Cookie Policy

1. About this policy

1.1 What this policy covers

This policy explains how we use cookies and similar technologies, what each category does, how the marketing website differs from the authenticated platform, and how you control what is set on your device.

It covers two quite different environments, and the difference matters:

• The marketing website — classe365.com and its subpages. This is the public site where people read about our products, request a demonstration, download material and start a free trial. Analytics and marketing technologies operate here.
• The authenticated platform — Classe365 and Hiree365, once you have logged in. This is where student, learner and candidate records live. Marketing and advertising technologies do not operate here.

1.2 Which entity is responsible

Customers located in the United States contract with 365 Software, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Customers located anywhere else contract with Sprout On Web Pty Ltd, ABN 72 138 602 418, 22 Palm Street, St Ives, NSW 2075, Australia. Support and engineering services are provided by Classe365 India Pvt Ltd, Mysuru, India. Together we are “Classe365”, “we”, “us” and “our”.

1.3 Related documents

Read this policy together with our Privacy Policy, our Children’s Privacy Policy, our US State Privacy Notice and our AI Use Statement. Where a term is defined in the Privacy Policy, it has the same meaning here.

2. What cookies and similar technologies are

2.1 Cookies

A cookie is a small text file that a website asks your browser to store on your device. When you return, the browser sends the cookie back, which lets the site recognise the browser, keep you logged in, remember a setting, or count a visit.

Cookies are described in two ways:

• First-party or third-party. A first-party cookie is set by the site you are visiting. A third-party cookie is set by another organisation whose code runs on that page — an analytics provider, for example.
• Session or persistent. A session cookie is deleted when you close your browser. A persistent cookie stays on your device until it expires or you delete it.

2.2 Similar technologies

Several other technologies do similar jobs, and this policy treats them the same way as cookies:

• Local storage and session storage — browser storage the site can read and write. The platform uses local storage to hold interface state so that pages load correctly and your work is not lost between screens.
• Pixels and tracking images — a tiny image or script embedded in a page or an email that records that the page was opened or the email was read. We use these in our business marketing emails, and on the marketing website. We do not use them in platform notification emails sent to students.
• Software development kits and embedded scripts — code from a third party running in a page, such as an analytics or support-messaging script.
• Persistent identifiers — any identifier that recognises a user or device over time, including a cookie identifier, a device identifier, an account identifier or a session token. Section 5 explains how these are used in the platform, and why we treat them carefully.

2.3 What we do not use

We do not use browser fingerprinting to identify users, and we do not use cookies to build advertising profiles of students, candidates or children.

3. The four categories we use

We group everything we set into four categories. Only the first category is set without asking you.

3.1 Strictly necessary

These are required for the website or the platform to work. Without them, pages will not load correctly, you cannot log in, and security controls fail. They cannot be switched off through our consent tool, because switching them off would break the service. In most jurisdictions consent is not required for them.

3.2 Analytics

These tell us how the marketing website is used — which pages are visited, how visitors arrive, how long they stay, where they leave — so we can improve it. They are set on the marketing website only, and only where you have consented in jurisdictions that require consent.

3.3 Preference

These remember choices you have made, so you do not have to make them again: language, region, an interface option, whether you have dismissed a banner, or your cookie preferences themselves.

3.4 Marketing

These support our business-to-business marketing: recognising a returning visitor to the marketing website, measuring whether a campaign led to a demonstration request, and recording whether one of our marketing emails was opened or a link followed. They are set on the marketing website and in our business marketing emails only. They are never set inside the authenticated platform, and they are never served to authenticated student users.

4. What we set, and what it does

The table below names the technologies in use and what each does. Where a technology is provided by a third party, the third party sets its own expiry periods and publishes them in its own documentation.

Payment pages provided by Stripe and PayPal may set their own strictly necessary cookies to complete and secure a transaction. Those cookies are governed by the payment provider’s own policy.

If your institution has enabled SMOWL for online quiz proctoring, SMOWL is contracted by the institution directly under SMOWL’s own terms, and any technologies it uses are governed by SMOWL’s own privacy policy rather than this one. Similarly, where a customer has configured Zapier, the customer controls that integration.

5. The platform is different from the marketing website

This section is the one we ask school administrators, IT teams and parents to read most carefully.

5.1 No marketing or advertising cookies for authenticated students

Marketing and advertising cookies are not served to authenticated student users.

Once a user is logged in to Classe365 or Hiree365, no advertising technology runs, no advertising network is loaded, no advertising identifier is set, and no advertising profile is created. There is no advertising inside the platform at all. This holds for every student and learner, at every age, in every country, and it is not a setting an institution can switch on.

Analytics and marketing technologies — Google Analytics, Semrush, Mailchimp and ActiveCampaign — operate on the classe365.com marketing website only and never receive student or candidate records from the platform.

5.2 Persistent identifiers inside the platform

The platform necessarily uses persistent identifiers. A session token identifies your browser as belonging to your logged-in session. An account identifier associates an action with the person who took it. A tenant identifier keeps one institution’s data separate from another’s. Local storage holds interface state between screens.

Persistent identifiers within the platform are used only to support the internal operations of the service. By internal operations we mean:

• authenticating a user and maintaining a logged-in session;
• keeping one institution’s data separate from every other institution’s;
• remembering a user’s own interface and language preferences;
• maintaining audit trails so an institution can see who accessed or changed a record;
• protecting the security and integrity of the service, including detecting intrusion, abuse and fraud;
• diagnosing and fixing faults, and measuring performance so pages load reliably;
• fulfilling a request the user made, such as an in-platform support conversation;
• complying with a legal obligation.

