Last Updated: October 4, 2021

CLASSAVO PRIVACY POLICY

Effective Date: May 25, 2026

This Privacy Policy explains how interactiveX, Inc. d/b/a Classavo ("Classavo," "we," "us") collects, uses, shares, and protects information when you use our Services. Capitalized terms not defined here have the meanings given in our Terms of Service.

If your Institution has a separate written agreement with Classavo (for example, a Master Subscription Agreement or Data Processing Addendum), that agreement governs how Classavo handles Institution and Student data and controls to the extent it conflicts with this Policy.

If you don't agree with this Policy, don't use the Services.

1. Definitions

These definitions apply across all Classavo agreements (Terms of Service, MSA, DPA) unless that agreement says otherwise.

  • "Personal Information" means information that identifies, relates to, or could reasonably be linked to an individual. It does not include information that has been de-identified or aggregated and cannot reasonably be traced to a person.
  • "AI Features" means Services that use artificial intelligence or machine learning to generate hints, explanations, summaries, questions, feedback, recommendations, analytics, or similar output.
  • "Generated Output" means content produced by AI Features.
  • "Service Provider" means a third-party vendor that processes Personal Information on Classavo's behalf, including hosting, payment processing, email delivery, analytics, AI model access, and customer support providers.
  • "Institution," "Instructor," "Student," "User," and "User Content" have the meanings given in our Terms of Service.

Where Classavo receives Personal Information from an Institution about a Student (such as roster data), we treat that information consistent with our obligations to the Institution under FERPA and the relevant DPA, even if the Student has not separately interacted with Classavo.

2. Information We Collect

2.1 Information you provide

  • Account and profile. Name, email, password, role (Student, Instructor, administrator), Institution affiliation, department.
  • Course activity. Assignments, submissions, quiz responses, discussion posts, comments, files you upload, prompts you submit to AI Features.
  • Grades and feedback. Scores, evaluations, and feedback recorded by Instructors.
  • Support communications. Messages you send to Classavo and records of our responses.
  • Payment information. When you purchase directly, our payment processor collects card details. Classavo does not store full payment card numbers.

2.2 Information collected automatically

  • Device and connection data. IP address, general location derived from IP, browser type, device model, operating system, and similar technical data.
  • Usage data. Pages viewed, features used, login timestamps, clickstream activity, and diagnostic logs.
  • Cookies and similar technologies. See Section 9.

2.3 Information from third parties

  • LMS and integration data. If you access the Services through an LMS (Canvas, Blackboard, Moodle, Brightspace) or SSO provider, we may receive account identifiers, course rosters, enrollment data, and grade-passback information from those systems.
  • Institution-provided data. Institutions may provide rosters, enrollment lists, and similar data to set up courses.

2.4 Location for attendance (optional feature)

If your Instructor enables location-based attendance, our mobile app may request approximate location at the moment of attendance check-in, and only if you grant permission. We do not track location outside attendance check-ins. Location data is deleted or anonymized after attendance is verified. If you decline location permission, your Instructor must provide an alternative method of attendance verification.

2.5 What we do not ask for

Classavo does not ask for, require, or solicit biometric identifiers, Social Security numbers, government identification numbers, precise continuous geolocation, or information about reproductive or sexual health, immigration status, sexual orientation, or gender identity. We do not design fields, forms, or AI prompts to elicit this information.

If you voluntarily include sensitive information in free-text fields (such as discussion posts, comments, support messages, or AI prompts), we recommend you not do so. We treat any sensitive information received this way with the same care as other Personal Information. Deletion requests follow the process and exceptions described in Section 10.

2.6 CCPA/CPRA categories

For California residents, the categories of Personal Information we collect are: identifiers; education information; commercial information (purchase history); internet and device information; geolocation (only as described in Section 2.4); and inferences derived from the above. We collect this information for the business purposes described in Section 3.

