Privacy Policy

Privacy Policy

This document explains directly what data we collect, who we share it with, and how long we keep it. No vague language – we name specific companies because your recordings really do go to them. The most important principle: we don't delete your data on our own – it stays as long as you have an account and only disappears when you ask.

1. Who is responsible for the data

The data controller (and also the seller of paid plans) is Filip Biskupski, operating an unregistered business (Art. 5 of the Act of 6 March 2018 – Entrepreneurs' Law), without a tax ID or business registry number. We will provide a mailing address on request sent to the email below. Contact: <a href="mailto:support@biskupski.site">support@biskupski.site</a>. For matters regarding your data, write to this address.

The ClassFlowy app on Android is published on Google Play by Media Gears (developer account) on behalf of the controller. Media Gears has no access to your data in ClassFlowy and does not process it – Filip Biskupski remains the data controller, as above.

2. What data we collect

• Account: email address, username, optional display name, encrypted password hash, account creation and last login dates, and account language (chosen in Settings or the language of the page where you registered) – we use it to email you, the assistant and Helper respond in it, the payment page opens in it.
• Sign in with Google or Apple (only if you choose this method): from Google or Apple we receive the ID of your account with that provider, your email address (Google – also whether it is verified; Apple – this may be a privaterelay.appleid.com relay address) and your first name (Google – from your profile; Apple – only on the first sign-in and only if you share it), which we use only to suggest a nickname. We store the ID, the latest address at the provider, the name, and the dates of connecting and last use – to recognise you the next time you sign in. With Sign in with Apple we may also keep an encrypted refresh token from Apple, solely so that we can revoke ClassFlowy's access to your Apple account when you delete your account. We delete this data when you disconnect the method in Settings or together with your account.
• Registration before clicking the link: email address, username, encrypted password hash, age statement, and the language of the page where you registered (in which we send the link) – only to confirm your email, for a maximum of 48 hours.
• Materials: audio and video recordings, photos of the board, files and notes you upload, and textbooks (PDF, EPUB, or page photos) from your shelf.
• Processing results: transcripts of recordings, text read from photos, lesson descriptions, textbook page text with page numbers.
• Conversations with the assistant: your questions, model responses, and the assistant's „memory" – facts it has learned about your studies.
• Assistant response reports: when you click „Report" on a response, we save a copy of that response and your question before it, the reason you selected, and your comment – so the administrator can review it. Reports disappear with your account.
• Lesson schedule and calendar: subjects, times, assignment of materials to lessons.
• Helper (help chat): your messages to the Helper and bot or consultant responses, and when the bot submits a report – its content, your plan, and whether you wrote from the website or the app. Without an account: a random identifier in the <code>work_help</code> cookie and your email address if you provide it in a report yourself. To count the daily message limit without an account, we use a one-day cryptographic hash of your IP address – we don't save the address itself. Details in the „Helper (help chat)" section below.
• Technical: your IP address when logging in, registering, messaging the assistant, and uploading materials (protection against bots and abuse), usage limit counter.
• Push notifications from the server (only if you enable „Materials processing complete" or „Assistant response ready" in the mobile app): device token – an identifier of the app installation assigned by Firebase Cloud Messaging – with the operating system type (Android or iOS), the login session from which the phone reported it, and the date reported and last sent; plus a short log of sent signals (type, lesson or conversation ID, time) – no content, only to avoid sending too many notifications.
• Payments (if you buy a plan or package or top up your balance): what you buy, the amount, payment status and dates, and payment and subscription IDs in the payment gateway. For the balance, also its amount, operation history (top-ups, bonuses, usage over the limit, storage fees, refunds, adjustments) and your balance settings (spending limit, automatic top-up). A card saved for automatic top-ups is stored by the payment operator – we do not see card numbers, BLIK data, or bank login credentials.
• Partner link (only if you first visited ClassFlowy through a partner link and created an account within 30 days): which link it was and when your account was assigned to it, and the payment records needed for settlements with the partner. Only the ClassFlowy administrator sees them – the partner receives no user data.

We do not collect location data, we do not track you across other websites, we have no ads or external analytics.

