Privacy Policy

1. Introduction and Scope

Class Technologies Inc., (“Class,” “we,” “us,” or “our”), provides a virtual classroom and learning platform for K-12, higher education, government, and workplace customers (the “Service”). We believe privacy is a fundamental right. Our customers trust us with the personal information of their employees, learners, and students, and we take the obligations attached to that information seriously.

This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our websites (including class.com), our marketing activities, and the Service. It also describes the privacy rights available to you and how to exercise them.

Our Two Roles: Controller and Processor

Class acts in two distinct capacities, and your rights and our obligations differ depending on which applies:

• Class as processor / service provider (“Service Data”). When we provide the Service to a customer institution or organization, we process personal information — including student educational records — on behalf of and at the direction of that customer. The customer is the data controller (or “business” under U.S. state law) and Class is the data processor (or “service provider”). Our processing of Service Data is governed by our agreement with the customer, including the Class Data Processing Addendum, and not by this Privacy Policy except where expressly stated. If you are a student, learner, or end user of an institution, please direct privacy questions and rights requests to your institution first.
• Class as controller / business (“Business Data”). When we operate our websites, market and sell the Service, manage customer accounts and billing, provide support, and administer our business, we determine the purposes and means of processing and act as a data controller. This Privacy Policy applies fully to Business Data.

We do not sell or rent Service Data or Student Data, and we do not use Service Data to advertise to students or end users. Our commitments regarding limited disclosures of website data through cookies and similar technologies are described in Sections 7 and 14.

2. Our Privacy Commitments

• We do not sell Student Data or Service Data, and we do not use Student Data for targeted advertising.
• You and our customers own the content shared with Class; we do not.
• We do not display third-party advertising within the Service.
• We maintain a written information security program aligned with industry standards and are SOC 2 Type II attested.
• We honor recognized opt-out preference signals, including the Global Privacy Control, where required by law.
• We are transparent about our practices and will notify you of material changes as described in Section 16.

3. Personal Information We Collect

Information You Provide

• Contact and account data: name, email address, school or company name, job title, address, state/country, phone number, and login credentials.
• Commercial data: billing details, order and subscription history, and records of products or services purchased. We do not store full payment card numbers; payments are processed by our payment processors.
• Communications: information you submit through contact and demo-request forms, support tickets, surveys, and event registrations.

Information Collected Automatically

• Usage data: IP address, device and browser type, operating system, pages viewed, referring URLs, time and duration of visits, and interaction data.
• Cookies and similar technologies: as described in Section 7 and our Cookie Policy.

Information from Other Sources

We may receive information from our customers (for example, when an institution provisions user accounts), from service providers, from event partners, and from publicly available business sources. We may combine this with information we collect directly.

Sensitive Personal Information

We do not seek to collect sensitive personal information (such as government identifiers, precise geolocation, biometric identifiers, or health information) through our websites, and we ask that you not submit it. Where the Service processes any category of sensitive information at a customer’s direction, that processing is governed by our agreement with the customer. We do not use or disclose sensitive personal information for purposes requiring a right to limit under the California Consumer Privacy Act.

4. How We Use Personal Information

We use Business Data for the following purposes, relying on the legal bases indicated where the EU or UK General Data Protection Regulation (“GDPR”) applies:

• Providing and operating the Service — account creation, authentication, delivery of features, support, and troubleshooting (performance of contract; legitimate interests).
• Improving and securing our products — monitoring, diagnostics, analytics, testing, product development, and protecting against fraud, abuse, and security incidents (legitimate interests; legal obligation).
• Marketing and sales — sending marketing communications, managing campaigns, and measuring their effectiveness (legitimate interests; consent where required, including for electronic marketing under applicable e-privacy laws). You may opt out of marketing communications at any time.
• Legal and compliance — complying with legal obligations, responding to lawful requests from public authorities, enforcing agreements, and establishing or defending legal claims (legal obligation; legitimate interests).

We do not use personal information for purposes that are incompatible with the purposes described above without providing notice and, where required, obtaining consent. Continued use of the Service is not treated as consent where applicable law requires affirmative, unambiguous consent.

5. AI Features and Automated Processing

Certain features of the Service use artificial intelligence, including features that generate transcripts, summaries, or participation insights from recorded sessions (for example, the AI Teaching Assistant). These features are:

• Enabled only at the customer level by the institution’s administrator; and
• Where the feature analyzes an individual user’s participation in recorded sessions, activated for that user only after the user opts in through the designated in-product consent flow. Users may deactivate the feature, and customer administrators may disable it, at any time.

We do not use Service Data or Student Data to train generalized artificial intelligence models, and we contractually restrict our AI technology vendors from doing so. We do not use personal information to make decisions that produce legal or similarly significant effects concerning individuals without human involvement.

