Effective: June 2026
Privacy Policy
§11. Data Controller
ClassLingos ("we", "us") is a SaaS software service operating from the United States. Inquiries: privacy@classlingos.com.
§22. Scope of Service
ClassLingos is a cloud-based content authoring platform for independent ESL educators. We are NOT an accredited academic institution, tutoring service, or after-school training provider. We license interactive presentation layouts, voice synthesis tools, and worksheet generators.
§33. Personal Data We Process
(a) Account: email, name, password hash, country. (b) Technical: IP, browser fingerprint, session timestamps. (c) Usage: lesson generations, voice character counts. (d) Subscription: plan tier, billing status (NO card data stored — handled by Stripe when activated). (e) Content: lessons you create, vocabulary saved.
§44. Legal Bases
(i) Contractual necessity to deliver the service. (ii) Legitimate interest in maintaining security. (iii) Your explicit consent for marketing.
§55. International Transfers
Data processed on Cloudflare infrastructure (USA + global edge) under Standard Contractual Clauses recognized by the European Commission.
§65A. Sub-Processors
We use a small set of vetted providers to operate the service: Cloudflare (USA) — hosting, D1 database, R2 storage, WebRTC; Google (USA) — Gemini AI for text and voice; Amazon Web Services SES (USA) and Resend (USA) — transactional and parent-communication email delivery; Cartesia (USA) — voice synthesis; Stripe (USA) — payments (when activated). Email addresses you send to are processed by our email sub-processors solely to deliver your messages and are never sold or used for advertising.
§76. Retention
Account data: while active + 90 days. Audit logs: 12 months. Generated content: lifetime of account.
§87. Your Rights
ARCO (Access, Rectification, Cancellation, Opposition) + GDPR (portability, restriction, erasure). Complaints to INAI (MX), CNIL (FR), ICO (UK). Email: privacy@classlingos.com — 30-day response.
§98. Subscriber-Created Content & Audience Scope
ClassLingos is a content-authoring tool for adult educators (18+) who may create teaching materials for any age group (kids, teens, adults, business professionals, exam prep). If a subscriber USES our platform to teach minors, the subscriber remains the sole data controller of those minors' information. We do not collect data directly from end-students.
§109. Cookies
See /legal/cookies. Essential cookies (session) cannot be disabled. Analytics/marketing require consent.
§1110. Changes
Material changes notified via in-app banner 30 days before taking effect.
§1211. Encryption & Access Controls (June 2026 Security Standard)
High-risk personal data — parent phone numbers and WeChat IDs, two-factor secrets and data extracted from identity documents — is encrypted at rest with AES-256-GCM in addition to Cloudflare's storage encryption. Passwords are stored as bcrypt hashes (cost 12). Every data request is checked against row-level ownership; staff overrides are written to a security audit log. Session cookies are HttpOnly, Secure, SameSite=Lax with the __Host- prefix. Sign-in and public forms are rate-limited and protected by Cloudflare Turnstile.
§1312. Identity Documents (Verification Vault)
Documents you upload to verify a school or institution are stored in a private, non-public bucket. No permanent URL exists; the CEO opens them only through signed links that expire after 60 seconds, and the document is deleted after the review decision. AI pre-screening reads the document once to extract the institution name and confidence score; that extract is encrypted.
§1413. AI Assistants & Guardrails
Our text assistants are confined to ClassLingos support and ESL teaching. Off-topic requests are refused, messages are limited to 1,000 characters, and guests have a daily allowance. Conversations are kept with your account, never sold and never used to train third-party models. Refused requests are logged by topic and length only.
Got a legal question?
We reply within 2 business days: legal@classlingos.com