We do not use persistent identifiers in the platform to profile users for advertising, to build or enrich a marketing audience, to track a user across other companies’ websites or apps, or to target content to a user based on behaviour observed elsewhere.

5.3 Why we state this so precisely

The FTC’s amended COPPA Rule treats a persistent identifier as personal information in its own right, whether or not it is attached to a name. That means a cookie identifier or device identifier associated with a child is regulated data. The Rule permits the use of a persistent identifier to support the internal operations of a service without parental consent, but it does not permit its use to build a profile or to target advertising.

We have designed the platform to sit squarely inside that support-for-internal-operations position: the identifiers exist because authentication, tenant separation, security, auditing and fault diagnosis cannot work without them, and they are used for nothing else. Our full position on children’s data, including consent, retention and our written children’s information security program, is set out in the Children’s Privacy Policy.

Hiree365 has a minimum age of 16 and no users under 13. We do not collect audio recordings of children’s voices.

6. How we ask for consent, and how you change your mind

6.1 The consent banner

When you first visit classe365.com from a jurisdiction where consent is required for non-essential cookies, a banner appears before any analytics or marketing technology is loaded. You can:

• accept all — allow analytics, preference and marketing categories;
• reject all non-essential — allow only strictly necessary technologies; the site works normally, and you are not asked again for the life of your preference record;
• manage preferences — turn each category on or off individually and save.

Rejecting non-essential cookies does not restrict access to any part of the marketing website, and it does not affect your ability to use the platform.

6.2 Changing your preferences later

Your choice is not permanent. You can reopen the preference centre at any time from the “Cookie preferences” link in the footer of every page on classe365.com, change any category, and save. The change takes effect immediately for technologies loaded after that point, and technologies you switch off are not loaded again.

If you clear your browser’s cookies, you will clear the record of your choice as well, and the banner will appear again the next time you visit.

6.3 Consent signals

Where a state or national law requires us to honour a universal opt-out mechanism such as Global Privacy Control, we honour that signal on classe365.com as an opt-out of non-essential categories, without requiring you to interact with the banner.

6.4 What consent does not cover

Consent is not required, and is not requested, for strictly necessary technologies, because the service cannot be provided without them. Turning them off is not possible through our preference centre; it is possible through your browser, but the site and platform will not work correctly if you do.

We do not treat continued scrolling or continued browsing as consent, and we do not pre-tick consent boxes.

7. Controlling cookies through your browser

You can control cookies in your browser as well as through our preference centre. Every major browser lets you view stored cookies, delete some or all of them, block third-party cookies, and block all cookies from a specific site. The controls are usually under Settings, then Privacy or Privacy and Security.

Some things to know before you do:

• Blocking all cookies will prevent you logging in to Classe365 or Hiree365, because authentication depends on a session cookie.
• Deleting cookies removes your saved cookie preferences along with everything else, so the consent banner will reappear.
• Browser settings are per-browser and per-device. Changing them on a laptop does not change them on a phone.
• Private or incognito browsing usually discards cookies at the end of the session, which means your preferences are not remembered either.
• Most browsers also offer a “Do Not Track” setting. There is no common industry standard for how sites should respond to it, and we do not rely on it. We do honour Global Privacy Control as described in section 6.3.

Your institution’s IT team may also apply cookie or script controls centrally on managed devices. If a platform feature is not working on a school-managed device, that is worth checking.

8. How long cookies last

A cookie’s stated lifespan is a maximum, not a promise that it will survive that long. You can delete any of them at any time, and clearing site data removes all of them immediately.

Separately from cookie lifespans, personal information collected through these technologies is retained under the schedule published in our Privacy Policy — most relevantly, server and security logs for 30 days, and marketing and CRM contact data for 36 months from last engagement.

9. Cookies and international transfers

Some of the providers named in section 4 are located in the United States. Where information collected by a cookie is transferred out of the European Economic Area, the United Kingdom or another jurisdiction with transfer restrictions, we rely on the transfer mechanisms set out in our Personal Data Processing Agreement and described on our International Data Transfers page. Those documents govern, and we do not restate their terms here.

Our Privacy Policy also discloses that personnel of Classe365 India Pvt Ltd in Mysuru, India may access customer data, including student data, when providing support and engineering services.

10. Changes to this policy

We review this policy at least annually, and whenever we add, remove or change a technology described in it.

Where a change materially affects what we set on your device or how we ask for consent, we will give at least 30 days’ notice before it takes effect, by a notice on classe365.com and, where appropriate, by email to institutional account contacts. If a change requires new consent, we will ask for it before the technology is loaded, rather than relying on a consent you gave for something else. Minor corrections — a renamed provider, a clarified sentence, a fixed link — take effect when published.

Each version carries a “Last updated” date and an “Effective” date at the top. The current version is dated 15 September 2026 and takes effect on 15 October 2026.

11. Contact us

Questions about this policy, or about cookies on our site: clientservice@classe365.com Support: clientservice@classe365.com Accessibility line: +61 2 9472 5000

By post — United States customers: 365 Software, LLC 131 Continental Dr, Suite 305 Newark, DE 19713 United States

By post — all other customers: Sprout On Web Pty Ltd 22 Palm Street St Ives, NSW 2075 Australia

If you are a parent, a student or a school administrator and you want to confirm what runs inside your institution’s tenant, write to us and we will tell you.

Classe365 and Hiree365 are operated by 365 Software, LLC (United States customers) and Sprout On Web Pty Ltd (all other customers), with support and engineering services provided by Classe365 India Pvt Ltd.