Privacy Policy

1. Scope and role

This Policy applies to self-serve accounts created on our website. For these accounts, Classmate is the controller of your account, billing, telemetry, and any content you choose to store with us as part of your teaching workflow.

2. What we collect

We minimise personal data and design teacher workflows for de-identified inputs.

• Account and identity: Name, work email, password hash, role, plan tier.
• Billing: Subscription details, invoices, tax details; payment method tokens are stored with our payment processor.
• Teaching content: Class names (use non-identifying labels), lesson metadata (e.g., dates/duration), prompts and chat with the lesson agent, and generated outputs (lesson plans, presentations, worksheets, PDFs).
• Support and communications: Emails, tickets, feedback.
• Usage and device: Event logs, crash reports, IP-derived approximate location, device/browser type, performance and security telemetry (e.g., rate-limit events).
• Cookies: Strictly-necessary cookies for authentication and session security. If we add analytics cookies later, we’ll update this Policy and obtain consent where required.
• Sensitive information and student data. We do not need or want health data, biometric data, or student personally identifiable information (PII) in teacher workflows. Please do not submit student names, contact details, photos, or unique identifiers in teacher prompts or class/lesson names.

3. How we use data

• Provide the Service (authenticate, host content, generate outputs, render/download assets).
• Maintain and secure (monitor availability, prevent abuse/fraud, troubleshoot).
• Improve (use de-identified/aggregated analytics to enhance quality and safety).
• Communicate (service messages, updates, invoices, support).
• Comply (tax, legal, regulatory obligations).
• We do not sell personal information.

4. AI/model and cloud providers

We use reputable AI and cloud providers configured so that Your Content and Outputs are not used to train their foundation models. Providers act under our instructions as processors. We may change providers without notice. A non-public list of provider categories is available on request.

5. Where we process and international transfers

Primary hosting is on AWS in Australia (ap-southeast-2). Limited transfers may occur to other countries where service providers operate (e.g., email/support/security). When we transfer personal data, we apply appropriate safeguards and minimise what is transferred.

6. Sharing

We share information only as needed to operate the Service: Service providers (cloud/AI, email/support, payments), legal/safety (to comply with law or protect rights), and business transfers (e.g., merger). We do not allow providers to use your information for their own marketing.

7. Retention and deletion

• While your account is active, we retain account data and teaching content you store with us.
• If you delete content or your account, we delete or de-identify it within 30 days; encrypted backups roll off within 35 days; security logs may be retained up to 180 days; billing records for 7 years (legal obligation).

Self-serve deletion is available in the app; you can also email hello@classmate.ai.

8. Security and breaches

We use industry-standard measures (encryption in transit/at rest, least-privilege access, audit logging, backups). No system is perfectly secure; please protect your credentials. We will notify affected users and regulators of notifiable data breaches as required by the OAIC Notifiable Data Breaches scheme and applicable NZ requirements.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, or object to certain processing, and—in some regions—data portability. Use in-app tools or email hello@classmate.ai. We will explain any limits that apply under local law.

10. Children and future Student Features

Classmate is not directed to children and does not offer direct student sign-ups under this self-serve plan. If we introduce optional Student Features that allow a teacher to invite students:

• the teacher must have lawful authority and any required permissions/consents;
• student data will be used only for educational purposes (no selling; no targeted advertising);
• automated scoring may be used for practice/feedback, not for high-stakes decisions without human review; and
• student data will be deleted or de-identified within a reasonable period after the teacher disables those features or requests deletion, subject to legal retention and backup roll-off.

11. Legal bases

We rely on contractual necessity (providing the Service), legitimate interests (security/maintenance/improvement—balanced with your rights), consent (where required for optional features/communications), and legal obligation (tax/audit/compliance).

12. Changes

We may update this Policy. Material changes will be notified in-app or by email. Continued use after the effective date indicates acceptance.