Classroom Writer Privacy and Data Processing Notice

Last updated: 17 June 2026

Privacy Policy 2.1 Purpose of this Privacy Policy This Privacy Policy explains how Classroom Writer collects, uses, stores, and protects personal data. We aim to collect only the data needed to provide, secure, support, and improve the service.

2.2 What personal data we may process Classroom Writer may process the following types of data. Teacher and school account data • name; • email address; • school name; • role; • login details; • account settings; • legal acceptance records; • support requests; • subscription or billing status. Admin and school management data • school administrator names and email addresses; • user role information; • training access; • trial/access status; • contact details; • password/help support records. Student worksheet data Depending on how teachers use the platform, Classroom Writer may process: • student name or identifier entered into a worksheet; • worksheet answers; • typed responses; • selected answers; • drag-and-drop responses; • matching task responses; • canvas drawings or annotations; • uploaded or created content; • PDF export data; • worksheet access token or link data. Worksheet content Classroom Writer may process content uploaded or created by teachers, including: • instructions; • questions; • images; • equations; • answer boxes; • imported Word/PDF-style content; • diagrams; • canvas content; • simulations or links; • assessment content. Technical and security data We may process basic technical data needed to run and secure the service, such as: • IP address; • browser type; • device type; • log-in activity; • timestamps; • error logs; • security logs; • access token activity; • cookie or session information. Billing data Subscription and payment data may be handled by a payment provider. Classroom Writer may receive limited billing information such as: • subscription status; • plan type; • payment success or failure; • billing email; • customer ID from the payment provider; • invoice or transaction reference. Classroom Writer does not store full card details.

2.3 Why we use personal data We use personal data to: • create and manage accounts; • allow teachers to create and share worksheets; • allow students to complete worksheets; • save, process, and export worksheet responses; • manage school accounts and subscriptions; • provide support; • record legal acceptance; • secure the platform; • prevent misuse; • diagnose technical problems; • improve the service; • comply with legal obligations; • manage billing and subscriptions.

2.4 Legal bases for processing The legal basis depends on the user, context, country, and school arrangement. Possible legal bases may include: • contract, where we provide the service to teachers, schools, or subscribers; • legitimate interests, where we secure, maintain, and improve the platform; • legal obligation, where we must keep certain records; • consent, where consent is required for optional features or certain student uses; • public task or legitimate educational interests, where a school determines the lawful basis for student use. Schools are responsible for identifying the correct legal basis for student data processing in their own context unless otherwise agreed in writing.

2.5 Classroom Writer as processor and controller For teacher account data, billing data, support data, and platform operation data, Classroom Writer may act as a data controller. For student worksheet responses and student content processed on behalf of a school or teacher, Classroom Writer will usually act as a data processor, and the school will usually act as the data controller.

2.6 Student data and children’s privacy Classroom Writer is designed to support education. Student data should only be processed where a teacher or school has a lawful reason to use the service. Teachers and schools are responsible for: • deciding whether Classroom Writer is appropriate for their students; • providing privacy information to students and parents where required; • obtaining consent where required; • avoiding unnecessary student personal data; • not asking students to enter sensitive data unless clearly necessary and lawful; • managing student access links safely; • deleting or exporting student work when no longer needed. Classroom Writer does not knowingly ask students to create public profiles or use the platform for advertising.

2.7 Sensitive personal data Users should not upload sensitive personal data unless it is necessary, lawful, and appropriate for the educational purpose. Sensitive data may include health information, disability information, safeguarding information, political opinions, religious beliefs, biometric data, or other special category data. Teachers and schools should avoid including sensitive student information in worksheets unless their school has approved this use.

2.8 Data sharing Classroom Writer may share data only where needed to provide the service, such as with: • hosting providers; • authentication providers; • database providers; • payment providers; • email or support providers; • analytics or security tools, where used; • legal or professional advisers; • authorities where required by law. We do not sell student personal data. We do not allow third parties to use student worksheet responses for their own advertising purposes.

2.9 International data transfers Classroom Writer may use service providers located in different countries. Where personal data is transferred internationally, appropriate safeguards will be used where required, such as standard contractual clauses, adequacy decisions, or equivalent protections.

2.10 Data retention Classroom Writer keeps personal data only for as long as needed for the purpose it was collected. Retention approach: • Teacher accounts: kept while the account is active and for a reasonable period after closure. • School accounts: kept while the school agreement is active and for a reasonable period after closure. • Billing records: kept for the period required by tax, accounting, and legal rules. • Legal acceptance records: kept for as long as needed to show which terms were accepted. • Support records: kept for a reasonable period to manage support history and disputes. • Student worksheet responses: kept according to teacher or school settings, deletion requests, account status, or school agreement. • Expired worksheet links/tokens: deleted, disabled, or anonymised when no longer needed. • Security logs: kept for a limited period unless needed to investigate misuse or legal issues.

