Legal
Privacy Policy
Last updated 16 October 2026
clssrm (clssrm.app) is operated by Oasome Services Ltd (16 Leocharous, 3086 Limassol, Cyprus; company no. HE 431352; VAT no. CY10431352E), the data controller for personal data collected through the website and for clssrm workspace accounts.
When you use clssrm to run your studio, clssrm acts as a processor on behalf of your studio (the controller) for the student and customer data you enter — students, guardians, contacts, attendance, and payment records. That processing is covered by our Data Processing Agreement (DPA). This privacy policy covers clssrm as controller for website visitors and account holders, and explains the processor relationship for studio data.
1. Information we collect
From website visitors and account holders we collect account and workspace information you provide, such as names, email addresses, and studio details, plus technical data needed to operate and secure the service (IP addresses, browser and device information, navigation data).
If you are a studio owner using the service, your workspace may contain information about your students (including, where classes are attended by children, students who are minors), guardians and emergency contacts, instructors and staff contacts, class schedules, bookings, attendance, and manual payment records (amount, date, cash/card method, note). clssrm does not collect payment card details; card payments are handled by Stripe (see "Sub-processors" below).
2. How we use information and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Authenticate users and operate clssrm workspaces (accounts, studios, instructors, classes, bookings, attendance) | Performance of a contract (Art. 6(1)(b)) |
| Subscriptions, invoices, and tax via Stripe | Contract and legal obligation — tax and accounting records (Art. 6(1)(b) and (c)) |
| Service emails (invitations, email verification) via Resend | Contract and legitimate interests (Art. 6(1)(b) and (f)) |
| Security, fraud and abuse prevention | Legitimate interests and legal obligation (Art. 6(1)(f) and (c)) |
| Simple, cookie-free usage analytics on public pages (onedollarstats) | Legitimate interests (Art. 6(1)(f)) |
| Optional marketing or direct communications | Consent where applicable (Art. 6(1)(a)); you can withdraw consent at any time |
3. Your data subject rights
You may ask us to: access your personal data; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; receive your data in a portable format; and object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time (withdrawal does not affect processing before you withdrew).
To exercise these rights, contact support@clssrm.appor write to us at the address above. We will respond without undue delay and within one month of receiving your request.
You also have the right to lodge a complaint with a supervisory authority: the authority of our establishment, the Commissioner for Personal Data Protection (Cyprus), or — if you are based in the EU — the supervisory authority in your own EU country.
4. Sub-processors
clssrm uses the following subprocessors to operate the service. The list is derived from the code and configuration of this repository; no other subprocessor receives personal data from clssrm.
| Subprocessor | Purpose | Data location |
|---|---|---|
| Turso database hosting (DATABASE_URL=libsql://...) | Database hosting for accounts, studios, students, classes, bookings, attendance, and payment records | Ireland (EU). Turso (US company) relies on SCCs |
| Resend (sending via Amazon SES eu-west-1 on send.clssrm.app) | Transactional email: invitations, email verification, service notices | Amazon SES eu-west-1 (Ireland) for the send.clssrm.app subdomain; Resend, Inc. (US) is certified under the EU-US Data Privacy Framework and also offers SCCs |
| Stripe | Subscription billing, checkout, invoices, Stripe Tax calculation, and VAT ID collection/verification. Payment card details are held by Stripe, not by clssrm | Stripe Payments Europe, Ltd. (Ireland); data may be processed in the US by Stripe, Inc. under the EU-US Data Privacy Framework and SCCs |
| Google (optional "Sign in with Google") | Social authentication for workspace users | Google Ireland Limited; transfers to the US under the EU-US Data Privacy Framework and SCCs |
| Railway | Hosting infrastructure for the clssrm web app and API | Amsterdam, Netherlands (EU). Railway Corp. (US) relies on SCCs |
| onedollarstats | Simple, privacy-focused usage analytics on public pages | Cookie-free, aggregated page-view statistics only |
Services operated by clssrm itself (not subprocessors): authentication and session management via Better Auth (self-operated on clssrm's own infrastructure) and the Caddy web server serving clssrm.app.
5. International transfers
clssrm is established in Cyprus (EU). Some subprocessors listed above are based outside the European Economic Area, principally in the United States. Where personal data is transferred outside the EEA, clssrm relies on the European Commission's Standard Contractual Clauses (SCCs), or on an adequacy decision where one applies, including the EU-US Data Privacy Framework for certified US providers. The mechanism for each subprocessor is shown in the table above.
6. Retention periods
We keep personal data only as long as needed:
| Personal data | Retention |
|---|---|
| Account and workspace data (owners, instructors) | While the account is active, then deleted within 30 days (1 month) of account closure, except records we must keep by law |
| Studio student data (students, guardians, contacts, attendance, payment records) | Retained only as long as the studio (controller) instructs; deleted or returned at the end of the processing relationship (see the DPA) |
| Payment and invoicing records | As long as Cyprus tax and accounting law requires (generally 6 years) |
| Security and access logs | Up to 30 days, unless needed to investigate an incident |
| Analytics data (cookie-free page views) | Aggregated statistics only; no personal profiles are kept |
7. Cookies and analytics
- Strictly necessary cookie. clssrm sets a first-party session cookie through Better Auth so you can stay signed in to your workspace. This cookie is required for the service to work.
- Analytics. clssrm loads the onedollarstats snippet on public pages only — never on /admin or inside your workspace. It records page views and simple events and does not set cookies on clssrm.app.
- No marketing or advertising cookies are set by clssrm.
- If you click the WhatsApp contact button, the chat opens in WhatsApp (Meta). clssrm does not share your data with WhatsApp unless you initiate a chat yourself.
8. Contact
Questions about this policy, privacy requests, or data-protection queries can be sent to support@clssrm.app.