Privacy policy
Last updated: 5 October 2026
Who is responsible
Unclass is operated by Sergei Andronov, self-employed (autónomo) in Spain, NIE Z1308614B, Avenida Fernando Abril Martorell 28, A-1-1, 46026 Valencia, Spain. Contact: [email protected].
Unclass is the data controller for teacher and school accounts. For student data, Unclass is a data processor acting on the instructions of the teacher or school that added the student, who is the controller. Students should direct requests about their data to their teacher or school first.
What we process and why
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Email, name, password (hashed), time zone, languages | Provide accounts and sign-in | Contract (b) |
| Lessons, uploads, exercise answers, messages, teacher notes, dictionary entries | Deliver classrooms and save learning progress | Contract (b) |
| Audio and video streams during live classrooms | Run the live class; not recorded | Contract (b) |
| IP address, browser user agent, timestamps | Secure sessions, prevent abuse, diagnose errors | Legitimate interest (f) |
| Aggregated, cookieless visit statistics on the marketing site | Measure site usage | Legitimate interest (f) |
We do not sell personal data, use it for advertising, or make automated decisions with legal effects.
Children
Students under 14 may be added to Unclass only by a teacher or school that holds the consent of a parent or legal guardian. Teachers and schools are responsible for obtaining it.
Cookies
We use only strictly necessary cookies to keep you signed in and to open live classrooms. No consent banner is required. Marketing-site analytics do not use cookies.
Where data goes
Unclass stores data in the European Union. Content you share with a connected AI assistant may be processed elsewhere, as explained below. We use these service providers, each bound by a data processing agreement:
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Servers and file storage | Germany |
| LiveKit, Inc. | Live audio and video | EU region |
| Resend, Inc. | Transactional email | EU region |
| AppSignal B.V. | Error monitoring | Netherlands |
We also disclose data when required by law.
AI assistant connections
Connecting an AI assistant such as ChatGPT (OpenAI) or Claude (Anthropic) is optional. You sign in to Unclass and approve the permissions shown before the assistant can access your school's content. We process the connection and its requests to provide the integration you request (GDPR art. 6(1)(b), contract). Connecting alone does not change or publish lessons.
What the assistant can read and write
With read access, the assistant can list and read your school's courses, lessons, pages, and sections, including lesson text, teacher notes, word lists, exercise questions and authored answers, and saved media references and metadata. Access is not limited to the lesson you mention in a chat. If you also approve account identification, we share your Unclass account identifier; if you approve email access, we also share your email address.
With authoring access, the assistant can create and edit course and lesson content, duplicate, move and reorder supported content, publish or archive lessons, and delete authoring content. It can save lesson text, notes, exercises, and supported media supplied through the connection. These changes are saved in Unclass; the latest successful save wins, and deletion has no undo. Review the assistant's changes before using them with students.
The connection does not grant access to student records, student exercise submissions or progress, messages, personal dictionaries, classroom invitation links, browser sessions, or another school's content. It cannot modify frozen lesson copies used in classrooms. However, any personal information you include in accessible lesson text or teacher notes can be shared with the assistant. Do not put student details or other sensitive information in content you do not want to share.
OAuth credentials and expiry
The assistant connects using OAuth authorization code with PKCE, not your Unclass password or browser session cookie. Its client receives access and refresh tokens; Unclass stores token secrets as hashes rather than readable tokens. Tokens are restricted to the approved account, school, assistant client, permissions, and Unclass MCP service. Access tokens last 15 minutes. Refresh tokens rotate when used to obtain new tokens.
Each connection expires 30 days after authorization. Refreshing tokens does not extend that deadline; you must authorize a new connection to continue. Unclass records the connected account, school, client, permissions, authorization time, expiry, and revocation status to manage access. Lesson text and tool arguments are filtered from normal request logs; MCP telemetry records the tool name, outcome, and duration.
AI providers and disconnecting
Content returned to the assistant is shared with the provider you choose. Its handling of that content, including retention, training use, and processing locations, is governed by its own privacy policy and your account or workspace settings: OpenAI privacy policy or Anthropic privacy policy. This may involve processing outside the European Union. Review the provider's terms and settings before connecting; Unclass's EU storage commitment does not cover copies held by that provider.
To disconnect, open Account → AI assistant connections in the Unclass school portal and select Disconnect beside the assistant. This revokes the connection and its authorization codes, access tokens, and refresh tokens, preventing further access through that connection. You can reconnect later by authorizing again.
Disconnecting or expiry does not delete lessons created or edited through the assistant, undo its changes, or erase content already received by the AI provider. Unclass content follows the retention rules below. To remove copies held by the provider, use its deletion controls or contact it directly.
Retention
Data is deleted on request, or after 12 months of account inactivity. Server logs are kept for 30 days. Data may be kept longer where a legal obligation requires it.
Your rights
You may access, correct, delete, restrict, or export your data, and object to processing based on legitimate interest, by emailing [email protected]. You may also complain to the Spanish Data Protection Agency (AEPD, aepd.es).
Changes
We will post any changes here and update the date above.