Privacy Policy

We collect information in three buckets:

• Account information. Your email address; a display name; and, if you sign in via a third-party identity provider (such as Google), the basic profile information that provider returns (name and email). We do not store passwords for federated sign-ins.
• Service-use information. The classrooms, scenes, quizzes, prompts, files, and interactive content you create or upload; the AI Output generated for you; usage events such as generation requests, chat turns, and student-spot allocations; and basic device and browser metadata necessary to deliver the Service (IP address, user-agent string, request timestamps).
• Billing information. When you purchase a subscription or student-spot pack, payment is processed by Stripe. Stripe collects and holds your card details directly; we receive only the limited records needed for billing (customer ID, plan, transaction ID, country of residence for tax purposes, and the last four digits of the payment method).

We use the information above to:

• Provide, secure, and improve the Service — including generating AI Output, syncing your work across devices, and protecting against abuse.
• Process payments, calculate applicable taxes, send receipts, and comply with tax-reporting obligations.
• Respond to support requests and notify you about material changes to the Service or this policy.
• Aggregate usage statistics that do not identify you, so we can understand which features matter.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information. We do not use it for third-party advertising, and we do not allow our sub-processors to use it for their own marketing.

The Service uses third-party AI providers to generate text, images, audio, and other AI Output from your prompts and uploads. When you submit a prompt or file, that material is sent to the AI provider via an API request to fulfil your request.

We contract with AI providers that do not retain your inputs to train their general-purpose models. Where a specific provider retention policy differs, we will disclose that fact and give you a choice. AI Output is stored in your account so you can revisit it later; you can delete it from your account at any time.

To operate the Service we share necessary information with the following sub-processors. Each is bound by contract or by their public terms to use the information only to perform the service they provide to us.

• Supabase (PostgreSQL database, authentication, file storage) — hosted in the United States.
• Vercel (web hosting, edge compute, content delivery) — multi-region with U.S. primary.
• Stripe (payment processing, tax calculation, customer portal) — global.
• Third-party AI providers (language, speech, and image generation) — currently including MiniMax, Synthetic, and Google (Gemini via Vertex AI). The specific provider used for a given request depends on the feature; we publish the current roster on this page and will update it when it changes.

We may add or replace sub-processors as the Service evolves; we will update this list before a new sub-processor begins handling your information.

We use cookies and similar browser-storage technologies (such as localStorage and IndexedDB) for three purposes:

• Authentication. To keep you signed in across pages and devices.
• Functionality. To remember your preferences, in-progress work, and recently-opened classrooms.
• Service integrity. To prevent abuse, enforce rate limits, and detect unusual sign-in patterns.

We do not use advertising cookies or third-party tracking cookies. You can clear cookies and local storage from your browser at any time; doing so will sign you out and remove cached work that has not been synced.

We retain your information for as long as your account is active and for the periods set out below after closure:

• Classroom and content data — deleted within 30 days of account closure or on your request, whichever is sooner.
• Account and authentication records — deleted within 30 days of account closure.
• Billing records — retained for at least seven (7) years to satisfy U.S. tax and accounting obligations, then deleted.
• System logs and security events — retained for up to 90 days, then deleted in the ordinary course of operations.

Backups containing your information are retained on a rolling basis and are overwritten within 35 days. We do not restore from backups solely to satisfy a deletion request.

Subject to applicable law, you have the right to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email support@classesflow.com from the address on your account. We will respond within 30 days and may extend by an additional 30 days for complex requests.

Depending on where you live, you may also have specific rights under the California Consumer Privacy Act, the Texas Data Privacy and Security Act, the EU/UK GDPR, or other laws. We honour these rights regardless of whether the relevant statute strictly applies to us.

You will not be discriminated against for exercising any of these rights.

The Service is intended for educators and other adults. Account holders must be at least 18 years old.

Educators may use the Service to design instructional content for learners of any age. When you do, you are responsible for obtaining any consents required under the Children’s Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), and analogous laws in your jurisdiction. We do not knowingly collect personal information directly from children under 13. If we learn that we have, we will delete it promptly.

We and our sub-processors operate primarily in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. We rely on standard contractual clauses or other appropriate safeguards for transfers from regions that require them.

We use industry-standard measures to protect your information, including encryption in transit (TLS), encryption at rest for database and backup storage, scoped access credentials, audit logging, and routine review of access. No system is perfectly secure; we will notify affected users without undue delay if a security incident materially affects your information.

We may update this policy from time to time. If a change materially reduces your rights or expands our use of your information, we will give you at least 30 days’ advance notice — by email or by a prominent notice in the Service — before the change takes effect. Minor or clarifying updates take effect on posting.

Questions about this policy or about how we handle your information? Email support@classesflow.com, or write to:

Scalar Intelligence LLC
5900 Balcones Drive STE 100
Austin, TX 78731
United States