3. Classes and sharing

We share with other accounts knowledge only, never files. Here's exactly what a class, a person with a shared subject, and a link recipient see – and what no one sees.

• No one sees raw transcripts, photo reads, or document text – not even you. AI processes it to write a lesson note, but the read text itself doesn't leave the server: not in the interface, not in chat, not through a connected assistant, not in search results. You can always listen, watch, or download your own file – you won't see the text read from it. The exception is a handwritten note: its content is your own words, so you see it. The second exception is textbooks: their page text is textbook content, not your lesson, so you see it in page previews, the assistant uses it, and people you share the subject with also see it (see below).
• A lesson note is lossless, not a summary. It contains all knowledge from the lesson – definitions, examples with solutions, metaphors, quotes, homework – organised by topic. It's meant to replace the recording, so it has no timestamps or list of materials.
• Class gets only the shared lesson note, compiled from the materials of members that aren't private and come from subjects you share with it, plus items from your lesson schedule (subject, day, lesson number, room, teacher) from subjects you share with it. By default, the class gets nothing from you: you share only the subjects you mark in class settings, and only from them do you get shared notes. If you joined the class before this policy version took effect, you share all your subjects except excluded ones until you switch to marking subjects. No one – including us – shows who contributed what or whose a given schedule item is. Only a file's owner sees it.
• Private material feeds only your own note – never a class note or any sharing. A note someone sent you is treated the same way: it can't be shared further.
• Shared subject and lesson link show only the note to share – never files, materials, or additional notes. A shared subject also shows its items from your lesson schedule, without the rest of your schedule. The only addition to a shared subject (and in class): textbook page text linked to that subject – the recipient can browse them and ask the assistant about them. They won't download the textbook file, and a lesson link doesn't show the textbook lesson. When your plan stops including textbooks or you archive a textbook, recipients stop seeing it. When you open a lesson link logged in, the lesson goes to your account, and the person who shared it sees your username on the list of people with access (and can revoke it). Opening the link saves one technical access cookie for that specific lesson in your browser – details in the <a href="/cookies">cookie policy</a>.
• Shared conversation with the assistant is visible to anyone with its link (also without an account) until you turn it off – the link shows a copy of your questions and assistant responses at the time of sharing, without attachments, photos, username, or email address.
• A lesson sent to a classmate (by username, email, or link) goes to their calendar as their own text note. It's a copy – it stays with them even if you delete your account.
• Leaving a class, excluding a subject, turning off sharing, or deleting your account immediately recalculates the class's shared notes from scratch, without your contribution – without warning and without asking for consent. That's the only way we can be sure withdrawn material really disappears.

4. Why and on what basis

• Maintaining your account and providing the service – because the agreement between us covers it (Art. 6(1)(b) GDPR).
• Processing materials by AI (transcription, photo reading, lesson descriptions, assistant responses) – this is the heart of the service you ask for by uploading a file or asking a question; basis as above.
• Protection against bots and abuse, and monitoring limits – our legitimate interest (Art. 6(1)(f) GDPR).
• Helper – answers to questions about the service, reports, and conversation with a consultant: with an account – performance of contract (Art. 6(1)(b) GDPR); without an account – our legitimate interest in answering questions about the service (Art. 6(1)(f) GDPR).
• Sending account emails (link setting up account, address confirmation, password reset) – performance of contract. We don't send newsletters or ads.
• Push notifications about a ready lesson note and ready assistant response – performance of contract, only when you enable them in the app; you can turn them off anytime in Settings → Notifications.
• Processing payments for plans and packages – performance of contract; keeping payment records – legal obligation from accounting and tax laws (Art. 6(1)(c) GDPR).
• Partner link – assigning a new account to the partner link through which someone first came to us, and settlements with partners – our legitimate interest (Art. 6(1)(f) GDPR).

We do not make decisions about you based solely on automated processing that would have legal effects or impact you similarly significantly (Art. 22 GDPR), and we do not profile you for marketing. The only automatic decision mechanism is an anti-bot system that may reject a login, registration, password reset, or – without an account – your first message to the Helper if suspected to be bot activity – it evaluates only technical browser signals, not you as a person, and AI generates materials only on your request, never automatically.

