Privacy Policy

Who is responsible for data

SubSchool LTD, 17 King Edwards Road, 2nd Floor College House, Ruislip, HA4 7AE, United Kingdom, acts as the controller of personal data when it decides why and how data is processed in the SubSchool service. This policy applies to SubSchool websites, apps, and user-facing portals, including class and teacher.

Data we process

We process account and profile data: name, email address, role, interface language, school or organization, account status, user identifiers, login data, and information that a user adds to their profile.

We process learning and workspace data: courses, lessons, assignments, answers, progress, grades, schedules, messages, support requests, live lesson recordings if enabled, files, and materials that users create, upload, or receive through the service.

If a user uses AI features, we may process input materials, prompts, instructions, and AI-generated output, such as lesson drafts, assignments, grading suggestions, summaries, or course structuring.

We process payment and billing data: purchases, subscriptions, amounts, dates, payment status, refunds, disputes, and data needed for payouts to educators or schools. Payment card data is typically processed by payment providers; SubSchool receives limited payment metadata.

We process technical and analytics data: IP address, device, browser, language, time zone, cookie and storage identifiers, security logs, app pages and sections, UTM parameters, advertising click identifiers, and registration or product usage events.

How data is used

We use data to create and protect accounts, provide access to courses and lessons, save progress, support communication between participants, process payments and support requests, prevent misuse, send important service notices, and improve the quality of the app.

We use data to operate AI features, process purchases, subscriptions, and payouts, prevent fraud, meet tax and accounting obligations, and investigate disputes or violations of service rules.

Depending on the context, we rely on contract performance, legitimate interests in security, support, and service improvement, legal obligations, or user consent, for example for certain analytics, advertising, or marketing technologies where consent is required.

Cookies, storage, and analytics

SubSchool uses cookies, localStorage, and sessionStorage for necessary functions: account login, session persistence, interface language, account switching, security, diagnostics, and context restoration. These technologies may store auth tokens, profile data, language preferences, and service identifiers.

We may also use analytics and advertising services, including Google Analytics and Google Ads, to understand how the app works, measure registration, and improve product effectiveness. These services may use their own identifiers and browser signals. Where consent is required, users can accept or reject these technologies through the consent banner or consent settings.

Student data and educational content

If SubSchool is used by a school, educator, parent, or other organization to teach students, student data is processed to provide educational features and manage learning. If special rules for children or education records apply, such as COPPA or FERPA in the United States, the relevant school, organization, or parent may define additional requirements for consent, access, and deletion.

Sharing with third parties

We share data with providers and partners that help operate SubSchool: hosting and infrastructure, analytics, payments, email and notifications, support, security, AI features, file storage, and service administration. Recipients must use data only to provide the relevant services or on another lawful basis.

Some data is visible to other users by design: an educator profile and public course information may appear in a catalog or marketplace; students and educators may see messages, materials, submissions, grades, and feedback within the learning context; a school or organization may see data needed to manage its users, courses, activity, and revenue sharing.

We may disclose data if required by law, court order, or government request, to protect users, minors, SubSchool, and third parties, or to prevent fraud, misuse, or security threats.

We do not sell personal data in the ordinary meaning of the word. Some analytics or advertising technologies may be considered a sale or sharing under certain US state laws if they are used for cross-context advertising. Where this applies, we provide the required notices and opt-out or consent mechanisms.

International data transfers

SubSchool is registered in the United Kingdom, and users and service providers may be located in different countries, including the United States. If data is transferred outside the user country, we apply reasonable contractual, organizational, and technical safeguards, including access restrictions and provider requirements.

Retention

We keep data for as long as needed to provide the service, support the account, meet contractual and legal obligations, maintain security, keep accounting records, resolve disputes, and protect lawful interests. The specific period depends on the data type, account settings, legal requirements, and the need to preserve evidence of operations or consents.

User rights

Users in the United Kingdom, European Economic Area, and regions with similar rules may have the right to request access, correction, deletion, data portability, restriction of processing, objection to processing, or withdrawal of consent. Users may also have the right to complain to a local supervisory authority, including the ICO in the United Kingdom.

Users in the United States, including residents of California and other states with privacy laws, may have rights to access, correct, delete, receive a copy of data, opt out of sale or sharing, opt out of targeted advertising, and limit the use of sensitive personal information if those rights apply to SubSchool and the specific processing scenario.

Users can reject optional cookies and analytics or advertising technologies through the consent banner or consent settings, and can opt out of marketing communications if such communications are sent. Necessary service messages related to the account, security, or learning may still be sent.

Security

We use technical and organizational measures to protect data against unauthorized access, loss, alteration, and disclosure. No service can guarantee absolute security, so users should protect their credentials and tell us about suspicious activity.

Contacts and requests

Privacy questions and personal-data requests can be sent through account support or to the email address listed on the Contacts page. We may request verification of identity or authority before fulfilling a request.

Policy changes

We may update this Privacy Policy as SubSchool evolves, laws change, or new features and providers are added. When we update it, we change the date in the document and, if a change is material, may provide an in-product notice or another reasonable notice.