Privacy Policy

Introduction

Classentra is an independent live-course operating system built for teachers who run their own classes. This Privacy Policy covers the Classentra service at classentra.com and all related dashboards, APIs, and emails we operate.

Classentra is operated by Classentra Technologies Inc., a corporation incorporated under the Canada Business Corporations Act with its registered office at First Canadian Place, 100 King Street West, Suite 5700, Toronto, Ontario, Canada M5X 1C7. Classentra is subject to Canadian federal privacy law (PIPEDA), Quebec's Act Respecting the Protection of Personal Information in the Private Sector (commonly referred to as Law 25) for any Quebec residents using the service, and equivalent regimes (GDPR, UK GDPR, Australian Privacy Principles, etc.) where applicable based on user location.

It applies to everyone who interacts with Classentra: teachers who create accounts to run courses, students who enrol in those courses, guests who register for a live class without an account, and visitors who browse the marketing site.

For any privacy questions, email privacy@classentra.com. We aim to respond within 30 days.

Data We Collect

From account creation and sign-in

• Email address
• First name, last name, and optional title (teachers)
• Role (teacher or student)
• Password hash: we never store plain-text passwords
• OAuth identifiers when you sign up via Google (user id, email, display name, avatar URL)
• Email verification status
• Session tokens, stored server-side and expired automatically

From product usage

• Courses you own or are enrolled in, including title, description, dates, and visibility
• Course items: announcements, materials, assignments, submissions, notes, sessions, files, and links
• Messages, reactions, and read receipts in course and direct message channels
• Personal and course-derived calendar events
• Notifications
• Attendance records
• Grades and feedback on submissions
• Files you upload, stored in Cloudflare R2

From billing (teachers only)

• Stripe customer id
• Plan, billing interval, billing currency, subscription status, and current period end
• Pending plan change information
• Invoices and payment method metadata such as card brand, last 4 digits, and expiry: full card details are stored by Stripe, never by Classentra

From paid course sales (teachers only)

• Stripe Connect account id, status, country, and onboarding state: full Connect account details are stored by Stripe, never by Classentra
• Course purchase records: student id, teacher id, course id, gross price, currency, application-fee amount, status, and Stripe payment-intent id
• Coupon redemption records: coupon id, course-purchase id, discount amount, and timestamp
• Monthly Gross Merchandise Volume (GMV) aggregates per teacher: gross sales total, refunds, fee total, course count, and student count
• Active-student activity ledger: a 30-day rolling list of (teacher, student) pairs that had a paid enrollment, used to enforce active-student caps
• Plan-cap state: the current cap-utilisation snapshot per teacher (NORMAL / WARNING / GRACE / HARD_BLOCK) and the timestamps that gate transitions between them
• Fraud-signal records: system-generated risk events on a teacher account (e.g., high coupon redemption rate, off-platform link in description) with status (OPEN / DISMISSED / ESCALATED)
• Policy acceptance records: which version (sha256 hash) of the Terms of Service, Privacy Policy, Instructor Agreement, and Community Guidelines you have accepted, plus the timestamp of acceptance

From AI features

• AI requests initiated by teachers or students, including the course context grounded into each request
• Usage counters such as AI units per month

From live sessions

• Native live class participation (participant-minutes and recording metadata when applicable) via LiveKit
• External meeting URLs you paste in (Zoom, Meet, Teams)
• If you register as a guest for a live class without an account: the name and email address you give, whether the host approved you, your language, and a keyed hash of your IP address (not the address itself) used to limit abuse
• Captions and transcripts of what is said in classes, recordings, and uploaded or submitted audio and video, and the record of which participant a host named as captioner (see "Captions, Transcripts, and Audio")

Automatically collected

• Page view analytics via Vercel Web Analytics: cookieless, with country-level geolocation derived from IP
• Rate-limit tracking (IP address and request counts), purged automatically when the window expires
• Standard server logs (request path, timestamp, user agent) retained for security and debugging
• Aggregate page-view counters and UTM parameters via first-party cookies (cls_attrib, cls_utm) on course storefronts. Raw uniqueness lookup pruned after 30 days; daily aggregates retained at the course level only (no PII).
• Product analytics via PostHog, US-hosted, loaded only after you grant analytics consent. Separately, for signed-in users, we record server-side product milestones (account created, course created, course published, checkout started, purchase completed) against your account rather than a browsing profile; these are never used for advertising.

