Translation provided for information only: only the French version is legally authoritative.
Legal information
Privacy policy
Last updated: 17 October 2026
In 30 seconds
- To create an account, all you need is a username and a password: no name, no email address, no phone number.
- Your course materials are used only to prepare your explanations and quizzes. They are never sold, published or used to train AI.
- No advertising, no advertising cookies, no selling your data.
- Your data is stored in the European Union (Sweden). To operate, Classy uses a few service providers, some of which are in the United States: they are listed below.
- You can delete a course or your entire account yourself, in one click, and write to us to exercise all your rights.
1. Who is responsible for your data?
The data controller is Classy's publisher: Spinning-Impact Corp LTD, 4 Emmanouil Roidi Street, 1095 Nicosia, Cyprus, contactable at contact@classy.college (see the legal notice). We comply with Regulation (EU) 2016/679 (‘GDPR’) and French Law No. 78-17 of 6 January 1978, as amended (the ‘Data Protection Act’).
2. What data, for what purpose, on what basis and for how long?
We only collect the data necessary for each purpose (the data minimisation principle).
| Purpose | Data collected | Legal basis | Retention period |
|---|---|---|---|
| Creating and managing your account | Username, password (stored using irreversible encryption), declared age range (15 or over, or under 15 with the date of parental consent), level of study if you provide it, plan, registration date and last login date. | Performance of the contract (Terms of Use) | Until you delete your account. |
| Logging you in, restoring access to your account and sending you reminders | Email address, requested at registration (or added in ‘My account’ for older accounts); one-time verification codes (stored as hashes, valid for 15 minutes); your choice of whether to receive revision reminders (disabled by default). | Performance of the contract (login, email address confirmation, password reset); consent (reminders, which you can stop at any time in ‘My account’ or via the link in each email) | Until you remove the address or delete your account. Codes: deleted as soon as they are used, or the day after they expire. |
| Analysing your course materials and providing the service | Uploaded files (documents, photos of notes, audio recordings), extracted text, pasted past papers and questions, details you write, generated content (outline, explanations, quizzes, mock exams, voice audio, podcast), exam date, projects (the name you give them, the courses they bring together, overall analysis and project mock exams). Questions asked of the assistant are sent to the AI for a response, without being stored by Classy. | Performance of the contract | Until you delete the course or your account. |
| Avoiding repeating an identical analysis | Digital fingerprint (SHA-256) of the uploaded file and the level requested. If the same file has already been fully analysed for the same level, without past papers or instructions from its author, the outline and explanations already generated are copied into your account: neither student sees anything belonging to the other, including their name, files or results. | Legitimate interest (reducing waiting times and the cost of the service) | Stored with the course until it is deleted. |
| Testing AI quality and cost | A Classy administrator may rerun the analysis of a course that has already been analysed using different settings (a different AI model or a different way of sending it the course materials) to compare the quality and cost of the explanations generated. These tests are only visible to the team: nothing is added to or changed in your account. | Legitimate interest (improving the service and controlling its cost) | 90 days, or less if the course is deleted sooner. |
| Tracking your progress | Quiz answers, scores, questions to revisit (spaced repetition), progress statistics. | Performance of the contract | Until you delete the relevant course or your account. |
| Challenges between friends and Group plan | Username, challenge questions, scores and times; group members. | Performance of the contract | Until you delete your account (the challenge is deleted along with its creator's account). |
| Referrals | Referral codes you have created, the account that used each code and dates (use, referred user's first subscription, discount applied); for older link-based referrals, a fingerprint of the connection used at registration (never the IP address itself) to prevent abuse. | Performance of the contract (Terms of Use, Article 7); legitimate interest (fraud prevention) for the fingerprint | Until you delete your account (a code used by a deleted account is unlinked from that account); connection fingerprint: 30 days. |
| Managing your subscription | Plan, period, status, dates, Stripe customer and subscription IDs. Stripe collects your email address and payment details directly: we never see your card details. | Performance of the contract; legal obligation (accounting) | For the duration of the subscription, after which accounting documents (invoices) are retained for 10 years (Article L. 123-22 of the French Commercial Code). |
| Replying to your messages (help and contact, error reports) | Subject, message, email address if you are not logged in, username if you are logged in, the part of the course reported. | Legitimate interest (replying to you, improving the service) | 3 years after the message, then automatic deletion. |
| Security and abuse prevention | IP address and attempt counters (login, registration, usage limits), technical log of actions (registration, upload, payment, etc.) and server errors, hosting provider's access logs; if the anti-bot check is enabled at registration, technical data from your browser analysed by Cloudflare Turnstile. | Legitimate interest (protecting accounts and the service) | Counters: 2 days. Activity log: 13 months. Hosting provider's logs: a few days to 30 days. |
| Measuring website traffic (without cookies) | Page viewed, referring website, device type, campaign name if you arrive via a campaign link (‘utm’ parameters), and a fingerprint calculated daily (the IP address is not stored). When you register, the campaign and landing page (stored on your device until then, for no more than 30 days, along with the name of any referrer) are linked to your account to identify which channels bring in students. | Legitimate interest (statistics and service management) | Visits: 13 months, then automatically deleted. Account source: until the account is deleted. |
| Measure service costs and quality | For each AI call: model, number of tokens, duration, without the content of your course materials. | Legitimate interest (managing the service) | Until your account is deleted, then anonymised data. |
| Exercise or defend our rights (disputes, evidence of acceptance of the Terms of Use and Terms of Sale) | Date and version of the Terms of Use accepted (linked to your account); date and version of the Terms of Sale accepted and request for immediate performance (linked to the subscription, held by Stripe). | Legitimate interest; legal obligation | Terms of Use: until the account is deleted. Terms of Sale: for the duration of the subscription, then 5 years (limitation period). |
When you delete your account, all associated data (profile, course materials, files, voice data, results, revision sessions, challenges created, active subscription) is erased. Only data we are legally required to keep (invoices held by Stripe) and messages sent to support (disassociated from your account) are retained for the period stated above.