5. Who we share data with

These are entities that actually receive your content. It's worth knowing before uploading a recording:

• DeepInfra (USA) – recognises speakers in recordings, improves their transcript, and when Soniox fails or does not support the lesson language, itself processes recordings into text; reads photos of the board and textbook pages from photos or scans, describes textbook illustrations, counts content similarity for search, and generates assistant responses. The content of materials and conversations goes there, including Help chat conversations, and for conversations – also the language the model should respond in (from account or browser). The default models (including Qwen, DeepSeek, Nvidia Nemotron) are hosted directly by DeepInfra – it does not pass them to Google or other model makers, which matters especially for photos of notes by minors. The only exceptions are the „Sonnet" and „Opus" options in chat – see the next point. GPT models do not go through DeepInfra: see the point on OpenAI. When you click “Read aloud”, DeepInfra also receives the text of that answer and turns it into audio (the Chatterbox model); we keep the finished audio only in the server’s memory, for an hour at most, and do not save it to disk.
• Anthropic PBC (USA), through DeepInfra – only and exclusively when you choose the „Sonnet" or „Opus" option (Claude Sonnet and Claude Opus models) in chat. Your conversation content then goes there: your messages, photos attached to them, and fragments of notes and materials the assistant used to answer. At Flash, Pro, and Max levels and in every other ClassFlowy function (transcription, photo reading, lesson descriptions, search), nothing goes to Anthropic, and when a Claude model fails, the response is completed by a model hosted by DeepInfra, never another Anthropic model. Anthropic processes this data according to its own privacy policy.
• Soniox (Soniox Inc., USA) – converts speech to text. Recordings and materials with sound, including sound from videos: our server sends Soniox the audio file under a random name, with a list of languages to recognise, without long stretches of silence; Soniox does not receive your email, username, or account identifier. Once the text comes back to us, we immediately delete the file and its transcript at Soniox. If that doesn't work, we retry automatically after a few hours, and Soniox itself deletes such data at the latest after 30 days. Live answers, only when you turn on listening yourself (from the Plus plan): the sound from the microphone and the text made from it flow directly between your device and Soniox, on a short-lived ticket issued by our server. Soniox also gets the device's IP address, the languages to recognise, and a random session identifier, but not your email, username, or account identifier, and according to its privacy policy it does not store such live speech data. Live notes, only when you turn on recording in the note: the sound from the microphone flows directly from your device to Soniox, on a short-lived ticket issued by our server; Soniox gets the device's IP address, the languages to recognise, and a random session identifier, but not your email, username, or account identifier, and according to its policy it does not store audio from live speech; only the text comes back to us. According to Soniox's documentation, it does not use audio or text from them to train models.
• OpenAI (OpenAI Ireland Ltd. and OpenAI entities in the USA) – only in two cases you choose yourself: when you turn on voice chat with the assistant, or when you pick a GPT model in chat (Luna, Terra, Sol, Astra). In voice chat the audio flows directly between your device and OpenAI, so OpenAI also gets your device's IP address. In both cases it receives the content of the conversation and the context passed to it: your name or username, language, your subjects, upcoming homework and tests, what the assistant remembers about you, recent messages in the conversation, photos attached to messages, and what the assistant fetches from your data to answer (for example your calendar, notes, transcripts of materials, and, if you connect the e-register, also changes from it). According to OpenAI's documentation, data sent through its API is not used by default to train models, and abuse-monitoring logs are kept for up to 30 days. Without these two choices, nothing from your conversations or materials goes to OpenAI this way; an assistant you connect yourself is a separate matter, described below.
• Hetzner (Germany) – the server where the app and database run. Your files are here.
• Resend (USA) – sends account emails (account setup link, address confirmation, password reset) when the Resend key is set on the server – that's how it is in production today because Hetzner (see below) blocks outgoing SMTP ports by default. Without this key, the same emails are sent directly by Namecheap Private Email (USA) over SMTP from system@biskupski.site. In both cases, the provider gets your email address and the content of that one system message, never material content. This same path carries a message to the administrator about a new report from the Helper – with the report's content and the email of the person who sent it.
• Anty Bot (antybot.biskupski.site) – protection against bots. It checks login, registration, and password reset (openly, can reject attempts) and, in the background and without blocking anyone, messages to the assistant and uploading materials (to catch automated limit abuse). It also checks, once per conversation and invisibly, the first message to the Helper on the website – without an account it can reject it. It only gets technical browser signals and IP address – never material or conversation content.
• Tavily (USA) – web search and page content retrieval. In a conversation the assistant also uses it without a separate request when needed: when information may have changed, when a fact, date or name needs checking, or when a question goes beyond your materials. Tavily then gets the query content (and when opening a specific page – its address), your conversation ID, and an irreversible cryptographic hash of your account ID – technical data that allows the provider to limit abuse, can't be used to recover your data. When creating a lesson description, the model may also send Tavily a short query about a surname or proper name, to check whether it is written correctly in a recording or photo. We do not check dates, numbers, terms or concepts this way. Such a query is not meant to contain personal data: we filter out the names of students and teachers, the name of the school and class, and longer quotes from materials, and Tavily then gets no ID of your account or conversation. The results only serve to correct the record; we do not add new information from them to the description.
• Payment Gateway (platnosci.biskupski.site) – the payment system run by the ClassFlowy owner, only when you buy something or top up your balance (also automatically, if you turn that on). It gets your account ID, email address, what and how much you're buying, and the language the payment page should open in (from your account language).
• Stripe – payment operator through which the gateway accepts money. You provide card, BLIK, or Przelewy24 data directly on Stripe's website; Stripe processes it according to its own privacy policy, and this data does not reach ClassFlowy.
• Google (Firebase Cloud Messaging service, USA) – delivers push notifications to your phone, only if you enable „Materials processing complete" or „Assistant response ready" in the app (both are off by default). It gets the device token (app installation ID) and an empty signal: event type and a random lesson or conversation ID (and when the phone connects to this service – its IP address). Never material content, notes, transcripts, subject names, titles, or conversations – the notification text is assembled by the phone itself after fetching data from our server. Reminders about homework and tests are still scheduled by the phone itself, without Google. Without enabling these notifications, the app doesn't connect to Firebase.
• Google (Google Sign-In, USA) and Apple (Sign in with Apple, USA) – only if you sign in or create an account this way. We redirect you to the provider's page (or the app opens its sign-in window), and the provider confirms your identity to us with the data described above. We send the provider only what sign-in requires (ClassFlowy's app ID, a one-time code), and to Apple – when you delete your account or disconnect Apple – a request to revoke access. We don't share material or conversation content with them. Google and Apple process your account data on their side as separate controllers, under their own privacy policies.
• An AI assistant you connect yourself (e.g., Claude – Anthropic, ChatGPT – OpenAI, Gemini – Google) – only with your consent; see details below.