2.11 Deletion requests Users may request deletion of their account or personal data by contacting: info@classroomwriter.com Schools may request deletion of school-controlled student data. Where Classroom Writer acts as a processor, deletion requests from students or parents may need to be handled through the relevant school. We may need to keep some information where required by law, for billing records, legal records, fraud prevention, security, or dispute handling.

2.12 Access and correction requests Users may request access to or correction of personal data by contacting: info@classroomwriter.com If the request relates to student data controlled by a school, Classroom Writer may refer the request to the school or act according to the school’s instructions.

2.13 Security Classroom Writer uses reasonable technical and organisational measures to protect personal data. These include: • password-protected accounts; • access controls; • secure hosting; • encrypted connections where supported; • token-based worksheet access; • role-based admin access; • limited access to production data; • security logging; • backups where appropriate; • regular updates and maintenance. No online service can be guaranteed to be completely secure. Users and schools must also take care to protect passwords, devices, shared links, and exported files.

2.14 Data breaches If Classroom Writer becomes aware of a personal data breach, we will investigate and take appropriate action. Where required, we will notify affected schools, users, regulators, or individuals in line with applicable law. Where Classroom Writer acts as a processor, we will inform the relevant controller without undue delay after becoming aware of a breach.

2.15 Automated decision-making

If automated marking, AI feedback, analytics, or recommendation features are added in the future, this Privacy Policy will be updated before those features are used.

2.16 Changes to this Privacy Policy We may update this Privacy Policy from time to time. If changes are important, we will take reasonable steps to inform users, such as by email, account notice, or platform notice.

2.17 Contact For privacy questions or data requests, contact: info@classroomwriter.com

Data Protection Policy 3.1 Our approach Classroom Writer aims to protect personal data by design and by default. This means we aim to: • collect only the data needed; • use data only for clear purposes; • restrict access to authorised users; • keep data secure; • delete data when it is no longer needed; • help schools meet their data protection responsibilities; • be transparent about how the platform works.

3.2 Data minimisation Teachers and schools should avoid entering unnecessary student personal data into Classroom Writer. Where possible, teachers should use first names, initials, student numbers, class codes, or school-approved identifiers instead of unnecessary personal details. Students should not be asked to include private, sensitive, or unrelated personal information in worksheet responses.

3.3 Role-based access Classroom Writer will use role-based access where appropriate. This may include: • teacher access; • school admin access; • student worksheet access; • support access.

3.4 School-controlled student data Where a school uses Classroom Writer with students, the school is responsible for deciding: • which students use the platform; • what data is collected; • the purpose of the worksheet; • how long student work should be kept; • when student data should be exported or deleted; • what parents and students should be told. Classroom Writer will process student data according to the school’s instructions, unless the law requires otherwise.

3.5 Data Processing Agreement Schools may require a Data Processing Agreement before using Classroom Writer with student data. A Data Processing Agreement will cover: • the subject matter of processing; • the duration of processing; • the nature and purpose of processing; • the types of personal data; • categories of data subjects; • controller and processor responsibilities; • subprocessors; • security measures; • data breach notification; • deletion or return of data; • audit and assistance obligations; • international transfers.

3.6 Subprocessors Classroom Writer may use trusted subprocessors to provide hosting, database, authentication, payment, email, support, analytics, or security services.

A current list of subprocessors is available on request by contacting info@classroomwriter.com.

3.7 Security measures Classroom Writer should maintain reasonable security measures appropriate to the size, nature, and risk of the service. These may include: • secure authentication; • encrypted connections; • role-based permissions; • secure hosting; • access logging; • limited admin access; • staff confidentiality obligations; • regular backups where appropriate; • secure development practices; • vulnerability monitoring; • incident response procedures.

3.8 Data deletion and account closure When an account is closed, Classroom Writer may delete or disable access to account data after a reasonable period. Teachers and schools should export any needed content before cancellation or closure. Student data should be deleted, anonymised, or returned according to school instructions, plan settings, or legal requirements.

3.9 Support access to data Support staff should only access user or school data when needed to: • provide support; • investigate bugs; • resolve security issues; • comply with legal duties; • prevent misuse.

3.10 Training and internal controls Classroom Writer will maintain internal controls for anyone with access to user data. These may include: • confidentiality expectations; • secure password practices; • limited access; • awareness of child/student data sensitivity; • procedures for handling support requests; • procedures for reporting incidents.

3.11 Review This Data Protection Policy will be reviewed regularly, especially when Classroom Writer adds new features, changes providers, expands into new countries, or processes new types of student data.