Notice to Parents
1. Why you are reading this
Your child’s school, college or training provider uses Classe365 to run its day-to-day work: enrolment, timetables, attendance, coursework, marks and reports, and messages between the school and families. Classe365 is a student information system and learning platform made by us, and the school uses it under a contract with us.
Because your child is under 13, the law in the United States — the Children’s Online Privacy Protection Act, known as COPPA — says you must be told what is collected about your child, why, and who will see it. In the school setting, US law lets a school authorise that collection on parents’ behalf, for the school’s own educational purpose. That is how Classe365 works: your school has authorised us to collect and use your child’s information to run the platform for the school, and nothing else. Section 6 explains what the school authorised, and section 9 explains your rights and how to use them.
This notice is published by us, and we give it to every school so that the school can pass it to you. Your school may add its own information to it. We have tried to write it the way we would want it written if it were our child. If anything here is unclear, ask the school, or email us at clientservice@classe365.com and we will explain it.
One thing worth saying at the start: the school decides what goes into the platform. We built the system and we run it — under COPPA we are the “operator” of the platform — but we do not choose what is collected about your child, and we never use your child’s information for anything except running the platform for the school.
2. Who we are
Classe365 is operated by:
365 Software, LLC for schools in the United States — 131 Continental Dr, Suite 305, Newark, DE 19713, United States; or
Sprout On Web Pty Ltd for schools everywhere else — 22 Palm Street, St Ives, NSW 2075, Australia. ABN 72 138 602 418.
Our support and engineering team works around the clock, and its members are Classe365 group employees in Australia, India, the Philippines, Spain and the United States. Section 7 explains what that means, and it matters, so please read it.
You can reach any of us at clientservice@classe365.com.
3. What is collected about your child, and why
Exactly what is held depends on what your child’s school has chosen to collect. Typically it includes:
| What is collected | Why |
|---|---|
| Your child’s name, date of birth, address, and the school’s own student number | To create and identify your child’s record |
| Contact details, including your details as a parent or guardian, and emergency contacts | So the school can reach you, and reach someone in an emergency |
| A photograph, if the school uploads one | To identify your child on class lists and registers |
| Enrolment details — year group, classes, courses, timetable | To place your child in the right classes and build a timetable |
| Attendance | To record who was present, and to report attendance as the school is required to |
| Coursework, submissions, marks, grades, reports and certificates | To teach and assess your child and report progress to you |
| Activity in the learning platform — what was opened, what was submitted, quiz and assignment activity | So teachers can see progress and follow up |
| Pastoral notes the school chooses to keep — behaviour, welfare, accessibility arrangements, medical or dietary needs | Only if your school records these; the school decides |
| Fees, payment plans, scholarships and concessions | To manage what is owed and what has been paid |
| A username, a password (stored scrambled, never in readable form), sign-in records, and technical details like IP address and browser type | To let your child sign in, and to keep the account secure |
| Anything else your school adds to its own enrolment or admission forms | The school decides; ask the school if you are unsure why a field is there |
Three things we want to be clear about
We do not record your child’s voice. There is no voice-capture feature for children and we hold no voiceprints. If your child uploads schoolwork that contains their voice, such as a video, it is kept only as schoolwork, is never used for voice recognition, and is deleted with the rest of the record.
Classe365 itself does not use fingerprints, face recognition or any other biometric identifier — with one exception you should know about. Classe365 does not collect, store or process fingerprints, handprints, retina or iris patterns, genetic data, voiceprints, gait patterns, facial templates or faceprints, and does not do facial or voice recognition. There is one thing you should know: some institutions choose to switch on SMOWL, a separate online exam proctoring service that they contract with directly. If your child’s school uses SMOWL for supervised online exams, any biometric processing is done by SMOWL under SMOWL’s own terms and privacy policy, not ours. Ask the school whether it uses SMOWL, and ask the school for SMOWL’s privacy notice.
We do not need a government-issued ID number. We do not need a national identity number, social security number, tax number, passport number or driving licence number to run the platform. If a school has added such a field to its own enrolment form, that is the school’s decision. If it is collected, we protect it exactly like the rest of the record and delete it on the same timetable.
