Privacy policy

This is a translation provided for convenience. If there is any difference, the Portuguese version prevails.

1. What this policy covers

This policy applies to the classme.win website and to commercial contact with ClassMe. In the schools created on the platform, the teacher is the controller of the students’ and parents’ data, and ClassMe acts as processor, handling that data only on the teacher’s behalf and to run the school. Each school has its own policy.

2. Who is responsible

The controller of the data processed on this site is ClassMe, operated from Spain by an individual identified in the Legal notice. Privacy contact: contato@classme.win.

3. What data we collect

• Contact form: name, email, subject and the message you write.
• Free guide: name, email, country, what you teach, the boxes you ticked (with the exact text and date) and the source of the visit, when the link has campaign tracking (utm).
• Form security: the IP address is used transiently to limit excessive submissions; we keep only a code derived from it (hash) for up to 1 hour.
• Technical logs: the host (Cloudflare) logs technical access data, such as IP, date and page, for security and operation.
• Country of access: the host tells us the country the page is opened from, calculated from the IP. We use it only to show prices for your region and don’t store it.

The site does not use cookies, advertising pixels or third-party tracking tools.

Language choice: if you close the notice suggesting the version of the site in your browser’s language, that choice is stored only on your device (the browser’s local storage), is not sent to us and can be deleted by clearing the site’s data.

4. Why we use it and on what legal basis

• Replying to your enquiry and preparing a proposal: steps prior to a contract, at your request (GDPR, art. 6(1)(b); LGPD, art. 7, V).
• Delivering the free guide you asked for: steps at your request (GDPR, art. 6(1)(b); LGPD, art. 7, V).
• Sending ClassMe news by email, only if you ticked the specific box: consent (GDPR, art. 6(1)(a); LGPD, art. 7, I). You can unsubscribe through the link in each email or by writing to contato@classme.win.
• Protecting the site and the form against abuse: legitimate interest (GDPR, art. 6(1)(f); LGPD, art. 7, IX).
• Meeting legal and tax obligations, when you become a customer (GDPR, art. 6(1)(c); LGPD, art. 7, II).

5. How long

Messages from people who don’t become customers are deleted within 90 days, as are guide requests without the news box ticked. Those who ticked news stay on the list until they leave it; the consent record is kept while you are on the list and for up to 3 years afterwards, to prove you gave consent. Customer data is kept for the duration of the contract and then for as long as the law requires. School data follows the terms of use (copy delivered to the teacher and deletion 30 days after the service ends).

6. Who we share it with

We don’t sell data. We use Cloudflare to host the site and route emails; it has a global network, including the United States, and is certified under the EU-US Data Privacy Framework. For teacher customers, the platform stores account data with Neon (database, London region, United Kingdom; covered by the European Union’s adequacy decision for the United Kingdom). Both process data on our behalf, under a data processing agreement; for data from Brazil, the ANPD standard clauses apply. When a teacher connects their Google account, Google (Google LLC, United States) receives each lesson’s event data as an independent controller (see section 7). We may share data when required by law or by an authority.

7. Teacher’s Google account (Google Calendar and Google Meet)

Connecting a Google account is optional and only available to teachers. Those who don’t connect it keep using the platform normally, with a fixed video call link.

Who is responsible. For the Google connection data (the access token, the account’s email and identifier and the busy times consulted), ClassMe is the controller and processes it to perform the contract with the teacher (GDPR, art. 6(1)(b); LGPD, art. 7, V; UK GDPR, art. 6(1)(b)). The students’ data included in the lesson event is processed by ClassMe on behalf of the school, which is its controller. Requests about the Google connection (access, correction, deletion): contato@classme.win. Requests about student data: the school.

What we access. When connecting the account, the teacher authorises only these permissions: identifying the account (openid and email address) and viewing and editing calendar events (calendar.events). We don’t ask for access to Gmail, Google Drive, contacts or any other Google service.

What we store. An access token provided by Google (stored encrypted and never displayed or written to logs), the Google account’s email and identifier, the permissions granted, the connection status and the dates it was connected and last used.

What we use it for. Only three things, which the teacher can see in their own calendar:

1. creating, in the teacher’s calendar, the event for each booked lesson, with the student’s and teacher’s names, the duration and the Google Meet link, inviting the student and the teacher;
2. deleting that event if the lesson is cancelled;
3. checking the busy periods in the teacher’s calendar, so as not to offer students times when the teacher already has commitments. In that check we ask Google only for the start, end and status of each commitment. We never read the title, description, location or participants of events we didn’t create. These times are not saved in the database: they stay in the server’s memory for a few minutes and are discarded.

With whom. The event is created in the teacher’s own Google account: in doing so Google (Google LLC, United States) processes the student’s and teacher’s names and emails as an independent controller, under the terms and privacy policy of the teacher’s Google account. ClassMe stores the connection data with Neon (database, London region, United Kingdom) and Cloudflare (hosting, global network, including the United States), which process data on ClassMe’s behalf under a data processing agreement. Transfer safeguards: for the United Kingdom (Neon), the European Union’s adequacy decision for the United Kingdom; for the United States, the EU-US Data Privacy Framework and the UK-US Data Bridge for certified companies, or standard contractual clauses; for data from Brazil, the ANPD standard clauses.

What we don’t do. We don’t sell this data, don’t use it for advertising, don’t use it to build profiles or to develop, improve or train artificial intelligence models, and don’t transfer it to anyone other than those listed above, except when required by law. Nobody on the team reads this data, except with the teacher’s express consent, to investigate abuse or a security incident, or to comply with the law; technical access is restricted and logged.

How to disconnect. The teacher can disconnect the account at any time on their school’s Account page, in the Lesson video calls card: access is revoked at Google immediately and the stored token is deleted. It can also be revoked through Google itself, at myaccount.google.com/permissions. Lesson events already created remain in the teacher’s calendar, who can delete them whenever they wish. If the teacher deletes their account on the platform, the Google connection is deleted with it.

Limited Use. ClassMe's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Your rights

You can ask for confirmation of processing, access, correction, anonymisation, portability, deletion and information about sharing, and withdraw consent when it is the basis (GDPR and UK GDPR; in Brazil, LGPD, art. 18). Write to contato@classme.win; we reply within 15 days. You can also complain to the AEPD (Spain), the ICO (United Kingdom), the ANPD (Brazil) or your country’s authority.

9. Security

We use an encrypted connection (HTTPS), security headers, a submission limit on the form and, on the platform, two-step verification and encrypted backups.

10. Children

This site is for adult teachers. Data about under-18 students exists only inside schools, with a parent’s consent, under each school’s policy.

11. Changes

If this policy changes significantly, we will say so on this page and, for customers, by email.