What we do not collect

• We do not collect precise location: no GPS, no coordinates, and no location inferred from your IP address or device. The finest location we ever hold is a city you pick yourself from a list, and only if you turn that on (see Community Member Maps).
• We do not build or store a device fingerprint, and we do not track you across other sites. Browser signals are processed only by Cloudflare's anti-abuse challenge on our public forms, by Stripe's payment-fraud checks on billing pages, and, once you accept marketing cookies, by a Teacher's own advertising tags on their storefront; each is described under "Who We Share Data With"
• We do not use marketing or advertising cookies for Classentra's own marketing. The only advertising tags on the service are the Meta Pixel or Google tag a Teacher may configure on their own course storefront pages; they load only after you accept marketing cookies, and you can withdraw that consent at any time (see "Who We Share Data With")
• We do not sell personal data. Some laws treat the Teacher-configured storefront advertising tags described above as "sharing" personal data; you can opt out of those tags at any time: on classentra.com from Privacy preferences, linked in the site footer as "Do Not Sell or Share My Personal Information", and on a Teacher's own domain from the "Cookie preferences" link at the bottom of every page

How We Use Data

• Deliver the core service: account management, course workflows, messaging, assignments, grades, and live sessions
• Personalize the teacher and student dashboards
• Send transactional email such as verification, password reset, billing receipts, and notifications
• Process payments via Stripe (teachers only)
• Generate AI suggestions grounded in your course content, teacher-controlled and opt-in per action
• Make captions and transcripts of live classes, recordings, and uploaded or submitted audio and video, so they are accessible (see "Captions, Transcripts, and Audio")
• Prevent abuse and secure the platform through rate limiting, disposable-email blocking, and session management
• Monitor performance and stability via Vercel telemetry
• Trust and safety: reviewing content and account activity when investigating reports, suspected fraud, security incidents, or legal obligations (see "Trust, Safety, and Content Review")
• Comply with legal obligations

Legal Basis (GDPR / UK GDPR)

If you are in the EU, UK, or another jurisdiction that requires a legal basis for processing personal data, we rely on the following bases:

• Contract: to provide the service you signed up for
• Legitimate interests: for security, fraud prevention, trust-and-safety content review, service improvement, and analytics
• Consent: for optional AI features and optional email notifications where consent is the applicable basis
• Legal obligation: for tax records and responding to lawful requests

Who We Share Data With

Classentra uses the following subprocessors. Data is shared with them only as needed to provide the service.

• Vercel: application hosting and Web Analytics (US / global)
• Neon: PostgreSQL database hosting (US)
• Cloudflare R2: file storage for materials, submissions, and assets (global)
• Stripe: payment processing, invoicing, and billing management; on billing pages Stripe.js also collects device and browser signals for Stripe's Radar fraud checks and sets its own identifier cookies (__stripe_mid, __stripe_sid) (US / global)
• OpenAI: AI generation, teacher-routed and course-grounded, and speech-to-text for captions and transcripts, so it receives audio (see "Captions, Transcripts, and Audio") (US)
• LiveKit: native live class video infrastructure (US / global)
• Resend: transactional email delivery (US)
• Namecheap Private Email: hosting of our own mailboxes (support@, privacy@ and our other addresses), so it holds the emails you send us and our replies (US)
• Google: OAuth sign-in, only if you choose to sign up with Google (US)
• PostHog: product analytics, feature flags, and A/B experiments (US)
• Sentry: error reports carrying only a pseudonymous account id, with no name, email, or message content (US)
• Cloudflare Turnstile: anti-abuse challenge on our public forms; your IP address and browser signals are sent to Cloudflare when a form loads the challenge (US / global)
• LangSmith (LangChain, Inc.): tracing of AI prompts and outputs for debugging and quality review, when tracing is enabled (US)
• Browser push services (Google, Apple, Mozilla): delivery of the notification payloads you opted into, routed through your browser vendor's push service (US / global)

We do not share personal data with advertisers, data brokers, or any third party not listed above. Separately, a Teacher may configure a Meta Pixel or Google tag on their own course storefront pages. Those tags load only after you accept marketing cookies, and they report page views and purchase events on those pages to Meta or Google as the Teacher's advertising data, under the Teacher's own privacy terms.

