Data processing terms

These terms are part of the agreement between klass and each school that uses it (our Terms). They cover the personal data klass handles for the school. The school is the data controller; klass is its data processor, under the Nigeria Data Protection Act 2023. A school's admin accepts them for the school the first time they sign in.

• Whose: the school's students, their parents or guardians (a phone number and a record of agreement), and its staff.
• What: names, class, department, login IDs, optional recovery emails, parents' phone numbers, parent-agreement records, answers, scores and practice choices, sign-in times, lab-seat and laptop details, and support-access records. Our Privacy Policy lists it in full.
• Why: only to provide klass to the school, as described in the Terms, and to keep it secure.
• For how long: while the school uses klass, then as set out under "When the school leaves" below.

• To use the school's data only on the school's instructions: these terms, and what the school's staff do in klass. Never for our own purposes, never sold, never used for ads, and never used to train AI.
• To keep it secure: encrypted when sent and stored, each school kept apart from every other, and access limited to the school's own people.
• No standing access for klass staff. We look at a school's student records only when the school lets support in from its Privacy page, for a set time it can end at any moment, and every look is logged where the school can see it. The database's master key is used only to keep klass running.
• Everyone at klass who could reach the data is bound to keep it confidential.
• To help the school answer requests from students, parents and staff to see, correct or delete their data, and to pass on any such request we receive.
• To tell the school without undue delay, and within 48 hours of finding out, if its data is exposed, with what we know and what we're doing about it, and to help it meet its own duties, including telling the Nigeria Data Protection Commission.
• To give the school the information it reasonably needs to check we keep these promises.

The school agrees that klass may use these companies to run the service. Each is bound by a written agreement to protect the data and use it only for klass.

• Supabase

  The database, sign-in and file storage. Every account, answer and score is held here.

  Where: Ireland (EU)

• Vercel

  Runs the website and the app. Counts visits to our public pages, without cookies.

  Where: Ireland (EU) for the app's servers; pages are delivered from the nearest point of its worldwide network

• Resend

  Sends klass's emails: login details, password resets and reservation confirmations.

  Where: United States

• Anthropic

  Its AI, Claude, reads photos of a class's sign-up sheet so the names don't have to be typed. klass doesn't keep the photos.

  Where: United States

• Cloudflare

  Runs the address book (DNS) that points klass.school to the app.

  Where: Worldwide network

We'll tell schools at least 30 days before adding or replacing one. A school that objects can tell us, and if we can't resolve it, can stop using klass and pay nothing more for the time after the change.

Some of these companies are outside Nigeria. The database is in Ireland, under the EU's GDPR, and each provider's agreement with us carries the safeguards for data sent abroad.

• It has a lawful basis for putting its students and staff on klass, and the authority to enrol its students.
• It holds the consent of its students' parents or guardians, through its own forms, or records each parent's agreement in klass.
• Its instructions to klass are lawful, and the details it gives us are accurate.

The school can download every student's details from its Privacy page at any time, and should do so before it leaves. A school's data is deleted within 30 days of the school asking in writing, or of its agreement with klass ending. Backup copies are overwritten within 30 days after that.We'll confirm the deletion in writing if the school asks.

Email hello@klass.school, from the school's address for any request about the school's data.