirely by Stripe — we never see or store card details.
We review our code and infrastructure regularly.

5. Data Retention & Deletion

Account data (email, subscription status) is retained while your account is active.
Your API key remains until you change or remove it under Settings in the app.
Activity-log entries (metadata only) are retained about 90 days.
Row data you submit is not retained beyond the run.
To delete your account and associated data, contact us and we will remove it within 30 days.

6. Children's Privacy

Our tools are designed for professional use by adults. We do not knowingly collect data from anyone under the age of 13. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

7. International Users

We operate from the United States, and our service providers (Supabase, Netlify, Stripe) process data in the US. If you access our tools from outside the US, you consent to your data being processed in the US.

8. Changes to This Policy

We may update this policy from time to time. Changes are posted here with a new "last updated" date. For material changes affecting subscribers, we will notify you by email.

9. Contact Us

Questions about this policy or your data:

Email: support@mentoringu.org
Website: mentoringu.org