Privacy Policy

1. Controller and contact

Thiago Henrique da Cunha Mattos, Via Querce Petrarca SNC, 86092 Cantalupo nel Sannio (IS), Molise, Italy, controls processing whose purposes and essential means he determines for RepClass. Privacy contact: privacy@repclass.com. This contact is not described as a formally appointed DPO; any appointment duty must be assessed. This Policy is not blanket consent, parental authorisation, a school contract, an impact assessment or a supplier agreement.

2. Web platform and protection of children

RepClass is available as a web platform for adult representatives, responsible family members and teachers. Only enter data necessary for the features you use and that you are authorised to share. Availability does not replace a lawful processing basis, protection of children or required school authorisations. An adult account does not automatically authorise disclosure, advertising, profiling or health-data processing concerning children.

3. Data-protection roles

The operator determines purposes and essential means for accounts, authentication, security, support, preferences and its own legal obligations. Users must have authority to enter or share others' information. Where a school determines processing and RepClass acts for it, the relationship requires documentation, including a GDPR article 28 agreement when applicable. Separate or joint controllers depend on actual decisions. Not every family automatically becomes a controller or every school an institutional customer. The household exemption does not automatically cover the platform provider's processing.

4. Account data

Name, email, identifier, language, preferences, creation dates and technical authentication information are processed. Credentials are handled by the authentication service; passwords are not shown to other members. Required details are needed for account creation and access. Email confirmation, recovery and session maintenance support access and security. Never send passwords to support; minimise other people's and children's information in screenshots.

5. Families and classes

Features can store family records, adult relationships, a child's name and optional birth year, enrolment, school, school year, class identifier, roles and permissions. Need and visibility depend on the function. Only necessary and authorised data should be entered. Sources may be the person or another authorised adult. Where information is collected indirectly, legally required notices must be given within applicable conditions and periods. People may request the source of their information.

6. Content and interactions

Lessons, announcements, dates, descriptions, selected images and files, documents, events, poll and trip responses and read confirmations may be stored. Content, filenames and metadata can identify people; automatic removal of all metadata is not promised. Lesson images are optional and must not be required for an otherwise valid lesson. Later attachments follow permissions. Check rights, purpose and necessity before sharing a file.

The representative cannot edit a lesson published by a teacher. Teachers' personal notes, agenda and calendar are not automatically shared with the class; access follows those tools' permissions.

7. School collections and subscriptions

School-payment records organise descriptions, amounts, due dates, families, status and notes under distinct access permissions. RepClass does not receive, hold or transfer these amounts between families, schools or providers. Platform subscriptions are separate from school collections; payment data, terms and methods are presented before purchase.

8. Invitations and referrals

Class invitations involve codes, class association and validation data. Teacher invitations involve recipient email, issuer, class, validity and use or revocation status. Matching confirmed email reduces unintended reuse but does not replace the representative's checks. Product referrals associate a random code with the sender; registrations using it may record account association and date to measure referrals. Clicks are not counted as proven installations, and recipients' names or emails are not shown to the sender. People can object to this measurement. Records are removed or unlinked when the corresponding account is deleted under the applicable flow.

9. Adult purposes and legal bases

Contract performance covers data strictly necessary for requested functions, account management and related support. Specific legal obligations may require retention or disclosure; this is not a general-purpose justification. Security, abuse prevention, legal claims and limited referral measurement may rely on legitimate interests after necessity, proportionality and balancing assessments. People may object; the operator's interests are not presumed to outweigh children's interests.

Optional purposes requiring consent need separate, specific, informed, freely given and withdrawable consent. Refusal must not block an unrelated function. Device permission for a camera or notifications is not itself sufficient legal basis for every subsequent use.

10. Children and specially protected data

An adult's contract does not automatically justify all processing about a child. Each real-data operation's legal basis must be documented for each processing operation. Where consent is used, authority, purpose, age rules and withdrawal must be checked. The app remains for adult accounts regardless of statutory thresholds for services offered directly to children. Health, disability, religion, biometrics and criminal-offence data require additional conditions and should not be entered in this service. Institutional or mandatory school use requires separate assessment and must not depend on artificially forced consent. A DPIA assessment must consider vulnerability, scale, systematic processing and risks.