Captions, Transcripts, and Audio

To make classes and course media accessible, Classentra turns speech into text in the four places below. In each of them, audio can be sent to our speech-to-text provider, OpenAI, which processes it in the United States (see "International Data Transfers"). We don't keep a separate copy of the audio we send: recordings (with the audio track we record alongside them for captions), uploads, and submissions stay stored as they already are, and live-caption clips are never stored on our side. OpenAI processes the audio under its data processing agreement with us and does not use it to train its models. When AI tracing is on, the text that comes back may be logged in LangSmith like other AI output; the audio never is.

Live captions

Anyone in a live class can ask for captions, and a teacher can set a course so that captions are asked for from the start of every class. Each person whose microphone is on is then asked once in each browser they use whether their speech may be captioned. Nothing you say is live-captioned until you allow it, and you can stop at any time from the caption bar. Your answer is saved in your browser, not on our servers. If you decline, the people who asked for captions are told that some speakers have not allowed captions; you are not named.

Live captions are usually made by your own browser's speech recognition, and we don't receive your audio. Your browser's maker may process it to recognize speech (for example Google for Chrome, Microsoft for Edge, or Apple for Safari) under that company's own privacy terms. If you allowed captions and your browser can't make them, or stops partway through, your browser sends short clips of your own microphone, a few seconds each, to us instead, and we pass them to OpenAI to turn into text. This applies to registered guests who join without an account as well as to signed-in participants. Clips your browser measures as silent are not sent. We don't store the clips: each one exists only while it is being transcribed.

The caption text, with your display name, is shown to the other people in the class. We store it only if the host turns on "Record transcript", which shows a banner to everyone in the class. A stored transcript is kept with the class. The people who run the course's live classes can read it; enrolled students can read it while the class is live, and afterwards only if the host allows it. Captions of guests' speech are never stored.

A host can also name one person in the class as its captioner, who types captions that everyone sees, shown with the captioner's name. Typed captions stay in the class and are not sent to OpenAI; they are stored like other captions when "Record transcript" is on. While a captioner is present, no one is captioned automatically, so no audio is sent for live captions.

Recorded classes

Everyone in a class is told when it is being recorded. We may then send the recording's audio to OpenAI to make captions, and we keep the captions with the recording. They cover everything said in the recording, whatever you answered about live captions.

Uploaded audio and video

When a teacher uploads audio or video as course material, or to an assignment, an announcement, or a repertoire piece, we may send its audio to OpenAI to draft captions for it. The draft is marked as automatic, and the teacher can correct, replace, or remove it.

Student audio and video submissions

When a student submits audio or video for an assignment, we may send its audio to OpenAI for a transcript, which we keep as captions on the submission. On plans with AI features, the transcript is also used to draft feedback suggestions for the teacher.

Where audio is never sent

We never send audio to OpenAI from a class with HIPAA mode or end-to-end encryption on, from a course on the healthcare plan, or from a course with any class in HIPAA mode. In those classes and courses, live captions come only from each speaker's own browser or from a captioner the host names, and the class recordings are not captioned automatically. In a course on the healthcare plan or with any class in HIPAA mode, uploads and submissions are not captioned or transcribed automatically either. End-to-end encryption protects only the class it is on: it does not stop the course's other uploads and submissions from being transcribed.

In those classes, your browser's own speech recognition may still send your audio to the browser's maker, as described under "Live captions", if you allow captions. If you don't want that, decline captions; a captioner the host names can cover you instead.

