Privacy Policy

We collect information in three buckets:

• Account information. Your email address; a display name; and, if you sign in via a third-party identity provider (such as Google), the basic profile information that provider returns (name and email). We do not store passwords for federated sign-ins.
• Service-use information. The classrooms, scenes, quizzes, prompts, files, and interactive content you create or upload; the AI Output generated for you; usage events such as generation requests, chat turns, and student-spot allocations; and basic device and browser metadata necessary to deliver the Service (IP address, user-agent string, request timestamps).
• Billing information. When you purchase a subscription or student-spot pack, payment is processed by Stripe. Stripe collects and holds your card details directly. We receive and store customer, subscription, transaction, tax, entitlement, and records derived from signature-verified payment-provider events needed to administer the Service, reconcile transactions, and meet accounting obligations. Provider event records may include additional customer or billing metadata supplied by Stripe. We do not store full card or bank-account details directly.

We use the information above to:

• Provide, secure, and improve the Service — including generating AI Output, syncing your work across devices, and protecting against abuse.
• Process payments, calculate applicable taxes, send receipts, and comply with tax-reporting obligations.
• Respond to support requests and notify you about material changes to the Service or this policy.
• Aggregate usage statistics that do not identify you, so we can understand which features matter.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information. We do not use it for third-party advertising, and we do not allow our sub-processors to use it for their own marketing.

The Service uses third-party AI providers to generate text, images, audio, and other AI Output from your prompts and uploads. When you submit a prompt or file, that material is sent to the AI provider via an API request to fulfil your request.

Provider training and retention terms vary by deployment, provider, feature, and whether you supply your own API credentials. We do not use your content to train our own models. For institutional deployments, approved-provider and retention terms are documented in the applicable agreement and deployment disclosure. Optional or customer-selected providers are governed by their own terms and must not be assumed to offer the same no-training or retention protections.

An enabled feature may use a configured fallback provider during service throttling or failure. For institutional deployments, fallback providers must be approved for the deployment and identified in the applicable agreement or deployment disclosure before they process institutional information.

We use the following core sub-processors to operate the Service. A provider receives only the information needed for its function and is governed by applicable contractual or service terms.

• Supabase (PostgreSQL database, authentication, file storage) — hosted in the United States.
• Vercel (web hosting, edge compute, content delivery) — multi-region with U.S. primary.
• Google Cloud (Vertex AI) — AI inference for deployments that use Scalar-managed Google generative-AI services.
• Stripe (payment processing, tax calculation, customer portal) — global.
• Resend (transactional email) — recipient name, email address, and message template content.

Customer-selected integrations for AI, media, speech, document processing, search, or public-content metadata, including configured fallback services, may involve additional providers only when enabled for the applicable deployment or configured by the customer. Applicable provider terms and deployment disclosures identify those providers. We will update this policy or provide required notice before a new core sub-processor begins handling personal information.

We use cookies and similar browser-storage technologies (such as localStorage and IndexedDB) for three purposes:

• Authentication. To keep you signed in across pages and devices.
• Functionality. To remember your preferences, in-progress work, and recently-opened classrooms.
• Service integrity. To prevent abuse, enforce rate limits, and detect unusual sign-in patterns.

We do not use advertising cookies or third-party tracking cookies. You can clear cookies and local storage from your browser at any time; doing so will sign you out and remove cached work that has not been synced.

Browser storage may contain in-progress classroom content, preferences, and generated assets. These device-resident copies remain under the user's or institution's device controls and may persist until ClassesFlow site data is cleared. Managed-device offboarding should therefore include clearing ClassesFlow browser data.

We retain information for the period needed to provide the Service, meet an applicable institutional agreement, protect the Service, resolve disputes, and satisfy legal or accounting obligations. The lifecycle depends on the data and deployment:

• Classroom and content data — generally retained while the account or institutional relationship is active. When an authorized classroom deletion is processed through the application workflow, it removes the primary record and starts asynchronous, best-effort server-side storage cleanup. Cleanup may require reconciliation if an operation fails and is subject to applicable contractual requirements, legal holds, provider lifecycles, and copies controlled by the user or institution.
• Account and authentication records — retained while needed to provide and secure the account and afterward only as needed for institutional administration, security, dispute resolution, or law.
• Billing records — retained for at least seven (7) years where required for U.S. tax and accounting obligations, subject to applicable legal holds or retention exceptions.
• System logs and security events — retained under the configured application and managed-provider retention schedules, with longer preservation where needed for an investigation, contractual obligation, or law.

Backups may contain information until they age out or are overwritten under managed-provider schedules. We do not restore a backup solely to process an individual deletion request. Browser-resident copies remain subject to the device controls described in Section 6.

Subject to applicable law and an applicable institutional agreement, you may request access to, correction of, export of, or deletion of personal information we hold about you, or object to or restrict certain processing. For education records, the institution may be required to direct the request. To submit a request, email support@classesflow.com from the address on your account. We respond without undue delay and within any deadline that applies to the request.

Requests are verified and may be fulfilled through a manual support process. Access, export, correction, and deletion depend on the records and service capabilities in scope and remain subject to applicable law, contractual requirements, and the device and backup limitations described in Sections 6 and 7.

Depending on where you live, you may also have specific rights under the California Consumer Privacy Act, the Texas Data Privacy and Security Act, the EU/UK GDPR, or other laws. Where those laws apply, we will honor the rights and response requirements they provide.

You will not be discriminated against for exercising any of these rights.

ClassesFlow may be used by educational institutions to provide services to students under the institution's direction and applicable agreement. Features offered to minors must be authorized and configured consistently with the institution's agreement, applicable law, and the terms of the enabled service providers.

For institutional deployments, the institution controls the educational relationship and authorizes ClassesFlow to process education records as a school official or service provider under FERPA and the applicable contract. We use that information only to provide the service and do not use it for advertising or model training. Consumer use by a child under 13 without authorization from a parent, guardian, or educational institution is not permitted.

Our primary database and storage are hosted in the United States. Some AI features, including certain current image-generation routes, and customer-selected or globally delivered integrations may use global processing or process information in other countries. Where required, we use applicable contractual and transfer safeguards.

We use industry-standard measures to protect your information, including encryption in transit (TLS), encryption at rest for database and backup storage, scoped access credentials, and audit logging. No system is perfectly secure; we will notify affected users without undue delay if a security incident materially affects your information.

To report a suspected security issue, email security@scalarintelligence.io.

We may update this policy from time to time. If a change materially reduces your rights or expands our use of your information, we will give you at least 30 days’ advance notice — by email or by a prominent notice in the Service — before the change takes effect. Minor or clarifying updates take effect on posting.

Questions about this policy or about how we handle your information? Email support@classesflow.com, or write to:

Scalar Intelligence LLC
5900 Balcones Drive STE 100
Austin, TX 78731
United States