K-5
ClassKit Global
LEGAL
Launch Studio →

Privacy Policy

Effective Date: September 26, 2026 • ClassKit Global (getclasskit.com)

1. Zero Student PII Collection (Our Core Privacy Promise)

ClassKit Global is engineered from the ground up on an uncompromising foundation of student privacy: We collect, process, and retain ZERO personally identifiable information (PII) from children and students.

All problem generation algorithms, math layouts, and visual puzzle engines execute entirely client-side within the educator’s local web browser environment (volatile DOM memory). When teachers input student names, custom titles, or dates on worksheets, that data never leaves the local browser and is never transmitted to, monitored by, or stored in our cloud databases. Students interact strictly with physical paper worksheets and pencils in an authentic, screen-free classroom environment.

2. Full COPPA, FERPA & CSPC Compliance

Because ClassKit Global is exclusively an educator- and parent-facing productivity studio, and students do not create accounts, log in, or interact with digital screens:

  • COPPA (Children’s Online Privacy Protection Act): We do not knowingly solicit, collect, use, or disclose personal information from children under 13 years of age. If we learn that any personal information of a child under 13 has been submitted to our servers, we will delete such information immediately.
  • FERPA (Family Educational Rights and Privacy Act): Because no student education records, student performance scores, or student directory information are maintained in our cloud systems, educational institutions and school districts can deploy ClassKit Global worksheets without violating FERPA compliance mandates.

3. Information We Collect (Educator Accounts Only)

We adhere strictly to the principle of data minimization. When an educator creates an account or purchases a Pro Pass, we collect only the minimal information necessary to deliver and authenticate access:

  • Account Credentials: Email address and securely salted/hashed passwords (we never store plain-text passwords).
  • Transaction Records: Payment transaction identifiers, pass activation timestamps, and pass expiration dates.
  • Technical & Security Telemetry: Anonymized server logs, IP addresses, browser user-agent strings, and Cloudflare security Ray IDs collected transiently for DDoS defense, automated bot mitigation, and rate limiting.

4. Legal Bases for Processing (GDPR & UK GDPR)

For individuals residing within the European Economic Area (EEA), the United Kingdom, or Switzerland, we process personal data under the following legal bases pursuant to Article 6 of the General Data Protection Regulation (GDPR):

  • Contractual Necessity (Art. 6(1)(b)): To provision, authenticate, and maintain your Pro Pass access, deliver order receipts, and provide customer support.
  • Legitimate Interests (Art. 6(1)(f)): To maintain web infrastructure security, prevent fraudulent transactions, combat malicious scraping bots, and protect service integrity.
  • Legal Compliance (Art. 6(1)(c)): To fulfill statutory accounting, taxation, and financial reporting obligations.

5. Third-Party Service Providers & Payment Security

We never sell, rent, or trade your personal information to data brokers or third parties. We share data only with trusted, PCI-compliant infrastructure partners who are contractually bound to protect your data:

  • Payment Processors (PayPal & Stripe): Financial transactions are processed directly by PCI-DSS Level 1 certified payment processors over TLS 1.3 / 256-bit SSL encrypted channels. ClassKit Global never accesses, processes, or stores your full credit card numbers, bank account numbers, or CVVs.
  • Security & CDN (Cloudflare, Inc.): Content delivery, DDoS mitigation, and SSL/TLS edge certificate termination are managed by Cloudflare to ensure high-availability global performance.
  • Privacy-Conscious Analytics (Google Analytics 4): Used with IP anonymization enabled to understand aggregate, non-personally identifiable site usage and optimize page performance.

6. Cookies & Local Storage

ClassKit Global uses only strictly necessary functional cookies and local browser storage:

  • Session & Security Cookies: Secure, HTTP-only authentication cookies used to keep educators logged in and verify Pro Pass entitlements.
  • Browser Local Storage: Client-side storage used exclusively to preserve your chosen worksheet settings, paper size preferences, and layout options locally on your device.
  • No Third-Party Advertising Trackers: We do NOT deploy third-party advertising cookies, cross-site behavioral tracking scripts, or data re-targeting pixels.

7. Data Retention & International Data Transfers

We retain educator account information only for as long as your account remains active or as required by applicable tax, commercial, and financial record-keeping laws. Upon account deletion requests, personal identifiers are purged from production systems within thirty (30) days.

Because ClassKit Global serves educators worldwide, information collected may be processed and stored in secure data centers located in the United States and global edge nodes. Where data is transferred internationally, we ensure adequate security safeguards in compliance with applicable data protection laws.

8. Your Privacy Rights (GDPR & California CCPA/CPRA)

Depending on your location, you hold statutory rights regarding your personal information:

  • Right of Access & Portability: Request a copy of the personal data we hold about you in a structured, portable format.
  • Right to Rectification & Erasure: Request the correction of inaccurate data or the permanent deletion of your account and associated data.
  • Right to Restrict or Object: Restrict or object to certain processing activities based on legitimate interests.
  • California “Do Not Sell or Share My Info”: Under the California Consumer Privacy Act (CCPA/CPRA), we confirm that ClassKit Global has NEVER sold and will NEVER sell or share personal information for cross-context behavioral advertising.

9. Information Security Safeguards

We implement multi-layered administrative, technical, and physical safeguards to protect your personal data, including 256-bit SSL/TLS 1.3 transport encryption, secure HTTP-only cookie flags, salted password hashing algorithms (bcrypt), SQL injection parameterization, and isolated connection pools.

10. Data Protection Officer & Contact Inquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or wish to exercise your statutory privacy rights, please contact our data protection team directly at [email protected].