4. Who sees your child’s information
The school
Your child’s school sees the record. That is the point of the system. Which staff see which parts is up to the school.
Us
We see it only to run the platform: to keep it working, to fix problems, to restore data when something goes wrong, and to keep the account secure. We do not use it for anything else.
Amazon Web Services — the company that hosts the platform
Classe365 runs on Amazon Web Services, which is where the data is actually stored and backed up. Each school’s data is kept in the Amazon region set for that school’s account, which is generally the one nearest to the school. That may be outside your own country. Your school, or we, can tell you which region applies. There is no version of the platform that does not run on this hosting.
The companies that help us run, support and bill the service
Your school’s authorisation also covers a small number of companies we need in order to run, support and bill the service. Information about your child reaches them only in the situations described:
Intercom, in the United States, is the messaging system our support team uses. Information about your child reaches it only if the school raises a support question about your child’s record.
Atlassian, in the United States and Australia, is the system our engineers use to log and fix faults. Information about your child reaches it only if a fault affects your child’s record and has to be diagnosed.
Stripe and PayPal, both in the United States, process online payments. Information about your child, linked to a fee payment, reaches them only if fees relating to your child are paid online through the platform. Your card or bank details are held by the payment company, not by us. If your school does not take online payments, this does not arise.
Each of these companies is under a written contract with us that limits it to doing that one job for us and requires it to keep the information confidential and secure.
The AI model providers — only where your school has our AI features
Some of our AI features use AI models from OpenAI, Anthropic and Google, all in the United States. These apply only where your school has taken our optional AI add-on, and only after the school has separately authorised that disclosure when it switched the add-on on. If your school has not taken the add-on, none of your child’s information goes to these companies. Section 11 says more.
And who does not see it
Some tools people ask us about — Google Analytics, Semrush, Mailchimp and ActiveCampaign — run on our public marketing website only. They never receive anything from the platform and they never see your child’s information.
What we never do
We never sell your child’s information. Not to anyone, for any price.
We never show advertising to your child inside the platform.
We never build an advertising profile of your child, and we never track your child across other websites.
We never use your child’s information to train shared or general-purpose AI systems. Where a feature learns from data, it learns only from that one school’s own data, for that one school. Nothing is pooled across schools.
We never send marketing to your child, and we never add your child to a mailing list.
5. Employers, older students and Hiree365
We also run a platform called Hiree365, which helps colleges and universities run graduate recruitment. Hiree365 has a minimum age of 16 and no users under 13. It does not apply to your child while your child is under 13, and nothing in this notice about Classe365 puts your child’s information onto Hiree365.
6. How your school authorised this
US law recognises that a school can act in place of parents when it uses an online service for its own educational purpose — teaching, assessing, keeping registers, communicating with families — provided the information is not used for anything commercial that is unrelated to that purpose. The Federal Trade Commission, which enforces COPPA, has long said so in its guidance on schools. Classe365 relies on that route.
Here is what that means in practice.
What your school authorised, and when. When your school signed up to Classe365 and accepted our terms, a school administrator confirmed on the school’s behalf that the school authorises us to collect and use its pupils’ information — including your child’s — to provide the platform to the school, and to pass that information to the hosting, support, engineering and payment companies listed in section 4, because we cannot run, support and bill the service without them. If your school later takes our optional AI features, a school administrator has to give a separate authorisation at that point, covering the AI model providers described in section 11. Without that separate step the AI features are not switched on for your school.
What the school promised. In our terms the school confirms that it has the authority under the law that applies to it to give that authorisation; that it has given parents any notices the law requires, including making this notice available to you; that it has obtained any consent its own law requires on top of its authorisation; and that it will handle your requests about your child’s record and bring us in where our help is needed.
What we keep. We keep a record of the school’s authorisation — who gave it, for which school, on what date, and which version of our terms and policy was in force. We do not run a consent process of our own with parents, and we do not keep consent records against your child’s record.
What we promise in return. Our use of your child’s information stays limited to your school’s educational purpose. We never use it for anything commercial that is unrelated to that purpose. The school can withdraw its authorisation for your child at any time, including because you have asked it to; section 9 explains how.