11. Access and recipients

Access depends on authentication, membership and permissions. Representatives manage participation and permitted delegations; families and teachers access only information authorised for their role and class. Teachers do not receive general access to family, financial or administrative data. Their personal tools have separate permissions.

12. Suppliers and external apps

Supabase provides authentication, database and storage; Emergent hosts the development environment; Expo Go supports mobile testing. Operating-system, distribution or notification services may participate as features are enabled. Product names do not replace verification of contracting entities, data-processing agreements, subprocessors, locations and actual configuration.

Sharing via email, WhatsApp, SMS or another app opens that external service with selected content. Its own terms apply to its processing. A share button is not a guarantee of external-recipient privacy and does not exempt the operator for integrations or disclosures it determines.

The website uses Aruba for hosting and email. The main Supabase database region inspected is Frankfurt, Germany; this does not mean that all storage, support access or processing by suppliers takes place exclusively in the European Economic Area.

13. Transfers outside the EEA

No claim is made that every data item and support access stays in the EEA. Database region, supplier processing and international access must be assessed together. Before real-data launch, transfers and actual safeguards must be established, such as adequacy decisions or standard clauses with necessary assessments and supplementary measures, or another applicable lawful mechanism. A supplier's GDPR reference alone proves no transfer's compliance. People may request countries, recipients and safeguards at section 1's contact. Pending checks are not represented as completed.

14. Devices and permissions

Devices may retain session information, language, preferences and the completed/skipped introduction flag for access and continuity. The introduction should not repeat at every opening after this recording. Camera, images, files and notifications depend on user action, supported capabilities and necessary permissions. Refusal may limit that feature, not make a lesson image compulsory. Permissions can be changed in settings; lock-screen notifications may expose content. Behavioural advertising, non-essential trackers and additional analytics must not be enabled without assessment, notice and consent where required. Accepting Terms does not consent to them.

Using the microphone to record audio depends on the user's requested action and device permission. Refusal limits the corresponding feature. On the website, necessary resources maintain sessions, security and language and theme preferences. We use necessary storage for login, security, language and theme. With your permission, we use the Google Ads tag to measure advertising results and completed registrations. We do not send names, emails or children’s data for this measurement.

15. Security and breaches

The project uses authentication, class- and role-based access, database policies and attachment restrictions. These do not promise absolute security, a completed independent audit or end-to-end encryption. Measures, administrative access and incident response require ongoing assessment. Report mistaken recipients, exposures, lost files or unauthorised access. Incidents are assessed and documented; authority notification, where required, is without undue delay and where feasible within 72 hours of awareness. High-risk affected people are informed without undue delay unless a legal exception applies. A processor must notify its controller without undue delay.

16. Retention and deletion of class data

Class data and files will be deleted 30 days after a cancellation request accompanied by a request to delete the class, or 30 days after the subscription ends automatically. Cancelling only renewal, without requesting deletion of the class, does not start this request-based period.

When moving to a new school year, data and files from the previous year will be deleted 30 days after the move. Registration records and content for the new year will be preserved. This rule covers class content and its attachments stored in the service; it does not, by itself, delete participants' accounts or teachers' private tools.

Account deletion is a separate procedure, described in the next section. Statutory erasure requests and other rights are not automatically conditional on the commercial 30-day period. Records strictly necessary for legal obligations or defending rights may have separate retention limited to the applicable purpose and duration; this does not authorise indiscriminate retention of all class files.

Acceptance records identify version, language and date. Operational log, backup and suppliers' technical retention periods still need to be formalised before public launch. No unverified backup rotation or technical copy-removal period is asserted. RepClass does not remotely delete copies already downloaded by recipients.

17. Erasure and shared copies

Account deletion removes linked records according to implemented relationships. Shared content may remain without an author identifier, but text, images and metadata are not necessarily anonymous. Requests are assessed by data subject, purpose, other people's rights and legal duties. Management handover must not indefinitely obstruct rights. Copies held by recipients or external services may need additional action, with the operator's legally required cooperation.

