Privacy Policy

Overview

Classfolio helps teachers run live lessons and save student learning evidence into Student Folios. This policy explains the personal data handled by the app and how it is used.

One distinction runs through everything below: for staff accounts — teachers, administrators and other staff — Classfolio decides how the data is handled, so this policy is our own account of it. For student data, the school decides, and we act only on its instructions. If you are asking about a pupil, the school is the right place to start.

Who we are

Classfolio is a trading name of Classfolio Ltd, a company registered in England and Wales (company number 17384601), registered office 66 Paul Street, London, EC2A 4NA. We are registered with the Information Commissioner’s Office under reference ZC215629.

For the account data of teachers, school administrators and other staff users, Classfolio Ltd is the data controller. For student data — class membership, responses, marks and Student Folio evidence — the school or organisation is the controller and Classfolio acts as a processor on its instructions. That is why requests about a student’s data should go to the school first; see Your rights below.

A school can also share a questionnaire as a link — to parents and carers, for example. Answering one does not create a Classfolio account, login or profile, but a response can still contain personal data: a named questionnaire asks for a name, optionally an email address, and a free-text answer can identify the person who wrote it. The school decides why the questionnaire is run, what it asks and whether responses are named or anonymous, so for those responses the school is the controller and Classfolio is the processor.

Data we collect

• Account details from Firebase Authentication, such as email address and provider sign-in ID.
• Teacher approval status and role information.
• Student class membership using Firebase Auth UID and a minimal display label.
• Lesson responses, confidence ratings, scores, feedback, and Student Folio evidence.
• A pupil’s support profile, set by their teachers: EAL status and home language, Read to me, and support adjustments such as larger text, a dyslexia-friendly display or extra time. We record adjustments, never diagnoses, and none of it is sent to an AI service.
• Uploaded lesson assets, including imported PDF page images and teacher-created resources.
• Teacher voice recordings: recordings a teacher makes of their own voice when they press Record, as narration on a lesson slide or as an audio clip on a task or question, and any captions made from them.
• Pupils’ speaking answers: where a school has switched speaking recordings on (they are off until it does) and a teacher sets a speaking question or task, for example in a language lesson, the recording a pupil makes of their own voice to answer it. Recording happens only when the pupil presses Record, after the browser asks permission to use the microphone. The recording is stored in the UK, can be played only by the pupil and the teachers of their class, is marked by the teacher and is never sent to an AI service. It is deleted automatically at the end of the period the school chooses (by default, the end of the academic year); the mark and feedback are kept.
• Questionnaire responses. Where a school runs a named questionnaire, this includes the respondent’s name and, if they give one, an email address; where it runs an anonymous one, neither is asked for or stored. Answers may be free text either way.

Student privacy

Classfolio is designed to avoid storing full student names in class membership records. Teachers see display labels such as "Smith, J" or a school-managed alias such as "9X-01". Firebase Auth UID is used as the stable identity for signed-in students.

How data is used

Data is used to authenticate users, manage classes, join live lessons, record responses, create Student Folios, and provide teacher analysis. Student work is not sold or used for advertising.

Processors and hosting

Classfolio uses a small number of processors. Each one is listed here with what it does and what it receives:

• Google (Firebase and Google Cloud) — hosting, sign-in, the database, file storage and server-side processing. Application data, uploaded files and server-side processing are all in Google Cloud’s London region (europe-west2).
• Google Vertex AI — the AI features. When a teacher generates content or asks for marking assistance, the relevant lesson content or answer text is processed by Vertex AI, also in the London region. Student answers are sent without any name, email address or identifier. The same applies if a teacher asks for AI analysis of a questionnaire’s results: the written answers are sent, and no respondent name or email address is. Submitted data is not used to train Google’s models. Vertex AI may keep a request in memory, in the London region, for up to 24 hours to answer repeated requests faster, and a request that Google’s automated abuse checks flag may be kept for a limited period for review. AI image generation is the exception to the London region and is described under “Where data goes” below.
• Stripe — subscription billing. Stripe receives a billing contact email address and an account identifier. Card details are entered on Stripe’s own pages and never reach Classfolio. No student data is sent to Stripe.
• Resend — sending service emails such as invitations and account notices, from servers in Ireland. No email is ever sent to a student.

Where a teacher connects an external AI assistant (see below), their teaching content is additionally processed by that assistant’s provider. The current list of processors, with the safeguards for each, is kept in our Data Processing Agreement.

