Privacy Policy

1. Who we are

Classario is operated by Lenedo Tech FZ-LLC, Dubai, UAE (Trade Licence No. 105312, Free Zone Limited Liability Company). We are the data controller for account, billing and website data. Where a tutor or school uses Classario to manage their own students, we act as a data processor on their behalf — see our Data Processing Agreement.

For any privacy request, including access, correction, export or deletion, write to support@classario.com.

2. Information we collect

We collect only what the service needs to work:

• Account data — name, email address, role (tutor, school administrator or student), interface language, and an authentication credential handled by our authentication provider.
• Content you create — lessons, materials, exercises, whiteboards, homework, and the lesson briefs you give to Cleo AI.
• Class and student records — the data a tutor or school adds to run their classes, such as student names, scheduling, attendance, submissions, feedback and grades.
• Billing data — plan, subscription status and invoices. Card details are entered directly with our payment provider and never reach our servers.
• Technical and usage data — IP address, device and browser information, and product events used to keep the service secure and to improve it.
• Google Calendar data — only if you choose to connect your own Google account, as described in section 4.

3. How we use information

We use personal data to run the service, and for no unrelated purpose. We do not sell personal data, and we do not use it for advertising profiles.

• To create and administer accounts, spaces and subscriptions.
• To deliver the product: live classrooms, lesson building, whiteboards, homework, scheduling and progress tracking.
• To generate lesson drafts when you ask Cleo AI to do so.
• To send transactional email such as sign-in links, invitations and service notices.
• To provide support and to respond to your requests.
• To detect, prevent and investigate abuse, fraud and security incidents.
• To meet legal, tax and accounting obligations.

4. Google user data

Classario offers one optional Google integration: a Google Calendar connection that a member can enable for their own account. It is off until you explicitly connect it, and you can disconnect it at any time.

Scopes we request — we request the narrowest scopes that make the feature work:

• calendar.readonly — to display your existing primary-calendar events alongside your Classario lessons, so you can see conflicts when scheduling. This is read-only.
• calendar.app.created — to create and manage only the dedicated "Classario Lessons" calendar that Classario itself creates. This scope cannot modify any of your other calendars.
• openid and email — to identify which Google account is connected.

4.1 How we access, use, store and share Google data

• Access — we call the Google Calendar API only to read events for the date range you are currently viewing, and to write lessons into the dedicated Classario Lessons calendar. We do not access Gmail, Drive, Contacts, Photos or any other Google service.
• Use — Google Calendar data is used solely to render your schedule inside Classario and to keep the Classario Lessons calendar in sync. It is never used for advertising, profiling, resale or analytics.
• Storage — we store your OAuth refresh token, encrypted at rest with AES-256-GCM in a table reachable only by a privileged service role. Calendar events themselves are fetched on demand for display and are not accumulated into a long-term store.
• Sharing — Google user data is not shared with any third party. In particular it is never sent to OpenAI or to any other AI provider.
• Revocation and deletion — disconnect the integration inside Classario, or revoke access from your Google Account permissions page. On disconnection we call Google's token revocation endpoint and delete the stored credentials.

5. Limited Use of Google user data

Classario's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We do not use, transfer or sell Google Workspace user data — whether raw, aggregated, anonymised or derived — to create, train, fine-tune, evaluate or improve foundational or generalised artificial-intelligence or machine-learning models.
• We do not transfer Google Workspace user data to any third-party artificial-intelligence service. Google Calendar data is held in a separate code path from Cleo AI and is never included in a prompt, embedding, log or dataset sent to a model provider.
• We do not use Google user data for advertising, ad targeting or advertising profiles.
• Humans do not read Google user data, except with your explicit consent for a specific support request, where it is strictly necessary for security or abuse investigation, or where required by law.
• We do not sell Google user data under any circumstances.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

6. Artificial intelligence processing

Cleo AI turns a short lesson brief into a draft lesson. When you press generate, we send that brief to OpenAI and receive structured lesson content back.

The request contains only the brief you typed — interface language, subject, topic, optional focus, level, duration and whether you want homework. It contains no names, no email addresses, no student records, no submissions or grades, no uploaded files and no Google Calendar data.

We call OpenAI directly, server to server. We do not use an aggregator, gateway, proxy or model hub, and no other AI provider receives Classario data. The provider's terms prohibit training foundational models on our API inputs and outputs; we review those terms before integrating and whenever they change.

Full disclosure of the AI providers we integrate with:

7. Sub-processors and sharing

We never sell personal data. We share it only with the providers below, each bound by contract to process it solely on our instructions:

7.1 Other disclosures

We may also disclose personal data to professional advisers, or to authorities where disclosure is legally required, or where necessary to establish or defend legal claims or to protect the safety of users. If Classario is involved in a merger or acquisition, data may transfer to the successor entity under this policy.

8. Embedded third-party content

Lessons can embed content from services such as YouTube, Vimeo and interactive exercise tools. When a student opens a lesson containing an embed, the embedded provider may receive the request and set its own cookies. Those providers act under their own privacy policies. We only load embeds that a teacher has deliberately added to a lesson.

9. Data retention

We keep account and content data for as long as the account is active. After deletion we remove or irreversibly anonymise personal data within 90 days, except where we must retain records for legal, tax or accounting purposes.

Google Calendar credentials are deleted as soon as you disconnect the integration or delete your account.

10. Security

We use encryption in transit (TLS) and at rest, row-level access control in the database, encrypted storage of integration tokens and other secrets, least-privilege access for staff, and audit logging. Access to production data is limited to personnel who need it.

No system is perfectly secure, but we follow industry-standard practice and will notify affected users and the relevant supervisory authority of a qualifying personal-data breach without undue delay.

11. International transfers

Classario operates internationally and your data may be processed outside your country. Where personal data leaves the European Economic Area or the United Kingdom, we rely on an adequacy decision or on Standard Contractual Clauses with appropriate supplementary measures.

12. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to processing of your personal data, to withdraw consent, and to receive your data in a portable format. You also have the right to lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact support@classario.com. We respond within the period required by applicable law, normally within 30 days.

13. Children's privacy

Classario is sold to tutors and schools, not to children directly. Where a tutor or school invites a student who is a minor, that tutor or school is the controller of the student's data and is responsible for obtaining any parental consent required locally; we process such data only on their instructions. We do not knowingly create standalone consumer accounts for children without a school, tutor or guardian involved.

14. Cookies

We use a small number of cookies and similar technologies for sign-in, language preference and aggregate analytics. See our Cookie Policy for the full list and how to control them.

15. Changes to this policy

We may update this policy as the product evolves. Where a change is material we will notify you by email or in the product before it takes effect. The date at the top of this page always reflects the current version.

16. Contact

Lenedo Tech FZ-LLC, Dubai, UAE (Trade Licence No. 105312, Free Zone Limited Liability Company)

HD88C, First Floor, In5 Tech, Dubai Internet City, Dubai, United Arab Emirates

Email: support@classario.com