Trust, Safety, and Content Review

A small number of authorized Classentra staff can access content stored on the platform — course materials (including drafts), assignments and submissions, community threads and replies, course chat, and file attachments — through internal tools built for a limited set of purposes: investigating reported or suspected violations of our Terms of Service or Community Guidelines, detecting and preventing fraud and abuse, securing the platform, complying with legal obligations and lawful requests, resolving billing or refund disputes, and diagnosing or verifying a reported problem with the service.

Direct messages and support conversations are treated as private correspondence. They sit behind a separate, more restrictive internal permission than course content, and are accessed only when a specific investigation of the kinds listed above requires it — never as part of routine review.

Safeguards on staff access

• Least privilege: staff hold only the access categories their role requires, and private correspondence requires a second, separately granted permission
• Every access is logged: opening a course, profile, conversation, or file through these tools writes an audit record with the staff member's identity, a timestamp, and a stated reason
• Staff access never registers as student or teacher activity: view counts and engagement statistics are unaffected
• Content accessed for review is never used for marketing and never used to train AI models

Outside these purposes, Classentra staff do not browse or read your content. Routine operations rely on aggregate numbers and metadata — counts, titles, statuses — not on the content itself.

Aggregated and De-Identified Data

We may create aggregated, anonymized, or de-identified data from personal information collected through the Service. This data is processed so that it cannot reasonably be used, alone or in combination with other information we hold, to identify any individual. Once data has been irreversibly de-identified, it is no longer considered personal information under PIPEDA, Quebec Law 25, the GDPR, the UK GDPR, or comparable laws.

We may use, retain, and share aggregated or de-identified data for any lawful purpose, including: operating, securing, and improving the Service and its AI features; training and evaluating models and other components we develop; producing benchmarks, statistics, and research reports about live teaching and online education; publishing case studies, marketing materials, and aggregated industry insights; and disclosing such data to subprocessors, advisors, partners, investors, or a successor entity in a business transaction.

We do not sell personal information, and we do not attempt to re-identify de-identified data or combine it with other data in a way that would reasonably allow re-identification. To the extent any law treats the Teacher-configured storefront advertising tags as "sharing" personal information, you can opt out of those tags at any time: on classentra.com from Privacy preferences ("Do Not Sell or Share My Personal Information" in the site footer), and on a Teacher's own domain from the "Cookie preferences" link at the bottom of every page.

Community Member Maps

Some communities on Classentra show a map of member locations. Appearing on it is entirely opt-in: nothing about your location is shown to other members unless you turn it on yourself, step by step, in your account settings or on the community's Map tab.

Step one is your country. If you opt in, we place a pin using the country you select from a list. We never infer your location from your IP address, device, browser or any other signal. We record the exact time you opted in as your consent record under Quebec Law 25.

Step two, optional, is your city. You pick it from a bundled list of the world's cities with more than 15,000 people; you cannot type a city of your own, and we do not look it up anywhere. We store the city's identifier and the time you chose it, not a coordinate: the city's name and a coarse centre point come from the list when the page renders. Your city is the finest location we hold. Members of the same communities who have also shared theirs see it, in a "Near you" list ordered by city-to-city distance, and only when the community's host has turned that list on. Turning your city off removes it at once.

Step three, optional, is member messages. Members near you who have also turned this on can send you direct messages, in communities whose host allows it; you can message them back. It is for members 18 or older: you confirm your age when you turn it on, and we record that confirmation and the time you opted in. You can block a member at any time (they are not told), report a message to our team, and turn member messages off, which closes the door again. New conversations are capped per hour to limit abuse. Reported messages are read by authorized staff under the stricter permission described in "Trust, Safety, and Content Review".

Your country, city and messaging choices are used only for community member maps, the Near you list and member messages. They are not used for advertising, analytics, pricing or any other purpose, and they are not shared outside the communities you belong to. Your organization's administrators can turn member maps off for every community their instructors run.

The city list comes from GeoNames (geonames.org) under the CC BY 4.0 licence. It is bundled with Classentra; no request leaves our servers to look a city up.

You can turn any step off at any time from your account settings. Turning off your country also clears your city and your messaging choice; turning off your city clears your messaging choice. Each change takes effect immediately, with no residual copy kept for these features, and the same fields are included in your data export and deleted with your account.