We carry out no direct marketing, no advertising profiling and no automated decision-making that produces legal effects concerning you (Article 22 of the GDPR).
3. Your course materials and artificial intelligence
To generate your explanations, the content of your course materials is sent, at the time of analysis, to artificial intelligence models (Anthropic's Claude for text; Google's Gemini for synthetic speech and transcription of recordings), via the OpenRouter platform or directly to Anthropic. These providers act on our behalf: they process the data only to respond to our requests, do not use it to train their models and retain it only for the limited period specified in their terms (security, abuse prevention).
Tip: avoid uploading documents containing sensitive personal information (health, opinions, other students' data). If you record a lesson, the teacher's voice is personal data: only record with their permission.
4. Who receives your data?
Your data is accessible only to Classy's publisher, to the extent necessary (support, security), and to the following providers, which act as data processors (Article 28 of the GDPR), unless otherwise stated:
| Provider | Role | Data location |
|---|---|---|
| Supabase Inc. | Database, accounts, file storage | Sweden (European Union) |
| Vercel Inc. | Website and application server hosting | Server in Sweden; global content delivery network; company based in the United States |
| OpenRouter Inc. | Access to AI models (text, voice, transcription) | United States |
| Anthropic PBC | Claude AI models (course material analysis, explanations, corrections) | United States |
| Google LLC | Gemini models (synthetic speech, transcription of recordings) | United States / European Union |
| Resend Inc. | Sending emails (verification codes, reminders), only if you have added an email address | United States |
| Cloudflare, Inc. | Anti-bot verification (Turnstile) when creating an account, when enabled; no advertising cookies | Global network; company based in the United States |
| Stripe Payments Europe, Ltd. | Payment and invoicing. Stripe also acts as a separate data controller for its own obligations (fraud prevention and anti-money laundering): see stripe.com/fr/privacy. | Ireland (European Union), with possible transfers to the United States |
We do not sell or rent your data. It may be disclosed to the authorities only if required by law.
5. Transfers outside the European Union
Some providers are based in the United States. These transfers are governed by the European Commission's adequacy decision of 10 July 2023 (the ‘EU-US Data Privacy Framework’) where the provider is certified under it, and otherwise by the standard contractual clauses adopted by the European Commission, supplemented by security measures (encryption of data in transit and at rest). You can obtain a copy of these safeguards by writing to us.
6. If you are under 18
Classy is designed for students, many of whom are under 18: this is why we do not ask for your name or date of birth (the email address can be a parent's), display no advertising and create no commercial profiles. Processing is based on providing the service you use, not on your consent. If you are under 15, your account can only be created with permission from one of your parents (or your legal guardian), which you confirm when signing up after reading this page with them (Article 45 of the French Data Protection Act); email reminders, which are based on consent, also require this permission. A parent can write to us via ‘Help and contact’ to have their child's account deleted. Your parents (or legal guardian) can exercise your rights on your behalf; you can also exercise them yourself.
7. Security
- Encrypted communications (HTTPS); data and files encrypted at rest by our hosting providers.
- Files stored in private storage, accessible only through temporary signed links; no database table is directly accessible from the Internet.
- Passwords stored in hashed form; limits on login attempts; every access checked by the server.
- In the event of a data breach posing a risk, we notify the CNIL within 72 hours and, if the risk is high, the individuals affected.
8. Your rights
You have the following rights over your data: access, rectification, erasure, restriction of processing, portability (receiving your data in a machine-readable format), objection to processing based on our legitimate interest, and the right to set instructions for what happens to your data after your death (Article 85 of the French Data Protection Act).
- Do it yourself, straight away: download all your data in a JSON file (rights of access and portability: ‘My account’ > ‘Download my data’), change your password or email address, delete course materials (outline page > ‘Delete these course materials’) or your entire account (‘My account’ > ‘Delete my account’).
- For anything else: write to contact@classy.college or use ‘Help and contact’ while logged in (if your account has no confirmed email address, this is the simplest way to check that the request really comes from you). We may ask you for information to confirm that the account is yours.
We respond within one month (which may be extended by two months for a complex request, with prior notice to you). If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr/fr/plaintes.
9. Cookies and trackers
Classy only uses trackers essential to its operation and does not place any advertising trackers. Fonts are hosted by Classy: no requests are sent to Google when you visit. Details and settings: cookie policy.
10. Changes
We may update this policy, for example if we change providers. The update date appears at the top of the page; if there is a significant change, we will notify you in the app.