GDPR & Compliance
How Klasio handles your academy’s data and your students’ data, and where we stand on GDPR.
Lawful basis and transparency
Handling of personal data
We keep a record of the personal data that moves through Klasio and who it belongs to.
- Course creators and their team: name, email, phone, IP address, billing details, login and account settings.
- Students of academies on Klasio: name, email, enrollments, course progress, quiz results, purchases and certificates.
- Website visitors: browser and device details, and cookie data.
For student data, the course creator is the controller and Klasio is the processor. For your own account and billing data, Klasio is the controller.
Data processing
We only process personal data when the law allows it. Depending on the data, our basis is one of these:
- Contract: to run your Klasio account and deliver the platform you signed up for.
- Legitimate interests: fraud prevention, platform security, product improvement, and some marketing, where your rights don’t override them.
- Legal obligation: tax, accounting, or a lawful request from an authority.
- Consent: Consent for collecting cookies and for marketing emails. You can unsubscribe to Klasio marketing emails any time.
Privacy Policy
Our Privacy Policy explains what we collect, why, and who we share it with. It also covers Google Calendar and Google Meet data, which we use only to manage your class events.
When we make significant changes, we notify you by email or on our website before they take effect.
Academy and student data
How we handle the data in your academy, from student records to AI features:
Keeping student data on need basis
Your academy data stays in Klasio while your account is active, unless you delete it sooner.
When an account closes, we keep its data for 14 days so you can export it. Then we delete it.
We may keep some records longer where the law requires it, such as invoices and tax records.
Deleting a student’s data on request
If a student asks to be forgotten, you or the student can remove them from your academy dashboard.
If any data is left that you can’t delete yourself, email [email protected] with “GDPR request” in the subject. We’ll remove it.
Students of an academy on Klasio should contact their academy first, since the academy is the controller of their data.
Exporting student’s data on request
Students can export their data from your academy in a standard format.
Use this to answer a student’s access or portability request. If you need anything the export doesn’t cover, contact us.
AI usage
Klasio’s AI features help you create course content.
We do not use your course content or student data to train AI models. We already apply this rule to Open AI instructions data.
Location of Server
Klasio’s servers are located in Netherlands. Klasio Inc. is a US company, so your data may be processed outside your country.
When data leaves the EEA, UK or Switzerland, we use safeguards required by law.
Data security
How we protect academy and student data, and what happens if something goes wrong:
Privacy built into the product
Klasio is a hosted platform, so you don’t need a security expert to keep your academy safe. Security is on by default.
We collect only the data needed to run your academy. Team roles let you limit what each instructor or admin can see.
Data encryption in transit and at rest
All traffic between your browser, your students and Klasio runs over HTTPS (TLS).
Sensitive data is encrypted at rest. Card payments are handled by your payment gateway, such as Stripe or PayPal. Klasio does not store full card numbers.
Breach response plan
If a breach happens, we act in this order:
- Contain it and stop further access.
- Investigate what data and which accounts were affected.
- Notify affected customers without undue delay, so they can meet their own 72-hour reporting duty.
- Share updates as we make changes to our plan and fix the cause.
As a processor, we tell course creators so they can inform their students and authorities where needed.
Internal security policy
Only Klasio team members whose role needs it can access customer data. They are bound by confidentiality obligations.
Access is controlled by permission levels and reviewed regularly. 2FA is required for Staff members.
Assessment of risky processing
Before we launch a feature that handles personal data in a new way, we review the privacy risk. This includes new AI features and new third-party integrations.
Where GDPR requires it, we run a Data Protection Impact Assessment (DPIA).
Accountability and governance
Who is responsible for data protection at Klasio, and which partners help us run the platform:
Data protection contact
For GDPR questions, data requests, or a signed DPA, email Emran, CEO of Klasio, at [email protected] with the subject “GDPR request”.
Data Processing Agreement (DPA)
Course creators who serve students in the EU, UK or Switzerland can sign a DPA with Klasio. It sets out how we process student data on your behalf.
To get a signed copy, email [email protected] with “DPA request” in the subject.
Trusted subprocessors
Klasio uses a small set of third-party services to run the platform, such as hosting, email delivery and video. We require each of them to protect your data and use it only for the purpose we set.
Our subprocessors:
- Linear
- GitHub
- UberCloud
- Codex / Chat GPT
- Claude
- GLM
- Freescout
- PostHog
- Google Tag Manager
- Google Ads
- Meta Ads
- Microsoft Clarity
- weMail
- Postmark
- Resend
- toSend
- Bunny.net
- Cloudflare
- DigitalOcean
- Azure
- Outline
- Google Docs/Sheets/Drive
- Mobbin
- Wispr Flow
- Granola
- ElevenLabs
- Stripe
- Relay
EU representative
We’re appointing a representative in the EU.
Klasio Inc. is a US company. We’re appointing a representative in the EU and will add their details here and to our Privacy Policy once that’s done. Until then, email us at [email protected].
Privacy rights
Your rights under GDPR, and how to use them with Klasio. Students of an academy on Klasio should contact that academy first.
Right of access
You can ask what personal data we hold about you and get a copy of it.
Email [email protected] with “GDPR request” in the subject. Include your mailing address and country so we can verify you. We reply within one month.
Right to rectification
If your data is wrong or incomplete, you can ask us to correct it.
You can update most account details yourself in your Klasio settings. Students can update their profile from their academy account. For anything else, email us.
Right to erasure
You can ask us to delete your personal data when we no longer need it.
We may keep some records where the law requires it, such as invoices. We’ll tell you what we kept and why.
Right to restrict processing
You can ask us to pause processing your data. For example, while we check a correction you requested.
During that time, we store your data but don’t use it.
Right to data portability
You can ask for your data in a structured, machine-readable format, such as CSV. You can then move it to another service.
Course creators can also export student data directly from the dashboard.
Right to object
You can object to processing based on our legitimate interests or for direct marketing.
To stop marketing emails, click “unsubscribe” in any email or contact us. We stop right away.
Rights around automated decisions
You have the right not to be subject to decisions made only by automated means that significantly affect you.
Klasio doesn’t make such decisions about you. Quiz scores and course completion follow rules your instructor sets, not profiling.
Questions about GDPR
Is Klasio GDPR compliant?
Yes. We follow GDPR as a processor for your students’ data and as a controller for your account data. The sections above show how we handle each part.
Is Klasio a controller or a processor?
Both, for different data. For students and visitors of your academy, you are the controller and Klasio is your processor. For your own account and billing details, Klasio is the controller.
I’m a student. Who do I contact about my data?
Contact the academy where you take your course first. They control your data. If you can’t reach them, email [email protected] and we’ll help.
Where is my data stored?
Klasio’s servers are in Netherlands. Each service that handles data, and where it is based, is listed in the subprocessors table above.
Do you sign a Data Processing Agreement?
Yes. Email to [email protected] with “DPA request” in the subject for a signed copy.
How long do you keep academy data?
As long as your account is active, unless you delete it sooner. After an account closes, we keep its data for 14 days so you can export it, then delete it.
Can I delete all the data about one of my students?
Yes. Remove the student from your academy dashboard. If anything is left that you can’t delete yourself, email us and we’ll remove it.
Does Klasio train AI models on my courses or student data?
No. We don’t use your course content or student data to train AI models.
What happens if there is a data breach?
We contain it, investigate it and tell affected customers without undue delay. We share updates as we grow more.
Who at Klasio can see my data?
Only team members whose role needs it, for example to resolve a support request you raised. Access is controlled by permission levels.