If your school also asks you directly. Some schools, because of their own local law or their own policy, also ask parents for consent themselves. If your school does that, it will use its own process, and this notice is the explanation to read before you decide. Our full Children’s Privacy Policy is published at classe365.com.
7. Our support staff can see the record to help your school
We want to be straightforward about this rather than bury it.
We offer support 24 hours a day, so our support and engineering team is spread across several countries: Australia, India, the Philippines, Spain and the United States. Everyone on that team works for the Classe365 group, and they may look at customer data — including your child’s record — when they need to help your school.
Your child’s information stays in secure cloud storage with Amazon Web Services. It is not stored in any of those countries. Our staff connect to it remotely, and only when they need to sort out a problem the school has asked about or fix something that has gone wrong. This is a normal part of how the service runs. Depending on the time of day, the person helping your school may be in any of those five countries, and helping may mean looking at records in your school’s system.
That access is controlled:
staff can reach only the information needed for the task in front of them;
staff access is authenticated and logged;
our group companies and every individual staff member are bound by written confidentiality obligations;
formal data transfer agreements are in place between the companies in our group;
where information comes from Europe, the United Kingdom or Switzerland, the transfer mechanisms set out in our Personal Data Processing Agreement also apply;
the information is used only to help your school and keep the service working — never for anything else.
We tell you this because you are entitled to know who can see your child’s record.
8. How long the information is kept
The school decides when it no longer needs your child’s record, and deletes it. After that, here is what happens.
| Your child’s record, once the school deletes it | Removed from the platform when the school deletes it. It survives only in our backups for up to 7 days, then it is permanently deleted |
|---|---|
| Everything, if the school stops using Classe365 | All of the school’s data, including your child’s, is permanently deleted within 30 days |
| Support messages | Kept for 24 months after the issue is resolved |
| Security and server logs | Kept for 30 days |
| Backups | We take a backup every day. Each one is kept for 7 days, then it expires |
About that 7 days. We back the platform up every day so that a school can recover from a mistake — if someone deletes the wrong record, the school has a week in which it can ask us to restore from a backup. The consequence is that a deleted record sits in those backup copies for up to a week before the last copy containing it expires. During that week the record is not in the platform, nobody is using it, and nothing is being done with it. After the week it is gone for good.
We do not keep your child’s information for our own purposes. We hold it because the school needs it, and we delete it when the school says so. The only exceptions are payment records we must keep by law and records under a legal hold, as explained in the Children’s Privacy Policy.
9. Your rights, through your school
You can, at any time:
See what is held about your child, and be told how it is used and who receives it;
Correct anything that is wrong;
Have your child’s information deleted;
Refuse to allow any further collection or use of your child’s information — in which case the school withdraws its authorisation for your child, stops collecting, and deletes the record.
None of this costs anything.
Ask the school
Because your school authorised the collection on your behalf and controls your child’s record, your school is the place to go. It can look something up, correct it, delete it, or stop further collection directly in the platform, and it holds the context — it knows you, it knows your child, and it can confirm that you are the parent or guardian from its own records. Contact the school office, the registrar, student services, or whoever the school names as its data protection or privacy contact.
When the school deletes your child’s record, it leaves the platform straight away and is gone from our backups within 7 days, as section 8 explains. When the school stops further collection, nothing more about your child is gathered through the platform.
If you come to us instead
If you cannot reach the school, or you would rather write to us, email clientservice@classe365.com. Tell us your child’s name, the school, your relationship to your child, and what you want. Then:
We will confirm we have received it.
We will pass the request to the school without undue delay, because the school controls the record and the decision is legally the school’s to make — and we will tell you we have done that, and who will get back to you. We will not change or delete something in a school’s system on our own initiative, because that would mean altering your child’s school record without the school knowing.
We will give the school reasonable technical help to answer you, and we will act on whatever the school instructs us to do.
If the school does not respond within a reasonable time, we will follow it up with the school and tell you that we have done so.
The school will need to be satisfied that you are your child’s parent or guardian before it acts. It usually confirms that from its own records. Nobody will ask you for a passport or a driving licence unless there is genuinely no other way, and we will not keep a copy of one.
