Privacy Policy

1. Scope and role

This Policy applies to self-serve accounts created on our website. For these accounts, Classmate is the controller of your account, billing, telemetry, and any content you choose to store with us as part of your teaching workflow.

2. What we collect

We minimise personal data and design teacher workflows for de-identified inputs.

• Account and identity: Name, work email, password hash, role, plan tier.
• Billing: Subscription details, invoices, tax details; payment method tokens are stored with our payment processor.
• Teaching content: Class names (use non-identifying labels), lesson metadata (e.g., dates/duration), prompts and chat with the lesson agent, and generated outputs (lesson plans, presentations, worksheets, PDFs).
• Support and communications: Emails, tickets, feedback.
• Usage and device: Event logs, crash reports, IP-derived approximate location, device/browser type, performance and security telemetry (e.g., rate-limit events).
• Cookies: Strictly-necessary cookies for authentication, session security and remembering cookie preferences. Optional performance and analytics cookies load only if you consent, and only when analytics is configured for the site.
• Sensitive information and student data. We do not need or want health data, biometric data, or student personally identifiable information (PII) in teacher workflows. Please do not submit student names, contact details, photos, or unique identifiers in teacher prompts or class/lesson names.

3. How we use data

• Provide the Service (authenticate, host content, generate outputs, render/download assets).
• Maintain and secure (monitor availability, prevent abuse/fraud, troubleshoot).
• Improve (use de-identified/aggregated analytics to enhance quality and safety).
• Communicate (service messages, updates, invoices, support).
• Comply (tax, legal, regulatory obligations).
• We do not sell personal information.

4. AI/model and cloud providers

We use the processors below so we can provide the Service. They act under our instructions. We configure AI providers so that Your Content and Outputs are not used to train their foundation models. If we add a processor or change where personal information is hosted, we will give prior notice in-app or by email before that change takes effect.

• Amazon Web Services, Inc. (AWS) — hosting, storage, authentication, and transactional email. Primary processing: Australia (Sydney, ap-southeast-2). AWS is a US company; limited support or account operations may occur in the United States.
• Stripe, Inc. — payment processing. Card details are handled by Stripe, not stored by Classmate. Processing: United States and other Stripe operating locations.
• Google LLC — Gemini model inference for some lesson, presentation, and worksheet generation; reCAPTCHA for bot protection. Processing: United States.
• OpenAI, LLC — model inference for some generation workloads as configured. Processing: United States.
• MailerLite Limited — newsletter delivery if you subscribe on our website. Processing: Ireland / European Union.
• Slack (Salesforce, Inc.) — internal operational alerting that may include account identifiers when investigating faults. Processing: United States.
• Apple, Google, and Meta — only if you choose to sign in with those services. Processing: United States.

5. Where we process and international transfers

Primary hosting is on AWS in Australia (Sydney, ap-southeast-2). Some processors listed in section 4 operate in the United States and Ireland / the European Union. When we transfer personal information overseas, we apply appropriate safeguards and minimise what is transferred. If we move primary hosting to another country, we will give prior notice in-app or by email before the change takes effect.

6. Sharing

We share information only as needed to operate the Service: Service providers (cloud/AI, email/support, payments), legal/safety (to comply with law or protect rights), and business transfers (e.g., merger). We do not allow providers to use your information for their own marketing.

7. Retention and deletion

• While your account is active, we retain account data and teaching content you store with us.
• If you delete content or your account, we delete or de-identify it within 30 days; encrypted backups roll off within 35 days; security logs may be retained up to 180 days; billing records for 7 years (legal obligation).

Self-serve deletion is available in the app; you can also email hello@classmate.ai.

8. Security and breaches

We use industry-standard measures (encryption in transit/at rest, least-privilege access, audit logging, backups). No system is perfectly secure; please protect your credentials. We will notify affected users and regulators of notifiable data breaches as required by the OAIC Notifiable Data Breaches scheme and applicable NZ requirements.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, or object to certain processing, and—in some regions—data portability. Use in-app tools or email hello@classmate.ai. We will explain any limits that apply under local law. If you have a privacy complaint, contact us first at hello@classmate.ai. You may also contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Children and future Student Features

Classmate is not directed to children and does not offer direct student sign-ups under this self-serve plan. If we introduce optional Student Features that allow a teacher to invite students:

• the teacher must have lawful authority and any required permissions/consents;
• student data will be used only for educational purposes (no selling; no targeted advertising);
• automated scoring may be used for practice/feedback, not for high-stakes decisions without human review; and
• student data will be deleted or de-identified within a reasonable period after the teacher disables those features or requests deletion, subject to legal retention and backup roll-off.

11. Legal bases

We rely on contractual necessity (providing the Service), legitimate interests (security/maintenance/improvement—balanced with your rights), consent (where required for optional features/communications), and legal obligation (tax/audit/compliance).

12. Changes

We may update this Policy. Material changes will be notified in-app or by email. Continued use after the effective date indicates acceptance.