Where data goes

Classfolio deliberately keeps processing in the UK: the database, uploaded files, server-side processing and AI processing are all in Google Cloud’s London region. These exceptions are worth stating plainly rather than leaving you to find them:

• AI image generation. When a teacher generates an image, the written description they type is processed on Google’s global infrastructure, which may include servers outside the UK. No image model is available in the London region. This feature is off unless a school switches it on, only teachers can use it, and a request contains nothing but that written description — no pupil data, no pupil work, and nothing uploaded.
• Read Aloud. When a pupil asks for text to be read to them, the words to be spoken are sent to Google’s text-to-speech service, which processes them in the EU rather than specifically in London. The audio that comes back is stored in the London region and reused, so the same sentence is only ever sent once. For reading a lesson or a question aloud, the text is the teaching material itself, not the pupil’s work. In an AI-led lesson it is what the AI teacher says next, which is written in response to the pupil and may reflect what they just said. No pupil name is sent, and no recording is ever made of anyone’s voice.
• Listening clips. A teacher can type a short script, such as a dialogue for a language lesson, and have it spoken by the same EU text-to-speech service to make an audio clip for their class. Only the teacher’s script is sent — no pupil data. The clip is stored in the London region, and pupils hear it but never see the script.
• Sign-in. Firebase Authentication is a global Google service and some of its processing takes place outside the UK, including in the United States. This covers account identifiers and sign-in records, not lesson content or student work. It is governed by Google’s own data protection terms and transfer safeguards.
• Service email. Resend processes in Ireland, inside the European Economic Area, which UK law recognises as providing adequate protection.
• Billing. Stripe processes in the EEA and may transfer billing data onward to the United States under its own transfer safeguards.

Separately, a teacher who chooses to connect an external AI assistant is sending their own teaching content to a provider based in the United States — see below. That is off unless three separate approvals are given.

YouTube videos

Teachers can add YouTube videos to lessons, and Classfolio can suggest videos for a slide. The suggestions use YouTube API Services. By using these features you agree to be bound by the YouTube Terms of Service, and YouTube’s handling of data is covered by the Google Privacy Policy.

• Searching. Only a teacher can search, and only the search words are sent to YouTube, such as “water cycle explained”. No name, email address or pupil data is sent. Search results (video titles, channels, lengths and thumbnails) are kept for up to 7 days so a repeat search does not ask YouTube again, then deleted automatically. A count of each teacher’s searches is kept for a day to apply a daily limit.
• Watching. Videos play in YouTube’s own player, using its privacy-enhanced mode (youtube-nocookie.com), which does not set YouTube cookies until a video is played. When a video plays, YouTube receives the information any website visit sends, such as the device’s IP address. Classfolio never signs anyone in to YouTube.
• Nothing else. Classfolio does not access any YouTube or Google account, so there is no access to revoke. If a teacher wants a video removed, they delete it from the slide. You can also review apps connected to a Google account at Google’s security settings page.

Connecting an external AI assistant

A teacher may connect an approved external AI assistant (currently Claude, provided by Anthropic, and ChatGPT, provided by OpenAI) to their own Classfolio account. This is off by default and requires three separate approvals: Classfolio must enable it for the platform, the school administrator must enable it for the school, and the individual teacher must enable it for their own account. A teacher can disconnect at any time, and a school administrator can withdraw access for the whole school.

When connected, the assistant can read and create that teacher’s own teaching content — lessons, assessments, assignments, questionnaires and printable resources — and everything it creates is saved as a private draft for the teacher to review. It cannot publish, share, deploy or send anything to a class.

No student data is shared. The connection has no interface to student records at all: it cannot read student responses, assignment submissions, marks, Student Folio evidence, questionnaire answers, live session activity, or even class lists and who is in them. This is a property of how the connection is built rather than a setting, so it cannot be switched on by mistake. Where a questionnaire is read, only the total number of replies is visible — never the replies themselves, including those from parents and staff.

One limit is worth stating plainly: teaching content is free text, so if a teacher types a student’s name into a lesson slide, a mark scheme or a resource, that text is sent to the assistant along with the rest of that content. Teachers are asked not to put student names into teaching materials.

Content sent to the assistant is processed by that provider under the teacher’s own agreement with them, and is subject to that provider’s privacy policy. Both currently approved providers are based in the United States, so a teacher who connects one is sending their own teaching content outside the UK. Classfolio’s own processing and storage remain in the UK and EU as described above.

Only assistants explicitly approved by Classfolio can connect; an arbitrary third-party application cannot register itself. Schools that do not wish teachers to use this feature can leave it switched off, and it is switched off unless enabled.

How data is protected

Data is encrypted in transit and at rest, access is enforced at the database layer rather than only in the interface, and Classfolio holds no user passwords at all — sign-in is delegated to your school’s Microsoft or Google account. Classfolio Ltd is Cyber Essentials certified (whole organisation, valid to 17 August 2027). Our Security page describes the measures in detail, including what we do not have.