International Data Transfers

Classentra hosts its primary application and database in the United States (Vercel iad1, Washington D.C., and Neon aws-us-east-1, Virginia). Most of our subprocessors (Vercel, Neon, Stripe, Resend, OpenAI, LiveKit, Cloudflare, PostHog, Sentry) are also based in the United States or operate primarily from US regions. By creating an account, you understand that your personal information will be transferred to and processed in the United States and other jurisdictions in which our subprocessors operate.

We rely on the following safeguards to protect cross-border transfers, depending on where you live:

• EU/EEA, UK, and Switzerland: Module 2 Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with the UK ICO International Data Transfer Addendum or IDTA where applicable, and the Swiss FDPIC adaptations. Where the recipient is self-certified to the EU-US Data Privacy Framework, that adequacy decision applies in addition. We have completed a Transfer Impact Assessment as required by Schrems II.
• Canada (Quebec residents): before personal information is communicated outside Quebec, we assess it in a privacy impact assessment, as section 17 of Quebec's private-sector privacy Act requires, and we document that assessment.
• Canada (other provinces): PIPEDA's accountability principle applies; we remain accountable for personal information transferred to processors and require comparable protection by contract.
• Australia: Disclosure under APP 8. We remain accountable for the overseas recipient's compliance with the Australian Privacy Principles.
• Other jurisdictions: equivalent contractual safeguards (consent, comparable-protection clauses, or local mechanisms) apply.

A current list of our subprocessors, their locations, and the safeguards in place is published at classentra.com/subprocessors and is also available on request by writing to privacy@classentra.com. Notable processors and their primary regions: Vercel (US, application hosting), Neon (US, database), Stripe (US, payments), Resend (US, email), OpenAI (US, AI features and speech-to-text), LiveKit (US, live video), Cloudflare R2 (US, file storage), PostHog (US, product analytics), Sentry (US, error tracking).

Some countries impose hard data-residency or local-storage requirements that we cannot satisfy at this time (notably China, Russia, Vietnam, Kazakhstan, and any country subject to comprehensive Canadian or US sanctions). Account creation from these jurisdictions is not permitted. Existing users who travel to these regions may experience interrupted access.

Data Retention

• Account data: kept while your account is active. When you delete your account we erase it at once: your sign-in and linked accounts, sessions and devices, profile, preferences, student work, and uploaded files nothing else refers to. What the law requires us to keep (below) stays linked to a pseudonymous account record: an internal id with no name, email, or profile. A nightly job removes that record once the last retention period ends.
• Course content: kept while the owning teacher's account is active. Deleting a course permanently removes its items, materials, and messages. When a teacher deletes their account, courses with no sales, no paid memberships or packs, and no trust-and-safety report are deleted with it; the others are archived so buyers keep their access and receipts.
• Messages: retained while the course or conversation exists. Deleted when the course or a participant is fully removed.
• Class recordings, the audio track recorded with them for captions, and their captions: kept until the teacher deletes the recording, the class, or the course. Deleting a recording removes its video and caption-audio files.
• Stored live-class transcripts (only when the host turned on "Record transcript"): kept with the class until the class or the course is deleted. The lines you spoke stay in that class's transcript, under the display name you had then, even if you later delete your account.
• Captions and transcripts of uploaded and submitted audio and video: kept with the file or submission and deleted with it.
• Live-class records of host actions (such as starting a recording, refusing captions in a protected class, or naming a captioner, which stores the captioner's account id or guest registration id): kept with the class until the class or the course is deleted.
• Payment and tax records (course purchases, payment plans, session and usage packs, payout releases, refunds, affiliate records, seller tax profiles, and reportable-activity records): kept for 7 years after account deletion, as tax law requires. Sellers with a tax profile or reportable activity also keep their email address on the pseudonymous record for that period, so a tax authority can reach them.
• Automatic-renewal consent records: kept for 4 years after account deletion, with the email address, as evidence of the consent you gave.
• Policy acceptance records, fraud signals, account suspensions, monthly sales aggregates, and coupons that were redeemed: kept while the account exists and for 24 months after its deletion.
• Trust-and-safety reports: kept indefinitely as a legal hold, together with the course they concern.
• Student activity: one last-seen date per student and teacher, used to count active students over the last 30 days; removed when either account is deleted.
• Plan-cap state: retained while the teacher account is active.
• Rate-limit logs: purged automatically after the window expires.
• Telemetry and analytics: subject to Vercel's default retention windows.