If you are not happy with how something has been handled
Tell us first, at clientservice@classe365.com. If you are still not satisfied, you can complain to a regulator — in the United States, your State Attorney General or the Federal Trade Commission; in the United Kingdom, the Information Commissioner’s Office; in Australia, the Office of the Australian Information Commissioner; in the European Union, your national supervisory authority; elsewhere, your national or state data protection authority.
10. Keeping it safe
Your child’s information is protected by encryption when it travels across the internet and while it is stored, by keeping each school’s data separate so that one school cannot see another’s, by strict role-based access so staff see only what their job requires, by daily backups, by continuous security monitoring, and by logging of staff access and of changes to records.
We also maintain a written children’s information security program with a named coordinator, an annual risk assessment, documented safeguards, checks on every company that receives children’s data, and annual testing and review.
We are honest about what we do not have: a SOC 2 Type II audit is under way and is expected to finish in December 2026. We do not hold a SOC 2 report today and we do not claim one. We do not hold ISO 27001 certification and we do not claim one.
If something goes wrong and data is exposed, we tell the affected school within 24 hours of finding out, and we help the school work out what to tell families.
11. AI features
AI features are an optional extra. If your school has not taken them, no AI features are active and none of your child’s information is processed by AI. Where a school has taken them, it chooses whether to use them — for example help with marking analysis, attendance patterns, spotting students who may be struggling, writing assistance and plagiarism checking — and it can ask us to switch specific features off, or switch the add-on off altogether.
The analysis features run on AI models hosted inside our own systems on Amazon Web Services, so that information does not leave our hosting. Some other features, such as automated workflows, use AI models from OpenAI, Anthropic and Google, all in the United States. Your child’s information goes to those companies only if your school has taken the AI add-on and, when it switched the add-on on, separately authorised that. They are used through their business services, under terms that do not allow them to use the information to train their AI models. If your school later switches the add-on off, we stop sending its pupils’ information to those companies as soon as reasonably practicable.
Two promises apply:
The AI never decides anything about your child. Every output is advice to a teacher or administrator. A human being makes the decision. No automated system produces a significant decision about your child without a person reviewing it.
Your child’s information is never used to train shared AI. Where a feature learns from data, it learns only from your school’s own data and is used only for your school. Nothing is combined across schools, and your child’s work is never used to improve the product for anyone else.
We design our AI features so that people can recognise AI-generated output and know when they are talking to our AI chat assistant. Our AI features are not designed to work out your child’s emotions, and we do not use AI for any practice banned by the European Union’s AI Act.
If your school stops using Classe365, any AI model trained only on the school’s own data is deleted along with that data.
12. Who to contact
Your child’s school: the school is the first and the best place to go with a question about your child’s record, because it authorised the collection and controls the record. Its office, registrar, or named data protection or privacy contact can help you. If you do not know who that is, ask the school office, or ask us and we will point you to the contact the school has given us.
Us: Email: clientservice@classe365.com Phone (accessibility line): +61 2 9472 5000
Post, United States schools: 365 Software, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States
Post, all other schools: Sprout On Web Pty Ltd, 22 Palm Street, St Ives, NSW 2075, Australia
13. Where to read more
The Children’s Privacy Policy sets out our full COPPA position in detail, including the complete list of who receives children’s information, how the school’s authorisation works, our retention schedule, and our written children’s information security program.
The Privacy Policy is the master document covering everyone whose information we hold.
The FERPA Compliance Statement explains our position on school records under United States federal education law.
All are published at classe365.com, and we will send you a copy if you ask.
This notice was published on 22 September 2026 and takes effect on 22 October 2026. If we change what is collected about your child, how it is used, or who receives it, we will tell your school at least 30 days before the change takes effect, ask the school to confirm its authorisation for the change, and give the school an updated notice to pass to you.
Classe365 is operated by 365 Software, LLC (United States customers) and Sprout On Web Pty Ltd (all other customers), with 24/7 support and engineering provided by our group team in Australia, India, the Philippines, Spain and the United States.
