Privacy, in plain language.

ClassFlow Academy, operating from Lebanon, provides the ClassFlow private-pilot service. This notice applies to our public website, academy application, ClassFlow workspace, public registration pages, and support conversations.

An academy decides why and how it uses student, guardian, coach, attendance, and academy payment information in its own operations. The academy is responsible for its notices, permissions, and lawful use of that information. ClassFlow handles the information needed to provide the platform and support those instructions.

• Applications and accounts: name, email, phone, password authentication, academy details, selected plan, email confirmation, approval status, and account role.
• Academy operations: academy profile, staff and coaches, programs, classes, schedules, sessions, locations, and capacity settings.
• Students and guardians: names, date of birth, relationship and contact details, registrations, attendance, WhatsApp consent, and notes. Optional notes may contain health or other sensitive details, so only information genuinely needed by the academy should be entered.
• Payment and subscription records: academy-entered student payment records and ClassFlow plan, draft, invoice, receipt, delivery, and activity history. ClassFlow does not process parent money.
• Technical and support data: necessary session and security cookies, provider request and security logs, browser or device details made available to infrastructure providers, a local help-tour completion flag, and information sent in support emails.

ClassFlow does not currently use advertising cookies or an external product-analytics tracker.

• To create, review, authenticate, and support accounts.
• To provide tenant-separated registration, scheduling, attendance, payment-record, and parent-follow-up workflows.
• To operate manual ClassFlow subscription billing, document delivery history, and audit important administrative actions.
• To protect the service, investigate errors or misuse, and meet applicable legal obligations.
• To communicate about an application, account, support request, or service operation. WhatsApp follow-up requires the guardian's explicit choice and is opened for a person to review and send manually.

We use information where it is needed to provide the requested service, carry out an agreement, protect the platform and its users, comply with law, or where valid consent has been given.

ClassFlow does not offer accounts directly to children. A parent, guardian, or authorized academy representative supplies student information for academy operations and must have the authority to do so. Academies should collect the minimum information needed and should not place unnecessary medical or sensitive details in notes.

For a request about a student, guardian, attendance, or academy payment record, contact the academy first because it controls the operational record. We will support the academy when the request concerns information stored in ClassFlow.

We share information only as needed to operate the service:

• Supabase provides authentication and database infrastructure.
• Vercel hosts and serves the application.
• Resend handles transactional account and approved invoice emails.
• WhatsApp receives the phone number and prepared text only when an authorized user deliberately opens a WhatsApp link. WhatsApp then handles that information under its own terms.
• Authorities or professional advisers may receive information when disclosure is required by applicable law or reasonably needed to protect legal rights and service security.

We do not sell or rent personal information and do not use it for targeted advertising. Infrastructure providers may process information outside Lebanon as part of delivering their services.

We keep information while an account is active and for as long as it is reasonably needed to provide the service, resolve support or security issues, maintain reliable backups and audit trails, and meet billing or legal obligations. Different records may therefore be kept for different periods.

A deletion request may be limited where a record must be retained for security, invoicing, audit, dispute, or legal reasons. We will explain the outcome of a verified request.

Depending on the circumstances and applicable law, you may ask to access, correct, or delete information, object to certain handling, or withdraw a consent choice. Withdrawing consent does not undo handling that already lawfully occurred.

We may need to verify identity and authority before acting. Contact the academy first for its operational records, or email mahdialihaidar@gmail.com for a ClassFlow account, platform, or privacy request.

ClassFlow uses necessary cookies to keep users signed in and support account security. The app also stores a small local flag after a user finishes or dismisses the help tour. These are operational features, not advertising. We will update this notice and provide appropriate choices before adding non-essential tracking.

We use tenant boundaries, restricted server operations, and deliberate billing and communication workflows to reduce risk. No online service can guarantee absolute security. Please report a suspected account or data issue promptly and review our Security overview.

This notice is designed with reference to applicable Lebanese law, including Law No. 81 of 2018 concerning electronic transactions and personal data. Official public references are available from the Ministry of Economy and Trade and the Banque du Liban laws directory.

We may update this notice when the product, providers, or legal requirements change. The effective date at the top shows the current version. Material changes will be communicated through an appropriate service channel.

For privacy or data questions, email mahdialihaidar@gmail.com. Please do not send passwords, full payment-card details, or unnecessary child or medical documents by email.