1. Who we are and what this covers

ClassyLMS (“ClassyLMS”, “we”, “us”) is a multi-tenant learning-management platform operated by [Company Legal Name], [registered address]. This Privacy Policy explains how personal data is handled when organizations (schools, academies, training providers) and their instructors and students use the platform at classylms.com and its organization subdomains.

2. Our role: controller vs processor

ClassyLMS is a business-to-business platform. For most data about instructors and students, the organization that invited or enrolled them is the data controller — it decides what data to collect and why — and ClassyLMS acts as the data processor, handling that data on the organization’s behalf and under its instructions.

ClassyLMS is itself a controller only for limited data: platform sign-in accounts, security and audit logs, billing/subscription records, and communications with us. If you are a student or instructor, your organization is your first point of contact for questions about your data; we will direct certain requests to them accordingly.

3. Data we process

• Account data: name, email address, role, organization membership, and authentication identifiers.
• Organization & academic records: course and batch enrollments, instructor assignments, attendance, assessments/grades, and related history provided or generated by the organization.
• Content: material you create or submit — questions, answers, messages, and uploads.
• Live class & recording data: audio/video and chat during live sessions, and recordings of those sessions where enabled (see Section 7).
• Technical & usage data: device/browser information, IP address, log and diagnostic data, and session cookies needed to keep you signed in.

4. How and why we use data

We process data to provide and secure the platform, including to:

• authenticate users and operate organization workspaces;
• deliver courses, live classes, recordings, assessments and related features;
• maintain academic and administrative records on the organization’s behalf;
• secure the service, prevent abuse, and keep audit logs;
• provide support and send service communications (e.g., password resets);
• comply with legal, financial, and regulatory obligations.

Where the law requires a legal basis (e.g., GDPR) or a lawful ground (e.g., India’s Digital Personal Data Protection Act, 2023), processing relies on the organization’s instructions and legitimate interests, performance of the service, your consent where applicable, and compliance with legal obligations.

5. Service providers (sub-processors)

We use trusted providers to run the platform. Data may be processed by:

• Google Firebase — authentication, database, and hosting.
• LiveKit — real-time audio/video for live classes.
• Cloudflare R2 — storage of class recordings.
• Resend — transactional email delivery.

These providers process data only to provide their service to us. Some may process or store data outside your country; where required, appropriate safeguards are applied for such international transfers.

6. Sharing

We do not sell personal data. Data is shared within your organization (with its administrators and your instructors), with the sub-processors above, and where necessary to comply with law, enforce our terms, or protect rights and safety.

7. Live classes and recordings

Live classes may be recorded by an organization’s instructors or administrators. Recordings are stored privately and are accessible only to authorized people in the relevant batch — enrolled students, the batch’s instructors, and the organization’s administrators. Because a recording is part of the organization’s academic record, an individual participant cannot unilaterally require its deletion; requests are handled by the organization subject to the retention rules below.

8. Data retention

Personal data is retained for as long as your account is active and for as long as the organization needs it for the educational service. After that, the organization (as controller) may retain academic and financial records to meet its legal, tax, accreditation, and dispute-resolution obligations — typically for [retention period, e.g. up to 7 years] — after which data is deleted or anonymized. Platform security and audit logs are kept for [log retention period].

9. Account lifecycle and your rights

Subject to applicable law, you may request to access, correct, or export your personal data, close/deactivate your account, or request erasure. Two points are specific to this platform:

• Closing an account disables sign-in but does not erase the organization’s records of your participation (enrollments, grades, attendance, recordings), which the organization may retain as described above.
• Erasure requests are honored to the extent the law requires; where records must be retained for legal/financial reasons, we typically anonymize personal identifiers rather than delete the underlying business record.

Students and instructors should direct these requests to their organization’s administrator (the controller). You may also contact us using the details below and we will assist or route the request appropriately.

10. Security

We use technical and organizational measures to protect data, including access controls, encryption in transit, private storage for recordings, and audit logging. No system is perfectly secure, but we work to protect your information and to respond to incidents responsibly.

11. Minors

Where students are minors, the organization is responsible for obtaining any consent required from a parent or guardian under applicable law before the student uses the platform. We process minors’ data only on the organization’s instructions.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the platform or by email, and the “Last updated” date above will be revised.

13. Contact and grievances

For privacy questions or to exercise your rights, contact us at support@classylms.com. Our designated contact / grievance officer (as applicable under the Digital Personal Data Protection Act, 2023) is [Name, title, email]. If you are in a region with a data protection authority, you also have the right to lodge a complaint with it.