Privacy Policy & Data Protection
Last Updated: March 2026 • Version 2.4 • Effective for all multi-tenant educational institutions
1. Executive Commitment to Educational Privacy
Classegy (“we,” “our,” or “us”) operates an enterprise multi-tenant academic management platform. We recognize that student records, teacher evaluations, family financial statements, and campus biometric logs contain sensitive educational records. Our platform is architected around the core principle that educational institutions own 100% of their data. We act strictly as a secure data processor under the instructions of school administrators and trustees.
2. Compliance with Global Regulatory Frameworks
Full compliance with Family Educational Rights and Privacy Act standards. We never sell student data, build commercial marketing profiles, or serve third-party ads to minors.
Complete Data Protection Officer (DPO) workflows, right-to-be-forgotten data anonymization, and EU-standard Data Processing Addendums (DPA).
Data residency options hosted across regional cloud clusters in UAE and Saudi Arabia, adhering to ZATCA tax laws and UAE Federal Personal Data Protection Law.
Compliant with Digital Personal Data Protection mandates for minor consent, parental verification, and localized student record preservation.
3. Data Isolation & Tenant Boundaries
Classegy enforces strict cryptographic and database tenant isolation. Every school or multi-campus educational trust operates within isolated PostgreSQL schemas with Row-Level Security (RLS). A user or staff member in School Branch A can never inspect, query, or leak data into School Branch B.
4. Encryption in Transit and at Rest
- Data at Rest: Encrypted using industry-standard AES-256 with managed KMS keys.
- Data in Transit: Enforced TLS 1.3 encryption across all API endpoints, web sockets, and mobile app channels.
- Biometric Hashes: Biometric attendance devices transmit irreversibly hashed templates—never raw fingerprint or facial imagery.
5. Contact Our Data Protection Officer (DPO)
For questions regarding our privacy architecture, SOC2 reports, or to execute an enterprise Data Processing Agreement, reach out directly to our privacy desk at privacy@classegy.com.