Retention and deletion

For the accounts Classfolio controls — teacher, administrator and other staff accounts — a deleted account is first soft-deleted and excluded from processing, then permanently removed after a default 90 days. Immediate anonymisation is available instead if you would rather not wait. Administrative audit logs are kept for 365 days by default, archived live-session data for 180 days, and uploaded media for 365 days. A minimal record of which pupils joined and answered each live lesson — identifiers only, with no answers, marks or names — is kept with the class beyond the 180 days, so a teacher can see participation across a school year.

These windows are enforced automatically by a job that runs every night, not by someone remembering to do it. The one deliberate exception is unused uploaded files, which are flagged automatically but need a person to confirm the final deletion — a safeguard against automatically deleting a file that is still in use.

Where a teacher has turned on a class workspace or a Class Space, every comment a student writes is read and approved by a member of staff before anyone else can see it. That cannot be switched off. A comment that is declined, or withdrawn by its author before it is read, is never shown to the class — but it is kept for 365 days rather than deleted immediately, so that a school can still see what was written if it later needs to. After that it is permanently deleted by the same nightly job.

A school can also allow students to attach a photograph, an image or a PDF to a Class Space message. This is off unless the school switches it on and the individual teacher switches it on for their own class, and a school can switch it off again for everyone at once. Where it is allowed, files are limited to 1.5 MB each, location and camera information is removed from photographs before they are uploaded, and the file is not visible to other students until a member of staff has approved the message. If a member of staff declines a message, any file attached to it is deleted rather than kept — unlike the text of the comment, which is retained for 365 days as described above.

Separately, a school can allow students to hand in a photograph, an image or a PDF as part of an assignment — the digital equivalent of handing in an exercise book. This is a different permission from the one above and is also off until a school switches it on. Because this work is never published to a class, a wider range of files is accepted than in a Class Space — photographs, PDFs, documents, presentations, spreadsheets and similar coursework, up to 5 MB each. Programs and files that run when they are opened are refused, so that a teacher can open a pupil’s work safely. Location and camera information is still removed from photographs before the file leaves the student’s device. Work handed in this way is seen only by the teachers who mark that class — never by other students — and it is marked by a person: we do not give a handed-in file to an AI model. A student can remove a file they have handed in until the work has been marked, after which it is kept as part of their work, along with the mark it earned.

Staff training cohorts work differently, because the people in them are colleagues rather than children. A trainer may choose to let staff in a cohort publish without approval; where they have not, comments are approved by the trainer in the same way. Students are never members of a staff cohort, and a comment written by anyone without a staff role is always held for approval regardless of that setting.

For student data the school is the controller, so it sets the retention schedule for classes, lessons, student evidence and imported files. Requests to delete or export student data should be sent to the organisation administering the Classfolio workspace, and we support them in answering.

Why we are allowed to use this data

For teacher, administrator and staff accounts, we process personal data to perform our contract with you — creating and running your account is the service you signed up for. We also rely on our legitimate interests to keep the service secure, prevent misuse, fix faults, and understand how the product is used, balanced against your interests and limited to what that requires.

We do not currently rely on consent for anything: there are no advertising or analytics cookies to agree to. If that changes we will ask you first, and you will be able to withdraw your consent at any time.

For student data, the school or organisation decides the lawful basis as controller, and Classfolio processes that data only on its instructions. The same applies to questionnaire responses: the school decides the purpose and the lawful basis for asking, and we process the responses on its instructions.

We do not make decisions about anyone by automated means alone. AI-assisted marking produces a suggested mark and written feedback: a teacher decides whether a question is marked by AI at all, can change any mark or comment at any time, and chooses whether marks are held for review or shown to a pupil as soon as marking finishes. AI output is formative. It does not determine a pupil’s progression, set or placement, and no consequential decision about a pupil is made without a person making it.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask for data to be deleted, where there is no overriding reason to keep it;
• ask us to restrict how we use your data while a concern is looked into;
• object to processing we carry out on the basis of legitimate interests;
• receive data you gave us in a portable, machine-readable form; and
• withdraw consent at any time, where consent is what we relied on.

For a teacher, administrator or staff account, contact privacy@classfolio.co.uk and we will respond within one month. For a student, or for a questionnaire you answered, contact the school or organisation that runs the Classfolio workspace — they are the controller, and we will support them in answering. Exercising any of these rights is free, and we will not treat you differently for asking. Not every right applies in every case: erasure in particular depends on the circumstances and on the lawful basis the controller relied on.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first at privacy@classfolio.co.uk so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at any time — you do not have to come to us first.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. ico.org.uk

Contact

Which route to use depends on whose data you are asking about. For your own teacher, administrator or staff account, write to privacy@classfolio.co.uk — we are the controller for that. For a student’s data, contact the school or organisation running the Classfolio workspace, because the school is the controller and we can only act on its instructions.

For anything else about privacy or data at Classfolio, privacy@classfolio.co.uk reaches us directly. It is the address published on our ICO registration.