Account deletion can be requested through the app's profile feature or the procedure published at https://www.repclass.com/delete-account/. For difficulties and rights requests, contact privacy@repclass.com. Deleting an account does not, by itself, cancel a subscription purchased through an app store.

18. Your rights

Where legal conditions apply, request access, correction, erasure, restriction, portability and objection, or withdraw consent without affecting earlier lawfulness. A lawful retention need may limit erasure and must be explained. Use section 1's contact. Identity checks must be proportionate and do not always require an identity document. The usual response period is one month. A justified extension of up to two further months for complexity or number must be explained within the first month. Requests are normally free; fees or refusal require demonstrated statutory grounds.

19. Export and portability

In-app export covers account and own-family records and does not automatically contain all attachments or shared content. It does not exhaust access rights. A readable PDF is not a substitute, where required, for structured, commonly used, machine-readable portability. Request additional data or format through the privacy contact. Other people's information is not indiscriminately disclosed with an individual request.

20. Automated decisions and new uses

No solely automated legally or similarly significantly affecting decision function, or child behavioural profiling function, has been identified in the service. Invitation and permission checks are not educational assessment. New purposes, analytics and integrations require advance assessment and an appropriate basis. Holding information does not authorise incompatible reuse; material changes require relevant notice.

21. Complaints and updates

You may complain to Italy's Garante at https://www.garanteprivacy.it or another competent authority, including for habitual residence, workplace or alleged infringement as provided by GDPR. Internal support is not a prerequisite to authority or court action. This versioned Policy must reflect actual operations. Required notices accompany material changes. Acknowledgement is not blanket consent. Reading and downloading documents is free and does not require class membership.

22. Legislation and guidance explained

GDPR Regulation 2016/679 covers principles and bases (articles 5-6), protected data (9-10), transparency and rights (12-22), accountability, design, suppliers, security and DPIAs (24-35), and transfers (44-49). Real measures are required, not merely a policy. Italy's D.Lgs. 196/2003, amended particularly by D.Lgs. 101/2018, supplements GDPR; article 2-quinquies sets age 14 for certain consent-based services offered directly to children, without permitting child accounts in this adult-only product.

ePrivacy Directive 2002/58/EC, articles 5(3) and 13, and Italian implementation address device technologies and marketing, distinguishing necessary from optional processing. EDPB Guidelines 07/2020 explain roles by actual decision-making. Garante school FAQs and its 26 March 2020 distance-learning decision address minimisation, children, consent and school-provider agreements. EDPB rights and breach guides explain practice; they are not independent legislation or app certification.

Official sources: https://eur-lex.europa.eu/eli/reg/2016/679/oj ; https://www.garanteprivacy.it/codice ; https://eur-lex.europa.eu/eli/dir/2002/58/oj ; https://www.garanteprivacy.it/temi/cookie ; https://www.edpb.europa.eu/documents/guideline/guidelines-072020-on-the-concepts-of-controller-and-processor-in-the-gdpr_en ; https://www.garanteprivacy.it/home/faq/scuola-e-privacy ; https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9300784 ; https://www.edpb.europa.eu/sme/be-compliant/respect-individuals-rights_en ; https://www.edpb.europa.eu/sme/assess-the-risks/data-breaches_en

23. Website advertising measurement — 13 October 2026

With Advertising consent, the Google Ads tag measures visits from ads and registrations completed after email confirmation. It may process click and cookie identifiers, IP addresses, and technical browser and device information. The event includes a random identifier to prevent duplicate counting; we do not send names, emails, family or children’s data in this event.

Declining does not prevent registration or access. You can change consent in Cookie preferences in the footer. The choice is stored for up to 180 days; the local registration marker is valid for up to 7 days. The Google Ads click attribution window is 90 days. We do not enable enhanced conversions using user data or ad personalisation.

Google participates in this measurement and applies its policies to technical data received. Cookie, retention and transfer information: Google Privacy Policy.