„To help the lesson note distinguish teacher and student utterances, the recording also goes through speaker recognition (Nemotron model, DeepInfra), which marks fragments as „teacher" or „student 1, 2, 3…". This distinction works only within a single recording – we don't save names or voice characteristics, so no label links to a specific person or another recording; labels only go into the note."

Photos of the board or notes are read not by one model but several at once – all hosted by DeepInfra – and their reads are combined into one text by another DeepInfra model, which only gets the reads themselves (not the photo) and makes no guesses about anything that isn't in at least one of them. Multiple models at once make fewer mistakes about numbers and dates than a single model.

When DeepInfra transcribes the recording, in a foreign language lesson, a fragment that speech recognition first heard as Polish is double-checked with the lesson language forced (and vice versa) – this way sentences in a foreign language don't get lost in recognition, which by default „hears" Polish.

Data transfer outside the European Economic Area: DeepInfra, Anthropic (only with the „Sonnet" and „Opus" options), Namecheap/Resend, Tavily, and Google (Firebase Cloud Messaging – only when you enable server notifications) operate in the USA, outside the EEA. We transfer data to them based on their standard contractual clauses (a security mechanism provided for in Art. 46 GDPR) – a publicly documented mechanism for data transfer that each of these providers relies on. Soniox (recordings and materials with sound, and listening in Live answers) is also based in the USA; when transferring data outside the EEA it applies the contractual safeguards described in its privacy policy. OpenAI (only with voice chat and GPT models): our contract is with OpenAI Ireland Ltd., and data it transfers outside the EEA, including to the USA, is protected by standard contractual clauses or a European Commission adequacy decision.