Survey & onboarding responses

When you create a Classentra account, we ask you a short series of multiple-choice questions about your goals, current platforms, audience, budget, and other preferences. We use your answers to:

• Personalize the in-app experience (default dashboard view, AI assistant tone, suggested templates).
• Improve Classentra's product roadmap by understanding what teachers and students actually need.
• Publish aggregated, de-identified insights about the teaching and learning market: for example, "47% of music teachers report difficulty finding their first ten students." We will never publish individual responses or responses linked to identifiable users.

Retention

We keep your individual survey responses for up to 5 years from the date you submit them. After 5 years they are automatically deleted. Aggregated, de-identified statistics derived from your responses may be retained indefinitely.

Your rights

• You can review your responses and download them as JSON via your data export from your account settings.
• You can delete your responses at any time by deleting your account, or by emailing privacy@classentra.com.
• Under Quebec Law 25, PIPEDA, GDPR (where applicable), and CCPA (where applicable), you also have a right to be informed about, access, correct, and request deletion of this data.

No third-party sale of identifiable responses

We do not sell, rent, or share individual identifiable survey responses with third parties. If we ever introduce a third-party data-sharing program, we will ask for your explicit opt-in first and update this policy.

Your Rights

Depending on your jurisdiction you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (the right to be forgotten)
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent for consent-based processing
• Lodge a complaint with your local data protection authority: in Quebec, the Commission d'accès à l'information du Québec; elsewhere in Canada, the Office of the Privacy Commissioner of Canada; in the EU or UK, your local supervisory authority

To export your data in a portable format, sign in and use the "Download my data" button in Settings. We email you a signed download link within a few minutes. To delete your account and associated data, use the "Delete Account" button in Settings. To exercise any other right, email privacy@classentra.com. We will respond within 30 days.

Security

• Passwords are hashed and never stored in plain text
• Sessions are stored server-side with automatic expiry
• Disposable email addresses are blocked at sign-up
• Rate limiting protects against brute force and abuse
• All traffic to classentra.com is served over HTTPS
• Card data never touches Classentra servers: Stripe Elements handles card entry directly (PCI SAQ-A)

Children

Classentra is not directed at children under 13 (or 16 in the EEA). Teachers who use Classentra with minors are responsible for obtaining parental or guardian consent and for ensuring compliance with local child-protection law, including COPPA in the United States.

Business Transfers

If Classentra is involved in a merger, acquisition, financing, corporate reorganization, bankruptcy, receivership, sale of all or substantially all of its assets, or any other transaction that results in a change of ownership or control, your personal information may be transferred as part of that transaction or due-diligence process, subject to standard confidentiality protections.

We will require the successor entity, acquirer, or new operator to honour the commitments in this Privacy Policy with respect to your personal information. If the successor adopts materially different privacy practices, we will notify you by email or in-product notice before those changes take effect and give you a reasonable opportunity to access, export, or delete your data, and, where required by law, to withdraw your consent.

Quebec residents: this disclosure is made in accordance with section 18.4 of Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25). Your rights of access, rectification, deletion, and withdrawal of consent under Law 25 continue to apply against any successor entity, and you will be notified before any communication of your personal information for the purpose of concluding a commercial transaction that is not already covered by this Policy.

EU/UK residents: any such transfer will continue to rely on the safeguards described in the International Data Transfers section, including the Standard Contractual Clauses where applicable.

Changes to This Policy

We will post updates to this policy on this page and bump the "Last updated" date at the top. Material changes will be communicated via email or an in-product notification before they take effect.

Contact

For privacy questions, data requests, or concerns about how Classentra handles your information, email privacy@classentra.com.

The person in charge of the protection of personal information at Classentra Technologies Inc., for Quebec's private-sector privacy Act, is our Privacy Officer, reachable at privacy@classentra.com.