Skip to main content
LMS Plugin Hub

Privacy Policy

Last updated August 10, 2026

Summary

This Privacy Policy explains what personal data LMS Plugin Hub collects, what we use it for, who we share it with and what rights you have over it. It is written in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and the guarantee of digital rights (LOPDGDD).

The service is free: we sell nothing, process no payments and do not use your data for advertising.

Data controller

Studio LXD, S.L. — Tax ID B24941411. Avenida Menéndez Pelayo, 36, 3.º, D. 28007 Madrid, Spain. [email protected]. Further identifying details in the Legal notice.

Data we collect

  • Account data — name, email address, preferred language and, if you add one, a profile picture. You can register with an email and password or through GitHub or Google; in that case we receive your name, email, profile picture and identifier on their platform.
  • Technical access data — IP address and user agent (the browser and operating system your device reports). These are recorded on your active sessions and sign-in history — both visible from your account — when you accept the terms, and in the audit log of sensitive actions.
  • Content you publish — the plugins you upload, their versions, descriptions and screenshots. This content is public by its very nature, along with your name as its author.
  • Reviews and reports — the rating and text of your reviews, which are public, and the reason and details of any reports you file, which only moderators and the reported plugin's author can see. We never tell an author who reported their plugin.
  • Notifications and their preferences — the history of alerts we send you and the channels you have enabled.
  • Contact form data — name, email address and the content of your message, if you write to us.
  • Cookies — see our Cookie Policy.

You can browse the catalog and download plugins without registering. An account is only needed to publish, review or report.

Legal basis for processing

| Purpose | Legal basis | |---|---| | Account, publishing plugins, reviews | Performance of a contract (Art. 6(1)(b) GDPR) | | Transactional service messages | Performance of a contract | | Security, abuse prevention and moderation | Legitimate interest (Art. 6(1)(f) GDPR) | | Audit log and acceptance of the terms | Legitimate interest and legal obligation | | Contact form | Consent (Art. 6(1)(a) GDPR) | | Analytics cookies | Consent |

How we use your data

  • To run the service: manage your account and list your plugins in the catalog.
  • To validate published plugins automatically and tell you the outcome.
  • To moderate the catalog: handle reports, take down content that breaks the rules, and tell the author the decision and its reasons.
  • To notify you of what affects you (validations, reports about your plugins, security alerts on your account).
  • To protect the site from abuse: rate limits, bot verification and an audit trail of sensitive actions.
  • To answer your support or contact enquiries.

Recipients of your data (processors)

We share data with the following providers, to the extent needed to run the service and under a data processing agreement:

  • Cloudflare — bot verification (Turnstile) on the sign-up and sign-in forms. It receives your IP address in order to check you are not an automated system.
  • Netcup — hosting of our servers, in Frankfurt (Germany).
  • Object storage provider — stores profile pictures and plugin packages.
  • Email provider — delivery of transactional email (account verification, password reset, alerts).
  • Sentry — technical error monitoring, in its European Union region (Frankfurt), configured not to send personal data.
  • Google Analytics — web analytics, only if you accept it (see the Cookie Policy).
  • AI provider — when automated review is enabled, the plugin's source code is sent to an AI model to produce the quality report. What is sent is the published code, not your account data; note that a plugin's headers usually include its author's name and email.

We also use Plausible, hosted on our own servers, for aggregate site analytics; being self-hosted, that data never leaves our infrastructure.

We do not sell your personal data to third parties and do not use it for advertising.

International transfers

Google, as the Analytics provider, and whichever AI provider we use at any given time are entities based in the United States. When they process data on our behalf they do so under the Standard Contractual Clauses approved by the European Commission or another transfer mechanism valid under the GDPR. Netcup, Sentry's European region and our self-hosted Plausible keep data within the European Union.

Retention periods

  • Account data — for as long as your account is active. Deleting it removes the data immediately, along with your profile picture, your reviews and your reports.
  • Sign-in history — 90 days.
  • Notifications — 90 days.
  • Audit log of sensitive actions — in two stages: the IP address and user agent are removed after 90 days, and the whole record after 2 years. The split is deliberate: the personal data stops being necessary within weeks, while the trail of what was done and when remains the evidence that lets us resolve incidents. If you delete your account, your records are anonymised at that moment, without waiting for the 90 days.
  • Accounts suspended by an administrator — 30 days before permanent deletion, during which the suspension can be reversed.
  • Published plugins — they stay in the catalog even if you delete your account, because other people depend on them, but they are no longer associated with you.
  • Contact form data — until your enquiry is resolved and, at most, 12 months afterwards.

Security measures

We apply appropriate technical and organisational measures: encryption in transit (TLS) on all communications, passwords stored using key-derivation functions, optional two-factor authentication, role-based access control, rate limiting and error monitoring. No system is 100 % impenetrable, but we work actively to minimise risk.

Minors

LMS Plugin Hub is not aimed at children under 14, and we do not knowingly collect their data. If we find an account belonging to someone under that age without the consent of their guardian, we will delete it.

Your rights

You can exercise your rights of access, rectification, erasure, restriction of processing, objection and portability at any time by writing to [email protected]. From your account settings you can also review your sessions and sign-ins, change your details and delete your account yourself.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es, calle Jorge Juan, 6, 28001 Madrid).

Changes to this policy

We may update this Privacy Policy to reflect changes in the service or in applicable law. Significant changes will be announced in advance.