We do not sell data and do not share it with anyone for advertising purposes.

6. Connected AI assistants (MCP)

You can connect an external assistant to ClassFlowy – for example, Claude, ChatGPT, or Gemini. This happens only when you start the connection, log in to ClassFlowy, and click „Allow" on the consent screen. Without this, no assistant has access to your data.

• What the assistant gets: whatever it asks for in the course of your conversation with it – calendar, lesson schedule, subjects, lessons with descriptions and notes, homework and tests, text of textbook pages (yours and those shared with you through a subject), knowledge base entries, search results, and calculations. Data goes to the company running that assistant and is subject to their privacy policy.
• What it never gets: transcripts of recordings and text read from photos, original files, or your conversations with the ClassFlowy assistant.
• What it can change: if you leave the checkbox checked on the consent screen – add a note to a lesson; add, change or delete homework or a test; change a lesson's topic, subject, date and times (a lesson moved to a day on which you already have a lesson of that subject is merged with it); rename a material or move it to another lesson; change an entry of your own timetable; save or delete a knowledge base entry. A change takes effect immediately, without approval in ClassFlowy. Without that consent, the assistant only reads.
• What we don't get: your conversation with that assistant. We only see ClassFlowy tool calls – what was fetched or saved – and count them toward your plan limit.
• What we keep: the app name and domain access returns to, connection date and last use date, and access tokens – only as cryptographic hashes.
• How to revoke access: in Settings → Chatbots click „Disconnect" – it works instantly. Blocking your account also cuts all connections.

7. Helper (help chat)

On the page <a href="/pomoc">/pomoc</a> (also without an account) and in the app (Settings → Help), you can ask the Helper – a bot that answers based on our documentation and your account data, carries out actions on your account after you confirm them with a button, and when it can’t help on its own, files a report to the administrator.

• Who reads your messages: a language model hosted by DeepInfra writes responses – your messages from this conversation go there (in longer conversations, the same model first summarises), fragments of our documentation, and the language in which to respond (from your account, chosen page language, or browser settings). When you're signed in, the model also sees the account data it needs to answer: plan, limits and usage, balance, payments, processing status, and the names of lessons, subjects and materials. It also sees the account history: titles and dates of conversations with the assistant, names and status of materials, payments, exports and deletions. It sees the content of a single assistant conversation only if you ask about it. It never sees note content or raw transcripts.
• Account actions: the Helper changes nothing on its own. An action is carried out only after you click “Confirm” on the card in the chat. We save the action name, its parameters and the result, together with the conversation.
• To calculate a refund we save which features outside the Standard plan were used in a given period (just the name and date) and the largest storage space occupied each day (just the number of bytes, 400 days). Without the content of your files and conversations.
• Conversation record: we save the entire conversation and the administrator can read it – to help, check reports, and monitor response quality. The administrator can also take over the conversation and reply personally (you'll then see „Chatting with a consultant").
• Report (category, title, description, steps and result for errors) contains who sent it – account and its email or, without an account, the email you provided in the chat – your plan, and whether you wrote from the website or app. The administrator gets an email about a new report.
• Don't write in the chat passwords, card data, or other sensitive information – they're not needed for anything.
• Photos: photos and screenshots sent to the Helper are downscaled, stripped of EXIF data and stored encrypted together with the conversation. They go to the model at DeepInfra only in the reply you attach them to. You and the administrator can see them; they disappear with the conversation (12 months) or with your account. Some actions you confirm with your account password. We check the password immediately and do not save it in the conversation or pass it to the model. We keep a short history of deletions (what was deleted and when) so the Helper can answer what happened; we keep it for a year.
• How long: we keep Helper conversations for 12 months from the last message, and reports for 12 months from the last change; then we delete them automatically. They disappear with your account right away.

