Privacy policy
Last updated: November 5, 2026
This policy explains which personal data Digisphere Lab LLC processes, why, for how long, and how to exercise your rights. It covers this website (brandablelms.com) and the Brandable platform (app.brandablelms.com, the API and the plugin).
Data controller
Digisphere Lab LLC, 8206 Louisiana Blvd NE, Ste A #7833, Albuquerque, NM 87113, USA. Contact: contact@brandablelms.com.
The appointment of Digisphere Lab LLC's representative in the European Union (GDPR Article 27) is in progress. Their details will appear here. In the meantime, email us at contact@brandablelms.com.
This website, brandablelms.com
This website has no account, no form, no analytics and no third-party cookies. Its host, Vercel Inc., keeps technical logs (IP address, browser, requested page, date) to run and secure the site. These logs are kept for a few days, according to the host’s policy. Legal basis: our legitimate interest in providing a secure website.
A single cookie is set, and only if you switch languages: “lang”, which remembers your choice for 12 months. It serves no other purpose and does not require consent.
Data processed by the platform
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, password (stored as a hash) or Google or Microsoft identifier | Create and secure your account | Performance of the contract |
| Organization, members, invitations, connected Moodle sites (site address, environment) | Provide the service to your organization | Performance of the contract |
| Requests, structure of the pages involved, targeted element, attached images and fonts | Prepare the requested changes | Performance of the contract |
| Saved versions and history (Pro and Multi-site plans) | Keep your history and backups | Performance of the contract |
| Billing country, plan, credit usage, Stripe references | Bill you and apply your plan | Performance of the contract; legal obligations |
| Email address | Send service emails (verification, invitations, billing, retention notices) | Performance of the contract |
| Technical logs (identifiers, IP address for rate limiting) | Security and reliability | Legitimate interest |
Payment details (card, account) are entered directly with Stripe and Link, which process them under their own policies. We have no access to them.
Your learners’ data
Brandable does not need your learners’ data. The plugin sends the structure of the pages, stripped of personal information, and the element you point at, without personal data. If any personal information remained despite this cleanup, it would be deleted with the page context within 24 hours. For this data, Digisphere Lab LLC acts on behalf of your organization, which remains responsible for its Moodle.
Retention
- Page context, targeted element, attached images and fonts: deleted automatically within 24 hours.
- Session content (requests, summaries, changes) on the Free and Essential plans: deleted 7 days after the session’s last activity.
- On the Pro and Multi-site plans: session content and saved versions kept for your history, as long as your plan includes it.
- If your organization loses history (moving to a plan without it): kept for 30 days, with an email to the owner and the option to export everything, then session content and saved versions are deleted.
- Technical data about requests (status, durations, credits used): kept without the content of requests.
- Platform technical logs: 90 days at most.
- Account and organization: as long as the account exists. You can request its deletion at contact@brandablelms.com.
- Billing data: for the period required by applicable accounting and tax obligations.
Recipients and subprocessors
Your data is never sold, rented or used for advertising. It is accessible to our team, only as needed, and to our subprocessors, listed on the Subprocessors page.
The platform is hosted on Microsoft Azure, in the France Central region. Generation runs on Azure OpenAI in the European Union data zone; responses are not stored by Azure and are not used to train models.
Transfers outside the European Union
Some data may be processed outside the European Union, in particular by Digisphere Lab LLC, a company established in the United States, and by some subprocessors. These transfers are covered by the European Commission’s standard contractual clauses or by the EU–US Data Privacy Framework, as applicable.
Security
Traffic is encrypted, each site connects with its own revocable key, and logs contain no page content, names or email addresses. The Security and privacy page details these measures.
Your rights
You can request access to your data, its correction, erasure or portability, the restriction of its processing, or object to processing based on our legitimate interest. Email us at contact@brandablelms.com: we reply within one month.
You can also lodge a complaint with the data protection authority of your country (in France, the CNIL: cnil.fr).
Changes
We update this policy when our processing changes. The last update date appears at the top of the page; for any material change, we notify organization owners by email.