6. How We Disclose Personal Information

We disclose personal information to the following categories of recipients:

• Service providers and subprocessors — hosting, communications, analytics, support, and IT providers acting on our documented instructions under written contracts that require confidentiality, limit use to the contracted purposes, and impose data protection obligations no less protective than our own. Our current subprocessor list is available in the Class Trust Center.
• Our customers — where you use the Service through an institution, we disclose information to that institution as part of providing the Service.
• Advertising and analytics partners — for our websites only, as described in Section 7. This may constitute a “sale” or “sharing” under certain U.S. state laws, and you can opt out as described in Sections 7 and 14.
• Professional advisors and authorities — lawyers, auditors, and insurers; and courts, regulators, or law enforcement where required by law or to protect rights, safety, or property. Where legally permitted, we will redirect government demands for Service Data to the relevant customer and notify the customer before disclosure.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality protections and, for Student Data, subject to the successor assuming our privacy commitments.

7. Cookies, Analytics, and Opt-Out Preference Signals

Our websites use cookies, pixels, and similar technologies for essential site functions, analytics (including Google Analytics), and marketing. Where required by law, non-essential cookies are deployed only after you have given consent through our consent management platform, and you can change your preferences at any time through the cookie settings link on our websites.

Some of these technologies transmit identifiers, device information, and internet activity to third parties for analytics and cross-context behavioral advertising. Under certain U.S. state privacy laws this is treated as a “sale” of personal information or “sharing” for targeted advertising. You can opt out by:

• Clicking the “Your Privacy Choices / Do Not Sell or Share My Personal Information” link in our website footer;
• Broadcasting an opt-out preference signal such as the Global Privacy Control (GPC). We treat a valid GPC signal from your browser or device as a request to opt out of the sale or sharing of personal information linked to that browser or device, as required by applicable law; or
• Adjusting your cookie preferences through our consent management platform.

We do not knowingly sell or share the personal information of consumers under 16 years of age, and we do not process the personal information of known minors for targeted advertising.

8. Children’s Privacy (COPPA)

The Service is made available to children under 13 only through customer institutions. Consistent with the Children’s Online Privacy Protection Act (“COPPA”) and its implementing rule as amended, we rely on the school or institution to provide or obtain the required consent, and we collect, use, and retain children’s personal information solely to provide the Service on the institution’s behalf and for the purposes set out in our agreement with the institution.

• We collect only as much information from children as is reasonably necessary to provide the Service.
• We do not disclose children’s personal information to third parties for advertising, marketing, or other commercial purposes unrelated to the Service, and we do not do so without obtaining any separately required consent.
• We maintain a written data retention policy for children’s personal information and do not retain it longer than reasonably necessary for the purpose for which it was collected. We do not retain children’s personal information indefinitely.
• Institutions and parents may review, request deletion of, or refuse further collection of a child’s information at any time. Please contact your institution first; the institution can direct our fulfillment of these requests.

9. Student Data (FERPA and State Student Privacy Laws)

Through the Service we may collect personally identifiable information from or about students (“Student Data”), which may include education records governed by the Family Educational Rights and Privacy Act (“FERPA”). We treat Student Data as strictly confidential. Our collection, use, and disclosure of Student Data are governed by our contracts with educational institutions, FERPA, COPPA, and applicable state student privacy laws (including, where applicable, California’s Student Online Personal Information Protection Act), and not by the consumer-rights provisions of this Privacy Policy.

• We use Student Data only to provide and improve the Service for the institution or on its behalf.
• We do not use Student Data for targeted advertising, to build profiles for non-educational purposes, or to sell to third parties.
• Where we act as a “school official” under FERPA, we do so under the institution’s direct control with respect to the use and maintenance of education records.

Students and parents should contact their institution to review, correct, or delete Student Data.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law. In general:

• Service Data is retained for the duration of our agreement with the customer and deleted or returned in accordance with that agreement and our Data Processing Addendum following termination.
• Account and commercial records are retained for the life of the relationship plus the period required by tax, accounting, and legal requirements.
• Marketing data is retained until you opt out or the data is no longer needed for the purposes collected.
• Website and usage data is retained for the periods set out in our Cookie Policy.

The criteria we use to determine retention periods include the nature and sensitivity of the information, the purposes of processing, applicable legal requirements, and the status of our relationship with you or your institution. When retention periods expire, we delete or de-identify the information.

11. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction, including encryption in transit and at rest, access controls, logging and monitoring, and personnel training. We maintain SOC 2 Type II attestation and undergo regular independent assessments. No system is perfectly secure, and we cannot guarantee absolute security; if we become aware of a breach affecting your personal information, we will notify you and applicable regulators as required by law.

12. International Data Transfers; Data Privacy Framework

Class is headquartered in the United States, and personal information may be processed in the United States and other countries where we or our subprocessors operate.

Data Privacy Framework

Class Technologies Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Class Technologies Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Class Technologies Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Class is responsible for the processing of personal data it receives under the DPF and subsequently transfers to a third party acting as an agent on its behalf. Class complies with the DPF Principles for all onward transfers of personal data from the EU, the UK, and Switzerland, including the onward transfer liability provisions, and remains liable under the Principles if its agent processes such personal data in a manner inconsistent with the Principles, unless Class proves that it is not responsible for the event giving rise to the damage.