8. Startup promotions (once per person)

Startup promotions (first month free or cheaper, and the bonus on your first balance top-up – payment terms, point 3a) are available once per person. To enforce this even when someone deletes an account and creates a new one, when you buy or top up with a promotion we save:

• What: a one-way hash (HMAC-SHA-256 with a server secret key) of your email address after normalisation (lowercase; Gmail addresses without periods and „+tags"), the type of promotion used, date, and payment ID. The email address itself is not in this record, and the hash can't be reversed back to the address. When the payment operator starts providing a card fingerprint (card ID without its number), we'll also save its hash.
• Why and on what basis: so promotions are truly one-time – our legitimate interest (Art. 6(1)(f) GDPR): preventing promotion abuse.
• How long: 24 months from using the promotion, also after deleting your account (the record is not linked to the account); then we delete it automatically.
• Objection: you can file an objection (support@biskupski.site) – we'll then delete the hash, but future startup promotions won't be available for that email address, because without the record we can't check that it's the first time.

9. Timetable import from Librus and VULCAN

When editing your timetable, you can sync it with the Librus e-register (Librus Synergia, run by Librus sp. z o.o., Poland). You do this yourself with the “Sync with Librus” button – nothing happens automatically.

• What we send to Librus: the login (or Librus Rodzina account email) and password you type in the import window – only to sign in on your behalf and download the timetable. We don't store them: they exist only in the server's memory for a single request and never reach the database or the logs. The same goes for the access tokens Librus returns after signing in.
• What we download: the timetable for the coming weeks (subjects, days, times, rooms, teachers' names, substitutions and cancelled lessons) and the list of student accounts linked to the account (the student's name – only so a parent can pick a child; we don't store it).
• What we store: the timetable entries (subject, day, lesson number, bell times, room, teacher) – just as if you had typed them in by hand, marked as coming from Librus. First we show you the list of changes; once you confirm it, from today your timetable is the same as in Librus, and entries that aren’t there are removed from the weekly timetable. Earlier days in the calendar and lessons with recordings, notes and materials stay unchanged. Until you confirm (at most about 10 minutes) we keep the downloaded timetable on the server – without the login, password or the student’s name.
• Legal basis: performance of the contract at your request (Art. 6(1)(b) GDPR). Teachers' names in the timetable are processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) – as part of your timetable, as with manual entry.
• Children's data: if you sign in with a parent account, you import your child's timetable. Do so only as the child's parent or guardian. Accounts of minors are subject to the rules in the “Children and young people” section.
• Librus is an independent provider and handles your sign-in under its own rules. ClassFlowy is not affiliated with Librus; we use the same sign-in method as the Librus mobile app.

VULCAN (eduVULCAN). Syncing with the VULCAN e-register (UONET+ / eduVULCAN, run by VULCAN sp. z o.o., Poland) works the same way – with the “Sync with VULCAN” button, when this option is enabled. The differences:

• What we send to VULCAN: the eduVULCAN account email and password – only for a single request, without storing them (as above). To download the timetable, for this one import the server creates a one-time cryptographic key and registers it with VULCAN the way the register's mobile app does; that's why a new device may appear in the device list in eduVULCAN. We don't store the key – it ceases to exist after the import.
• What we download and store, legal basis, children's data: as for Librus above – the timetable for the coming weeks (with substitutions and cancelled lessons) and the list of students linked to the account (the name only to pick a child, not stored); timetable entries are marked as coming from VULCAN.
• VULCAN is an independent provider and handles your sign-in under its own rules. ClassFlowy is not affiliated with VULCAN; we use the same sign-in method as the VULCAN register's mobile app.

Permanent Librus connection (Plus plan and higher). In Settings → Librus you can connect your account permanently – the data from the e-register then updates in ClassFlowy on its own. You switch this on yourself and can switch it off at any time.