3. How We Use Information

We use the information we collect to:

  • provide, operate, and maintain the Services, including course delivery, assignments, grading, and analytics;
  • enable Instructors and Institutions to manage their courses;
  • provide AI Features (see Section 4);
  • communicate with you about your account, support requests, service changes, and security matters;
  • send optional marketing communications (you can opt out at any time);
  • detect, prevent, and respond to fraud, abuse, security incidents, and violations of the Terms of Service;
  • comply with legal obligations and respond to lawful requests;
  • improve and develop the Services; and
  • enforce our agreements and protect our rights and the rights of others.

4. AI Features and Your Data

Our AI Features process User Content to generate hints, explanations, summaries, questions, feedback, recommendations, and similar output.

  • No sale of User Content or Generated Output. Classavo does not sell User Content or Generated Output.
  • Third-party AI providers. Our AI Features may rely on third-party AI providers. We evaluate AI providers against our privacy and security requirements before integrating them. Where third-party AI providers act as Service Providers under our contracts, they process Personal Information only on Classavo's behalf. In other cases, applicable terms with the AI provider govern.
  • De-identified data. We may use de-identified and aggregated data to evaluate and improve the Services.
  • Sensitive data. Do not input sensitive personal information into AI Features. See Section 2.5.

Generated Output may be inaccurate. See the Terms of Service for AI Features usage terms and limits.

5. How We Share Information

We do not sell Personal Information and we do not share Personal Information for cross-context behavioral advertising as those terms are defined under California law. As used in this Policy, "sell" and "share" have the meanings given under California law.

We share Personal Information only as follows:

  • With your Institution and Instructors. Instructors and authorized administrators at your Institution can access your course-related data, submissions, grades, and participation as needed for the educational relationship.
  • With Service Providers. Service Providers may access Personal Information only to provide services to Classavo, under contracts that require confidentiality and limit their use of data.
  • For legal reasons. To comply with applicable law, lawful requests, court orders, or to protect the rights, property, or safety of Classavo, our users, or others.
  • Business transfers. In connection with a merger, acquisition, reorganization, financing, or sale of assets, subject to confidentiality obligations.
  • De-identified or aggregated data. Information that cannot reasonably identify an individual may be used and shared for research, analytics, reporting, and product development.

6. FERPA and Student Data

When Classavo provides Services to a U.S. educational Institution, Classavo acts as a "School Official" with "legitimate educational interest" under FERPA. We treat student education records as confidential, use them only for the educational purposes for which they were provided and as authorized by the Institution, and do not redisclose them except as permitted by FERPA or directed by the Institution.

For FERPA-related access, correction, or deletion requests, Students should contact their Institution, which is the entity responsible for education records under FERPA.

If this Policy conflicts with FERPA or another education-privacy law, the more protective rule applies.

7. Children Under 13

The Services are not directed to children under 13 unless their use is authorized through a school under COPPA. We do not knowingly collect Personal Information directly from children under 13 outside of that context. If we learn we have collected such information improperly, we will delete it. Parents and guardians can contact privacy@classavo.com with concerns.

8. Data Retention

We retain Personal Information only as long as needed to provide the Services, to comply with legal obligations, to resolve disputes, and to enforce our agreements.

Typical retention periods include:

  • Course data, submissions, and student activity: retained through the active course term and for a reasonable period afterward to support grade appeals, transfer-credit verification, and academic-record continuity, generally not longer than the end of the following academic term unless required by Institution agreement or law. Specific retention windows for institutional customers are set in the relevant Data Processing Addendum or Master Subscription Agreement.
  • Security and authentication logs: retained for fraud prevention, security investigations, and audit requirements.
  • Financial and payment records: retained as required by tax and audit law.
  • Records subject to legal hold or active investigation: retained until the hold or investigation concludes.
  • De-identified and aggregated data: may be retained indefinitely.

Institutions can request earlier deletion in writing, subject to legal-hold obligations. Instructors and Institutions are responsible for exporting required records (grades, gradebooks, audit data) before the retention period ends. Export tools are documented in our help center.

9. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

  • Necessary cookies. Required to operate the Services, including authentication and security. These cannot be disabled.
  • Preferences cookies. Remember your settings and choices.
  • Analytics cookies. Help us understand how the Services are used. We may use third-party analytics providers, including Google Analytics, for aggregated insights.
  • Marketing cookies. We do not use marketing cookies inside the authenticated Classavo platform (the parts of the Services Users access after logging in). We may use marketing cookies on our public-facing marketing pages to measure marketing effectiveness.

You can manage cookies through your browser settings or through cookie controls on our website. Disabling some cookies may affect functionality.

We honor the Global Privacy Control (GPC) signal as a request to opt out of any "sale" or "sharing" of Personal Information as those terms are defined under applicable law. We do not currently respond to "Do Not Track" browser signals because no uniform standard exists.

10. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your Personal Information:

  • Access. Request a copy of the Personal Information we hold about you.
  • Correction. Request that we correct inaccurate information.
  • Deletion. Request that we delete your Personal Information, subject to legal exceptions and FERPA constraints.
  • Portability. Request a copy of your data in a portable format.
  • Opt-out of sale or sharing. Opt out of any "sale" or "sharing" of Personal Information.
  • Limit use of sensitive information. Where applicable under state law.
  • Opt-out of automated decision-making. Where applicable under state law.
  • Non-discrimination. We won't discriminate against you for exercising these rights.

Classavo does not currently engage in profiling using sensitive Personal Information or in solely automated decision-making that produces legal or similarly significant effects on Users.

State coverage. Residents of California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia have specific rights under their state privacy laws. We honor those rights as required by the law of your state.

How to exercise these rights. Email privacy@classavo.com or use the request form at classavo.com/privacy-rights. We will acknowledge receipt within 10 business days and respond substantively within 45 days. If we need additional time, we will notify you within the original 45-day period and may extend by an additional 45 days where permitted by law. We may verify your identity before responding.

Authorized agents. You may use an authorized agent to submit a rights request on your behalf. We may require you to directly verify your identity with us, or to provide written authorization confirming the agent is acting on your behalf, before we respond.

Appeal of denied requests. If we deny a rights request, we will tell you why. You may appeal by replying to our denial email or by writing to privacy@classavo.com with "Privacy Appeal" in the subject line. We will respond to your appeal within 45 days. If your appeal is denied and you remain dissatisfied, you may contact the Attorney General of your state.

For Students whose data is held under FERPA. Contact your Institution. FERPA gives access and correction rights through the Institution, not directly through Classavo.

11. Security

We use reasonable administrative, technical, and physical safeguards designed to protect Personal Information. No security program can guarantee absolute security, and we cannot guarantee the security of communications transmitted to or from the Services.

You are responsible for keeping your login credentials confidential. See Section 2 of the Terms of Service.

If a security incident affects your Personal Information, we will notify affected Institutions without undue delay after confirmation of the incident, and in any event consistent with applicable law. We will notify Users directly when required by law or institutional agreement.

For institutional security commitments, see the relevant Data Processing Addendum or Master Subscription Agreement.

12. International Users

The Services are operated from and primarily hosted in the United States. If you access the Services from outside the United States, your information may be transferred to and processed in the U.S. and other countries where our Service Providers operate. By using the Services, you consent to these transfers.

For Personal Information transferred from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on Standard Contractual Clauses approved by the European Commission.

13. Third-Party Services and Links

The Services may link to or integrate with third-party services (LMS platforms, payment processors, AI providers, content providers). Classavo is not responsible for the privacy or security practices of these third parties. We encourage you to review their privacy policies before interacting with them.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a new Effective Date. Material changes will be communicated by reasonable means (in-app notice, email, or both). Your continued use of the Services after the update means you accept the changes.

15. Contact

interactiveX, Inc. d/b.a. Classavo
701 Ellicott Street
Buffalo, NY 14203
Email: privacy@classavo.com