Privacy
Last updated
Short version: we keep as little as we can, for as short a time as we can, and the learner data inside your Moodle backup never reaches the package we build you.
Who we are
mbz2scorm is operated by [MEDIAQUEST LEGAL ENTITY NAME] (“we”), of [REGISTERED ADDRESS]. For anything in this policy, write to [PRIVACY CONTACT EMAIL].
We are the data controller for information about you — your email address, your payments, your conversion history. See the next section for why your learners’ data is a different matter.
The part that matters most: learner data in your backup
A Moodle course backup taken with user data included carries real personal information about your learners — names, enrolments, grades, and any certificates they were issued.
None of it ever reaches the SCORM package. The converter reads course content and ignores user data entirely. But if you upload such a backup, that data sits on our storage until the file is deleted.
For that data we act as a processor, not a controller. You decide what is in the file; we only do what is needed to convert it, and never anything else with it. If you are subject to the UK or EU GDPR and need a data processing agreement, ask and we will provide one.
The better answer is for it not to be there at all. Our export guide shows you the boxes to untick so the data never leaves your Moodle. We detect it on upload and say so loudly if we find it.
What we collect
| What | Why | Basis |
|---|---|---|
The .mbz file you upload, and its contents |
To read the course and build a package | Performance of a contract |
| An email address, if you give one | To tell you the conversion is ready or has failed | Performance of a contract |
| Billing email and payment status, from Stripe | To take payment and issue receipts | Performance of a contract; legal obligation for records |
| A record of each conversion — course name, your settings, the report | So you can see your history and rebuild a course you have already paid for | Legitimate interests |
| Basic request logs and error reports | To keep the service working and diagnose failures | Legitimate interests |
We do not require an account to convert a course. A job gets an unguessable link that works without a login, and giving us an email is optional — it is a delivery address, not a registration.
How long we keep it
| What | Kept for |
|---|---|
Your uploaded .mbz | 7 days, then deleted automatically |
| The SCORM package we build | 30 days, then deleted automatically |
| The conversion record (name, settings, report — no course content) | Until you ask us to delete it |
| Payment records | As long as tax and accounting law requires |
If a conversion fails on a backup we cannot read, we may ask permission to keep that file longer so we can fix the cause. We will not keep it without asking.
Who else touches it
We use these providers, and no others, to run the service:
| Provider | For |
|---|---|
| Cloudflare | Website hosting and file storage |
| Supabase | Database — job records and settings |
| Fly.io | Running the conversion itself |
| Stripe | Payments. We never see or store your card details |
| Resend | Sending the “your conversion is ready” email |
We do not sell your data, share it for advertising, or give it to anyone else except where the law requires it.
We do not train any machine learning model on your course content, and we do not allow our providers to.
Where it is
Our servers are in the United States. If you are in the UK or EU, that means your data is transferred outside your region; we rely on Standard Contractual Clauses for that transfer. If your institution requires processing to stay within the EU, contact us before uploading anything — do not upload first and ask afterwards.
Cookies
The marketing pages set no cookies and carry no analytics or advertising trackers. The converter stores your last choices in your own browser so you are not asked twice; that never leaves your device. Stripe sets its own cookies during checkout, which are necessary for payment to work.
The SCORM preview tool uploads nothing at all. Packages you open there are unpacked inside your browser and discarded when you close the tab.
Your rights
You can ask us for a copy of what we hold about you, to correct it, to delete it, to restrict what we do with it, or to object to it. Write to [PRIVACY CONTACT EMAIL] and we will respond within 30 days.
Because we do not require accounts, tell us the job link or the email address you used so we can find the right records.
If you are in the UK or EU and think we have handled your data badly, you can complain to your national supervisory authority. We would rather you told us first.
Changes
If we change this policy in a way that matters, we will say so here and update the date at the top. We will not apply a change retroactively to data we have already deleted or promised to delete.