Privacy Policy

1. Data We Collect

When education centres (including music centres, tutoring centres, language schools, art studios, sports education centres, schools and private tutors) and their students’ parents / guardians use our service, we collect the following data:

Children’s data: This service does not collect data directly from children. Students’ personal data (including photos, videos and lesson records) is provided and managed by parents / guardians or education centre staff. We do not issue data requests directly to children under 13.

2. Purposes of Use

We use the collected personal data only for the following purposes:

1. Provide and operate lesson scheduling, make-up lesson booking, attendance roll-call and lateness reminders;
2. Record tuition fees, issue receipts and monthly statements, and email receipt copies;
3. Provide the digital handbook feature, allowing tutors to post homework / notes and share lesson progress with parents;
4. Send lesson reminders, leave approvals and handbook update notifications via push notifications;
5. Account management, technical support, system security and prevention of unauthorised use;
6. Comply with applicable laws and regulations.

We will NOT use your personal data for direct marketing (unless we obtain your explicit consent separately), and we will NOT sell or rent any personal data to third parties.

3. Data Sharing and Disclosure

Except in the following cases, we will not disclose your personal data to third parties:

1. Service providers: We use the following contractually bound service providers to process data on our behalf —
   • Google Firebase (authentication, database, file storage, cloud functions, push notifications): servers located in the US and other regions;
   • SendGrid (Twilio): sends receipt and notification emails.

   The above providers process data only on our instructions and may not use it for their own purposes.

2. Legal requirements: where required by law, court order or government authority, or where necessary to protect the rights and safety of the Company and its users.
3. Business transfer: in the event of a merger, acquisition or asset transfer, data may be transferred with the business to the new operator and will continue to be bound by this policy.

WhatsApp deep link: The WhatsApp contact feature in the app only opens the WhatsApp application on your device. We do not collect or store your conversation content through this feature.

4. Data Retention

We retain personal data for the following periods:

After the retention period expires, the relevant data is automatically deleted or anonymised. Except where required by law, we will not retain personal data beyond the necessary retention period.

5. Cross-border Transfer

Some of our service providers (such as Google Firebase) have servers located outside Hong Kong. When personal data is transferred outside Hong Kong, we take reasonable contractual and technical measures (including standard data protection clauses) to ensure the data receives protection comparable to the Hong Kong PDPO.

6. Your Rights (PDPO)

Under the Hong Kong Personal Data (Privacy) Ordinance, you have the right to:

1. Access the personal data we hold about you;
2. Correct inaccurate personal data;
3. Delete your account and related personal data;
4. Withdraw consent (where data processing is based on your consent).

To exercise these rights, please contact us in writing by email (see Section 10). We will respond within the period specified by the PDPO (generally 40 days). We may ask you to provide identification to verify the requester’s identity.

7. Security Measures

We take appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS) and Firebase cloud storage encryption;
• Role-based access control (owners / staff / tutors / parents each have different permissions);
• Firestore security rules restrict unauthorised reads and writes;
• Regular review of access logs and system status.

As the internet is not a completely secure environment, we cannot guarantee absolute security, but we continuously monitor and improve our security measures.

8. Policy Updates

We may update this policy from time to time to reflect changes to the service or the law. The updated policy will be published on this page with a revised effective date. Significant changes (such as changes to the scope of data collected or sharing parties) will be notified via in-app notification or email.

9. Google User Data (Calendar Sync)

When a centre owner enables instant Google Calendar sync and authorises with their Google account:

• Scopes: only the Google Calendar events scope (https://www.googleapis.com/auth/calendar.events) and your email address (https://www.googleapis.com/auth/userinfo.email) are requested.
• Use: events corresponding to lessons in the Service are created, updated and deleted in your own Google Calendar (group classes merge into a single event). Your email address is shown on the settings screen only, to indicate which account is connected.
• Read access: the Service does not read the content of your other calendar events; it only looks up identifiers of events it created itself, to avoid duplicates.
• Storage: the refresh token and email address are stored server-side in a protected database (access-restricted to that centre’s admins), never downloaded to ordinary user devices.
• Never: Google user data is never sold, used for advertising, used to train AI or machine-learning models, or transferred to third parties for their own purposes.
• Revoke: disconnect any time from the settings screen, or revoke access at the Google account permissions page. The stored token is deleted from our servers immediately upon disconnection.

Limited Use disclosure: Class Logic’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Contact Us

If you have any questions about this policy or your personal data, or wish to exercise your rights to access, correct or delete data, please contact: