Privacy Policy (GDPR & COPPA Compliant)

This page recreates the exported public privacy policy for AfterClass, with Chamberlin Innovations SASU kept as the operating company.

Effective date:January 1, 2026

Last updated:September 14, 2026

1. Who We Are

AfterClass (operated by Chamberlin Innovations SASU)

Registered in France

SIREN: 993 523 836

Registered address: 870 Rue des Thermes, 65130 Capvern, France

Email: support@afterclass.training

We operate afterclass.training and related services, including the AfterClass learner platform, teacher dashboards, and waitlist or email updates. We act as the data controller under the GDPR.

2. What Personal Data We Collect

You Provide

Name and email
School or workspace inputs (class size, goals, languages, and similar context)
Responses to practice questions or forms
Communication preferences

Collected Automatically

Browser user-agent and device type
IP address stored temporarily in access logs for security
Referrer, when available

AI-Generated Data

When you use AfterClass, we may generate AI feedback, summaries, transcripts, scores, and pedagogical guidance tied to your learning record.

No Advertising Cookies

We use essential storage to operate the site and remember your privacy choice. With your permission, Vercel Web Analytics measures visits to public product and legal pages without advertising cookies. Query strings and private workspace pages are excluded. You can allow or decline audience measurement, or change your choice using Cookie preferences.

2.1 Student and Children's Data (COPPA & FERPA)

Children's Privacy (COPPA)

AfterClass is an education tool intended for use by schools, training providers, and teachers. We do not knowingly collect personal information directly from children under 13 without school or parental consent.

School Authorization

When a school or teacher uses AfterClass, they confirm that they have authority to consent to the collection of student data on behalf of parents where applicable, including under COPPA in the United States and GDPR in the European Union.

Data Minimization

We only collect the minimum data needed for the educational function: student identifiers, learner context, audio or session records where required for delivery, and progress or performance records. We do not build student profiles for commercial advertising purposes.

2.2 Voice Data and AI Processing

How We Process Audio

When a learner submits a recording or a teacher captures session audio, the file may be securely transmitted to our AI processors solely to generate transcripts, feedback, scores, and pedagogical analysis.

No Training on Student Data

Our public policy states that student voice data is not used to train public AI models and remains under the control of the customer or teacher workspace.

Audio Retention

Audio may be stored to let teachers review learner work and session evidence for up to 36 months. Teachers may delete recordings at any time through the product or associated admin workflows.

3. How We Use Your Data

Generate and deliver practice feedback, reports, dashboards, and follow-up materials
Contact you about your submission or account when needed
Improve our tools, user experience, and content
Manage business operations and security
Comply with legal obligations

We do not sell your data or use it for advertising.

4. Legal Basis

Consent

When you submit a planner form, join the email list, or opt into optional communications.

Legitimate Interest

Delivering requested outputs, securing and maintaining services, and improving accuracy or experience without overriding your rights.

Legal Obligation

Accounting, audit, and compliance with French or European Union law.

5. Storage and Transfers

Supabase (EU region) for database, authentication, and storage
Resend for transactional email communications
No transfers outside the EU unless protected by GDPR safeguards such as Standard Contractual Clauses

5.1 Authorized Sub-Processors (GDPR Art. 28)

To provide the service, we share strictly necessary data with the following providers.

Provider	Location	Purpose	Training
Supabase	EU	Database, auth, storage	N/A
OpenAI	US	Transcription and feedback APIs	No public model training
Mistral	EU	Pedagogical generation and analysis	No public model training
Google	US/EU	Speech, Drive, and Calendar services where enabled	Service specific
Lemon Squeezy	US/Global	Merchant of record, payments, tax	N/A
Resend	US	Transactional and lifecycle email	N/A

6. Retention

Learner submissions, transcripts, and recordings: up to 36 months for delivery, support, improvement, and fraud prevention
Email communications: until you unsubscribe or the conversation closes
Server logs: 30 to 60 days for security, then deleted

You can request deletion at any time, subject to legal retention duties.

7. Your GDPR Rights

Access, correct, or delete your data
Object to or restrict processing
Withdraw consent where consent is the basis
Data portability
File a complaint with CNIL in France

To exercise your rights, email privacy@afterclass.training.

8. Sharing Your Data

We only share data with service providers needed to operate the service. We do not sell your data or share it with advertisers.

9. Security

HTTPS encryption (TLS 1.3)
Encryption at rest for stored data
Access controls and least-privilege permissions
Server-side processing with protected storage
72-hour breach notification workflow aligned with GDPR expectations

No system is 100 percent secure, but we apply industry-standard protections and operational safeguards.

10. Contact

Email: support@afterclass.training
Privacy inquiries: privacy@afterclass.training
Supervisory authority: CNIL (France) - https://www.cnil.fr/

Chargement…