Pursuant to the DPF Program, EU, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States in reliance on the DPF Program should direct their query to privacy@class.com. If requested to remove data, we will respond within a reasonable timeframe. We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to privacy@class.com. The Federal Trade Commission has jurisdiction over Class Technologies Inc.’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. Class may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Recourse, Enforcement, and Liability

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Class Technologies Inc. commits to resolve complaints about our collection or use of your personal information transferred to the U.S. pursuant to the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the DPF should first contact Class at privacy@class.com. We will respond to your complaint within 45 days.

Class Technologies Inc. has further committed to refer unresolved DPF Principles-related complaints to a U.S.-based independent dispute resolution mechanism, BBB NATIONAL PROGRAMS. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbbprograms.org/dpf-complaints for more information and to file a complaint. This service is provided free of charge to you.

Under certain conditions, more fully described on the Data Privacy Framework website at https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction, you may be entitled to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.

Other Transfer Mechanisms

In addition to, or where the DPF does not apply, Class relies on Standard Contractual Clauses approved by the European Commission (together with the UK International Data Transfer Addendum and Swiss-recognized equivalents), incorporated into our Data Processing Addendum with appropriate supplementary measures, as a legal basis for transfers of personal data from the EEA, the UK, and Switzerland. If any transfer mechanism we rely upon is invalidated or suspended, the remaining mechanisms continue to apply to the transfer.

13. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights with respect to personal information for which Class is the controller or business:

• Access / to know — confirm whether we process your personal information and obtain a copy of it, including in a portable format.
• Correction — request correction of inaccurate personal information.
• Deletion — request deletion of personal information, subject to legal exceptions.
• Opt out — opt out of the sale of personal information, sharing/processing for targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects.
• Restriction and objection (EEA/UK) — restrict or object to processing based on legitimate interests or performed for direct marketing.
• Withdraw consent — withdraw consent at any time where processing is based on consent, without affecting prior processing.
• Complain — lodge a complaint with your data protection authority or state attorney general.

How to Exercise Your Rights

You may exercise these rights by emailing privacy@class.com or using the “Your Privacy Choices” link on our websites. We will verify your request using information reasonably necessary to confirm your identity (and, for agent requests, the agent’s authority), and we will respond within the time required by applicable law (generally 45 days for U.S. state requests, extendable once with notice, and one month under the GDPR). We do not charge a fee unless a request is manifestly unfounded or excessive, and we will not discriminate against you for exercising your rights.

Appeals

If we decline to act on your request, you may appeal our decision within a reasonable period by replying to our response or emailing privacy@class.com with the subject line “Privacy Appeal.” We will respond to appeals within the period required by applicable law (60 days in most states). If your appeal is denied, you may contact your state attorney general; we will provide a mechanism to do so in our appeal response.

If you are an end user of an institution, your institution controls your Service Data, and we will route your request to the institution or ask you to contact it directly, as required by our agreement with that institution.

14. Additional Disclosures for U.S. State Residents

This section supplements the rest of this Policy and applies to residents of California and other U.S. states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia).

Categories of Personal Information (CCPA)

In the preceding 12 months, we have collected the categories of personal information listed below. The table also shows whether each category is disclosed for business purposes and whether it is “sold” or “shared” as those terms are defined by the CCPA.

We collect these categories from the sources, and use them for the purposes, described in Sections 3 and 4. We retain each category for the periods described in Section 10. We do not sell or share the personal information of consumers we know to be under 16 years of age, and we have no actual knowledge of doing so.

Your California Rights

California residents have the rights to know/access, delete, correct, and port their personal information; to opt out of sale and sharing (including through an opt-out preference signal such as GPC, which we honor as required by CCPA regulations); to limit the use of sensitive personal information (not applicable, as we do not use sensitive personal information for purposes requiring the right to limit); and to non-discrimination. You may designate an authorized agent to submit requests on your behalf. We will confirm receipt of verifiable requests within 10 business days and respond within 45 days, extendable by an additional 45 days with notice.

California’s “Shine the Light” law (Civil Code § 1798.83) permits California residents to request certain information regarding disclosure of personal information to third parties for their direct marketing purposes; we do not disclose personal information to third parties for their own direct marketing purposes.

15. EEA and UK Representatives; Data Protection Contacts

Controller for Business Data: Class Technologies Inc., www.class.com — privacy@class.com.

Individuals and supervisory authorities in the EU and UK may contact our representatives under Article 27 GDPR / UK GDPR:

• EU: DP-Dock GmbH, Attn: ClassEDU, Ballindamm 39, 20095 Hamburg, Germany
• UK: DP Data Protection Services UK Ltd., Attn: ClassEDU, 16 Great Queen Street, Covent Garden, London WC2B 5AH, United Kingdom
• www.dp-dock.com — classedu@gdpr-rep.com

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post a notice on our website at least 30 days before the changes take effect and update the “Last Updated” date above. Where a change materially affects how we use previously collected personal information and applicable law requires it, we will obtain your consent before applying the change to that information. Material changes to our processing of Service Data are governed by our customer agreements. We encourage you to review this page periodically.

17. Contact Us

End users of institutions: if you use the Service through your school, university, or employer, contact your institution first — its privacy practices govern how Class processes your Service Data on its behalf.

For all other questions or concerns about this Privacy Policy or our privacy practices, contact us at privacy@class.com.