• What we store permanently: your Librus login and password, the sign-in session (token), and the name of the student whose account is connected. All of it is encrypted (AES-256, with the key kept outside the database) – the database holds only the ciphertext. It never reaches the logs or anyone other than Librus.
• What we download and keep: the timetable with cover lessons and cancelled lessons, the calendar (tests, quizzes, events), homework, marks (with weight, category, comment and teacher), attendance, messages (received and sent: subject, sender, recipients, attachment names and the content – of an unread message only once you open it), school announcements and the lucky number. We download attachments only when you ask, through our server, without saving them.
• Timetable: it comes from the e-register. When you connect, we show your lessons that aren’t in Librus: the ones you tick “keep” stay for good (as do lessons you add later), and we remove the rest from your timetable from today. Earlier days in the calendar don’t change.
• How often: during school hours (from half an hour before your first lesson to half an hour after your last one, according to your timetable) messages, marks, cover lessons and announcements every 15 minutes, and the timetable, attendance, calendar and homework every hour; outside them, everything every 3 hours; plus “Sync now”. You can switch off each type of data.
• What we do in Librus on your behalf: only what you ask for – sending a message, replying, marking a message as read (opening it). Nothing is sent on its own.
• Who sees it: only you. Marks, messages, attendance, announcements and homework never reach a class, shares or links. Your class members (and people you share a subject with) see the timetable and tests from the e-register only for the subjects you share with them – just like any entry of your timetable.
• Disconnecting: the login, password, session and student name are deleted straight away. The downloaded data stays on your account but stops updating – you can delete it together with disconnecting or by deleting your account. Connecting a different student's account deletes the previous student's data. If Librus rejects the saved password, syncing stops and we delete the login and password.
• Children's data: by connecting your child's account you entrust us with their marks, attendance and messages – do so only as their parent or guardian. We process them solely to show them to you.
• Legal basis and how long: performance of the contract – a service you switch on yourself (Art. 6(1)(b) GDPR); names of teachers and message senders – our legitimate interest (Art. 6(1)(f) GDPR), as part of your e-register data. We keep the data as long as your account exists or until you delete it; short records of changes (for notifications) and of sent messages (without their content) – 30 days.

Permanent VULCAN connection (Plus plan and higher). When this option is enabled, in Settings → E-register you can connect your eduVULCAN account permanently in the same way. For now we only read data – we don't change or send anything in VULCAN. The differences from Librus:

• What we store permanently: your eduVULCAN account email and password, the cryptographic key of the “device” registered with VULCAN when you connect (private key and certificate), the address of the e-register's server and the student's identifiers (school, student, school terms), and the student's name. All of it is encrypted as above (AES-256, the database holds only the ciphertext) and never reaches the logs.
• One device: we register the key once, when you connect (one new device then appears in the device list in eduVULCAN), and use it for every sync – without signing in with the password. We use the password only if VULCAN stops accepting the key: we then register a new one once, and if that fails too, syncing stops and we delete the email, password and key.
• What we download: the timetable with cover lessons and cancelled lessons, tests and quizzes, homework, marks (with weight, category, comment and teacher, including predicted and final marks), attendance and the lucky number – no messages or announcements. How often, who sees it, children's data, legal basis and how long – the same as for Librus above.
• Disconnecting: the email, password, key and student name are deleted straight away; the downloaded data stays (you can delete it together with disconnecting). We don't know a way to deregister the device on VULCAN's side – you can remove it from the device list on eduvulcan.pl.
• VULCAN is an independent provider (as above). A ClassFlowy account can have a permanent connection with one e-register at a time – Librus or VULCAN.

10. How long we keep data (retention)

The principle is simple: we keep your account, materials, notes, and conversations with the assistant as long as your account exists. We don't delete them ourselves – not over time, not due to inactivity. They disappear only when you ask (deleting a single material or note) or when you delete your entire account. The only exceptions are those required by law, service security, or report handling – listed below:

• Registration with an unclicked link – 48 hours. Then we delete it and the account never forms (this is data before account creation, not account data).
• Email tokens (confirmation, password reset, account deletion, space freeing) expire after 48 hours or one hour and work once – these are short-lived technical data protecting your session, not „materials, notes, or conversations."
• Helper conversations (help chat) and reports are support correspondence, not your materials: we keep them 12 months from the last message (report – from the last change), then delete automatically. Deleting your account deletes them right away. Daily message limit counters (without IP addresses) – a few days.
• AI assistant connections: access token expires in one hour, refresh token in 30 days from last renewal; expired ones we delete within an hour. Disconnecting the app invalidates them immediately.
• Device token for server notifications we delete when you turn off both types of these notifications, log out on the phone, or don't open the app for 60 days, and right away when Firebase reports the token is invalid. Log of sent signals (no content, only for limits) – 2 days.
• On the Standard plan, we delete the original audio/video file right after processing (your allocation is 0.3 GB); on the Plus plan, the file stays in compressed form (recording as audio, video in 720p, photos and documents in a lighter version) – when compressing, nothing is deleted without leaving a smaller version behind. This decision about the source file only is frozen at upload time – transcription, lesson note, or description are not touched by either mode. You can also consciously free up space after your own files anytime (Settings → Files) – it's always your decision, never ours automatic.
• After deleting your account, we delete your materials and notes. Class shared notes you belonged to are recalculated from scratch, without your contribution. Lessons you shared directly with someone or by link stay with them as their own note – that's already their copy, independent of your account.
• Payment records (what, when, and how much) also stay after account deletion – without linking to it in the ClassFlowy interface anymore – as long as accounting and tax laws require (usually a few years from the end of the tax year). This is the only exception imposed by law, not our decision. Active subscriptions we cancel when you delete your account.
• The hash of the email address of a person who used a startup promotion (not the address itself, see „Startup promotions" section above) – 24 months from use, also after account deletion, so promotions are one per person.
• Partner link: the assignment of your account to the link – as long as the account exists; settlement records – as long as payment records, after account deletion no longer linked to it. The work-polecenie cookie lives 30 days, and the work-wizyta marker – 400 days.
• Permanent Librus connection: login, password and session – until you disconnect (or until Librus rejects the password); data downloaded from the e-register – as long as the account exists or until you delete it; records of changes (for notifications) and of sent messages (without content) – 30 days (see the Librus section above).
• Permanent VULCAN connection: email, password and device key – until you disconnect (or until VULCAN rejects the key and registering a new one fails); data downloaded from the e-register – as long as the account exists or until you delete it; records of changes (for notifications) – 30 days (see the VULCAN part above).

11. Your rights

You have the right to access your data, correct it, delete it, limit processing, transfer it, and object to processing based on our legitimate interest (e.g., bot protection). Write to <a href="mailto:support@biskupski.site">support@biskupski.site</a> – we'll answer as soon as we can. You can get a free copy of your data from the Helper or by email to this address. You’ll receive a one-time link by email, valid for 7 days, working only after you sign in; the ZIP package contains your account data in JSON and your files in original form, but not raw transcripts and readings. We prepare copies in a queue: without undue delay, within 20 days at most on the Standard plan and within 7 days on paid plans, one copy per 30 days. How to delete your account and what happens to your data then is described on the page <a href="/usun-konto">Delete account and data</a> (in short: „Start account deletion" in Settings or email us). You also have the right to lodge a complaint with the President of the Office for Personal Data Protection (PUODO), ul. Stawki 2, 00-193 Warsaw, if you believe we process your data in violation of the law.

12. Children and young people

The basis for processing your data is performance of the service agreement (Art. 6(1)(b) GDPR), not your consent – so Art. 8 GDPR, which for consent to information society services sets a threshold of 16 years (Poland did not lower it to 13), does not directly apply here. However, because entering into a contract with a minor is subject to the Civil Code, we have adopted our own, more cautious rules.

The service is used by students, but is not intended for children under 13 – when creating an account you must check one statement (checkbox) that you are at least 13 years old. It's a self-declaration – we don't collect birth dates or anything that would let us verify it. If we learn an account was created by someone younger, we'll delete it along with the data.

If you are 13 to 17 years old, you have limited legal capacity (Art. 10–22 of the Civil Code) – to validly enter into an agreement with us (including buying a plan or package), you need a parent's or guardian's consent or later confirmation, except for minor everyday matters. We don't verify this at registration or purchase – it's an obligation resting on you and your parent/guardian, not a mechanism we check technically. A parent can at any time request to view the child's data, have it deleted, or withdraw an unconfirmed contract by writing to support@biskupski.site.

13. Security

The connection is encrypted (HTTPS), we keep passwords only as cryptographic hashes, email tokens are one-time and saved as hashes. Materials (files) are only visible to your account – you share only the lesson note with others, never the file. We don't promise absolute security, however – this is a service run after hours on a single server.