Who we are
EduChain Inc. operates the ClassCore website and platform. In this notice, “ClassCore,” “EduChain,” “we,” “us” and “our” refer to EduChain Inc. and, where an institution’s order form identifies one, the EduChain affiliate contracting with that institution.
For website, sales and direct business-contact information, EduChain Inc. is the organisation that decides why and how the information is used. Privacy questions and requests can be sent to privacy@classcore.io. Contracting-entity and registered-office details are also stated in each institution’s order form.
Our role changes with the context
Website and commercial relationships
We generally act as controller when a visitor requests pricing, books a demonstration, contacts us, subscribes to an update or represents an institution evaluating ClassCore.
Institutional data
The school, university, ministry or network normally determines the purpose and permitted use of records placed in ClassCore. In that context, the institution is the controller and we act as its processor or service provider under the applicable agreement and data processing addendum.
If your request concerns a student or staff record controlled by an institution, contact that institution first. We will support it in responding to verified requests.
Information we process
Name, work email, telephone number, role, institution and country.
Product interests, student-count range, selected modules, estimated pricing configuration, meeting preferences and communications with our team.
User identifiers, institutional role, authentication events, permission scope and account settings.
Data an institution chooses to manage through contracted modules, such as admissions, enrolment, academic records, attendance, assessment, finance, staff, credentials and service workflows.
IP address, browser and device characteristics, request time, referring page, diagnostic events, access logs and suspected security activity.
Messages, attachments, call notes, requested configurations and product feedback provided by authorised users.
We receive information directly from you, from your institution, through an integration the institution authorises, and automatically when a browser or device communicates with our services.
Why we use information
| Purpose | Typical basis |
|---|---|
| Respond to enquiries, reveal a requested pricing estimate and arrange a demonstration. | Steps requested before a contract; legitimate business interests; consent where required. |
| Provide, configure, secure, support and improve contracted ClassCore services. | Contract; institution instructions; legitimate interests in reliable and secure service delivery. |
| Authenticate users, enforce permissions, investigate abuse and maintain auditability. | Contract; legal obligations; legitimate interests in protecting institutions, users and the service. |
| Send operational messages, OTPs, service notices and responses to support requests. | Contract; requested service; legitimate interests. |
| Comply with law, establish legal claims and respond to binding legal process. | Legal obligation and legitimate interests. |
Where we rely on consent, it may be withdrawn for future processing. Where we rely on legitimate interests, we consider the purpose, necessity and effect on the individual. We do not make decisions producing legal or similarly significant effects about website visitors solely through automated processing.
Education records and institutional control
ClassCore processes student and staff information only to provide the institution’s selected services, follow documented instructions, maintain the service, meet legal obligations or protect the platform. We do not sell institution-controlled records, build advertising profiles from them or use them to target students with advertising.
Access is determined by institutional roles and configuration. An institution is responsible for establishing a lawful basis, issuing notices, setting authorised access and obtaining any consent required for its deployment. Where applicable, our agreements support the institution’s obligations under education and privacy rules such as FERPA.
Data location, export, return and deletion commitments are defined in the applicable order form, data processing addendum and deployment plan. We do not promise a specific residency region unless it is documented for that deployment.
Service providers and subprocessors
These providers support the current ClassCore website, sales workflow or standard service delivery. A contracted institution may receive a deployment-specific list reflecting its selected region, modules and integrations.
| Provider | Service | Data / location context |
|---|---|---|
| Hetzner Online GmbHProvider information | Cloud hosting, networking and infrastructure. | Website and deployment data in the selected data-centre region; related technical traffic data. |
| AC PM LLC (Postmark)Provider information | Transactional email, including pricing OTPs and enquiry delivery. | Email address, name, institution and message content; processing includes the United States. |
| Calendly, LLCProvider information | Optional demonstration scheduling. | Contact, scheduling, browser and device data after the visitor opens Calendly; locations identified by Calendly. |
| Google LLCProvider information | Hosted web-font delivery. | IP address and request/device information; distributed infrastructure. |
Customer-directed integrations may send data to providers selected by the institution. Those providers are identified during implementation and governed by the institution’s agreement with that provider or by an applicable ClassCore deployment schedule.
When information may be disclosed
We disclose information to authorised institutional users, the providers listed above, professional advisers under confidentiality duties, and authorities when disclosure is required by valid legal process. We may also disclose information to protect users, institutions or the service from fraud, abuse or security threats.
If EduChain is involved in a merger, financing, reorganisation or sale, relevant information may be disclosed under appropriate confidentiality and data-protection safeguards. The commitments in this notice continue to apply to personal information transferred as part of that transaction.
International transfers and residency
ClassCore operates across multiple regions, and some providers process data outside the country in which it was collected. Where required, we use contractual safeguards, data processing terms and recognised transfer mechanisms. For European transfers, these may include Standard Contractual Clauses. Hosting location and any deployment-specific residency commitment are documented with the institution.
The UAE Personal Data Protection Law and the EU transparency requirements are among the regional frameworks considered when applicable.
How long information is kept
- Pricing verification: the OTP request expires after 10 minutes and the verified browser session after 30 minutes. These values are held in volatile server memory.
- Sales and enquiry records: normally retained while an evaluation or commercial relationship remains active and then for up to 24 months, unless a longer period is required for a legal claim, compliance obligation or requested follow-up.
- Institutional records: retained according to the institution’s instructions, applicable agreement and documented retention configuration.
- Security and service records: retained for the period reasonably necessary to investigate incidents, protect the service, meet contractual requirements and comply with law.
Information may remain for a limited period in protected backups before those backups rotate. We may retain de-identified information that can no longer reasonably identify an individual.
Security
We use administrative, technical and organisational measures appropriate to the context, including encrypted transport, access controls, environment separation, audit-oriented logging, secure credential handling and incident-response procedures. No system can guarantee absolute security. Institutions can request current, scope-specific security information through our security review process.
Your privacy rights
Depending on your location and relationship with us, you may have rights to access, correct, delete, restrict or object to processing; obtain a portable copy; withdraw consent; and complain to a privacy regulator. We will not discriminate against a person for making a valid privacy request.
Send a request to privacy@classcore.io. We may need to verify identity and authority. If an institution controls the relevant record, we will refer or transmit the request to that institution and assist it as required by contract and law.
Children, students and biometric deployments
ClassCore is offered to institutions, not directly to children for personal use. Institutions are responsible for notices, parent or guardian permissions and other legal authority required for their deployment. Do not submit student information through public marketing forms.
Face-recognition attendance and RFID attendance are optional institutional deployments. Their use requires a documented purpose, access limits, retention rules, alternatives and any assessment or consent required by local law. Product availability does not itself authorise an institution to collect biometric or location-related information.
Changes and contact
We may update this notice when our services, providers or legal obligations change. A material change will be identified by a revised effective date and, where appropriate, communicated to contracted institutions before it takes effect.
Contracting-entity and registered-office details are provided in the applicable order form.