Procurement FAQ
Procurement FAQ
Common questions from Headteachers, SBMs, DPOs, IT Managers and Trust Leaders evaluating Classfolio.
Jump to question
Is Classfolio GDPR compliant?
Classfolio is designed to support schools' GDPR compliance obligations. Under UK GDPR, schools remain the Data Controller — Classfolio acts as the Data Processor, processing data only on the school's instructions to deliver the educational service.
Classfolio does not sell school, teacher or student data. Student data is not used to train AI models. Classfolio provides a Data Processing Agreement on request.
Where is data stored?
Classfolio is built on Google Cloud / Firebase. Primary application data is stored in Cloud Firestore within Google Cloud's London region (europe-west2). Uploaded files are stored in Firebase Storage, also within europe-west2. Server-side processing runs in Firebase Cloud Functions deployed in europe-west2. The web application is served via Firebase Hosting — Google's global CDN.
AI-assisted features use the Google Gemini Developer API, which may process data outside the UK. Transfer safeguards are in place under Google's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Full details are in the Data Processing Agreement.
Do you have a Data Processing Agreement?
Yes. A full, signed Data Processing Agreement is available on request for schools and trusts that require one for procurement, DPIA, or compliance purposes.
To request a signed DPA, email privacy@classfolio.co.uk with your school or trust name, your role, and any specific requirements. We will respond within 5 working days.
What student data does Classfolio collect?
Classfolio collects and processes the following student data: display names (which may be pseudonymous), class membership, assessment results and AI-assisted marks, assignment submissions and feedback, lesson participation responses, flashcard and retrieval grid progress.
Classfolio does not collect biometric data, continuous audio or video recordings, device location, or browsing history. There is no continuous monitoring of student activity beyond the responses students submit within the platform.
Is student data used to train AI models?
No. School, teacher and student data is never used to train or fine-tune AI models. This applies to all data processed by Classfolio.
Classfolio uses the Google Gemini Developer API (gemini-2.5-flash) for AI-assisted features. Classfolio uses the paid tier of the Gemini API; under Google's paid-tier terms, data submitted is not used to train Google's models. When student answers are sent for AI marking, no student name, email, or identifying information is included — only the question definition and answer text.
What authentication methods are supported?
Classfolio uses Microsoft and Google authentication via Firebase Authentication. All users — teachers, students, and administrators — sign in using an existing Microsoft or Google account. Classfolio does not manage user passwords directly.
Schools using Microsoft 365 or Google Workspace can use existing school-managed identities without creating additional passwords, simplifying onboarding and reducing credential overhead. Teacher accounts require admin approval before access to teaching tools is granted. All students sign in with their school Google or Microsoft account; teachers can then add students to classes directly or via a teacher-issued join code.
How is data deleted when we leave or when a student leaves?
Schools and administrators can request deletion of data at any time by contacting privacy@classfolio.co.uk. When an account is deleted, it is soft-deleted with a 90-day retention period before permanent removal. Immediate anonymisation is also available on request.
Classfolio provides a structured GDPR request flow through which schools can submit data access, deletion, or export requests. These are processed and tracked with a full audit trail.
What should we know about Classfolio from a safeguarding perspective?
Classfolio is an educational delivery platform — it is not a safeguarding reporting system. Concerns about child welfare should always follow your school's established safeguarding procedures.
Key points for DSLs: Classfolio does not access, record, or store audio or video. There is no student-to-student messaging or communication. Students can only see their own work. Teachers control all content before it is visible to students. AI does not interact directly with students.
Can Classfolio be used across multiple schools in a trust?
Yes. Individual teachers, departments, schools, and trusts can all use Classfolio. There is no minimum deployment size — individual teachers can start on the free tier, and schools can adopt it at departmental or whole-school level.
Trust-level administration tools — including cross-school analytics, central admin dashboards, and trust-level licensing — are in development. Schools and trusts deploying now will have input into how these features are shaped. Contact hello@classfolio.co.uk to discuss your trust's requirements.
Still have questions?
Talk to us about your procurement requirements
If you need information not covered here — a DPIA, a signed DPA, a security questionnaire, or a conversation about your school or trust's specific context — get in touch.