Personal data processing principles
Effective from 9 October 2026
These principles describe how ForClassmates s.r.o. processes the personal data of users and visitors of the ForClassmates educational application (the "Application"), available at www.forclassmates.com and through its interfaces. We issue them under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and Czech Act No. 110/2019 Coll., on the processing of personal data.
1. Controller
1.1. The controller of personal data is ForClassmates s.r.o., company ID (IČO) 05625351, with its registered office at Evropská 516/10, Dejvice, 160 00 Prague 6, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 297922 ("we").
1.2. For matters concerning personal data, contact us at info@forclassmates.com or at our registered office. We have not appointed a data protection officer.
1.3. Where a school or another organisation uses the Application for its pupils or employees under a data processing agreement, that organisation is the controller of the data it enters in the Application and we are its processor. In that case, please contact the organisation first.
2. Whose data we process
2.1. We process the data of registered users (students, teachers and parents), children under 15 and their legal guardians, creators of public content, representatives of schools and other organisations, subscription customers and visitors of the Application who are not logged in.
3. Purposes, data, legal bases and retention
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Registration and Account management | e-mail, password (stored as a one-way hash from which it cannot be recovered), username, first name and surname if you provide them, account type, date of birth, language, profile photo, Google account identifier when signing in with Google, e-mail of the legal guardian for children under 15 | performance of a contract (Art. 6(1)(b) GDPR); for children under 15, consent of the legal guardian (Art. 8 GDPR, Section 7 of Czech Act No. 110/2019 Coll.) | for as long as the Account exists |
| Providing the features of the Application | content created and uploaded, answers and results, progress in courses, time spent on pages of the Application (page address, start and end), membership in organisations and groups, tasks, posts and comments, points, levels, streaks and badges, game nicknames | performance of a contract | for as long as the Account exists; deleted content under Article 10.2 of the Licence Terms |
| Making statistics available to parents, teachers and groups | results, progress, activity, the child's content | performance of a contract; for parents also the legitimate interest of the legal guardian in supervising the child | for as long as the accounts are linked or the group membership lasts |
| AI Features | requests and materials entered into AI Features (texts, files, images), voice recordings when dictating, AI outputs, history of conversations with the AI assistant, records of AI Credit usage | performance of a contract | for as long as the Account exists; we do not store voice recordings |
| Subscription and payments | e-mail, Plan, payment history, billing details you enter with the payment processor (name, address, VAT number), Stripe customer identifier | performance of a contract; compliance with a legal obligation (Art. 6(1)(c) GDPR) | for the duration of the Subscription; tax documents for 10 years under the Czech VAT Act |
| Support, complaints and content reports | e-mail, content of the message, reported content, outcome | performance of a contract; legitimate interest in handling the request and complying with the Digital Services Act | 3 years after the matter is resolved |
| Commercial communications | e-mail, name, language, account type, Plan | consent (Art. 6(1)(a) GDPR); for customers, legitimate interest (Section 7(3) of Czech Act No. 480/2004 Coll.) | until consent is withdrawn or you unsubscribe |
| Measuring traffic and improving the Application | data on the use of the Application, cookie identifiers, device and browser data | Google Analytics: legitimate interest in measuring traffic; Microsoft Clarity and PostHog: consent | according to the Cookie Policy |
| Security and prevention of misuse | IP address, technical logs, error records, records of access by Connected Applications | legitimate interest (Art. 6(1)(f) GDPR) | usually 90 days |
| Visitors who are not logged in | anonymous browser identifier, pages viewed and time spent on them, answers in public content, nickname in a live game | legitimate interest in operating the Application and in statistics | for the validity of the identifier (1 year) |
| Protection of legal claims | data needed to establish a claim | legitimate interest | for the limitation periods and the duration of any dispute |
3.1. Without the data necessary to perform the contract, we cannot create an Account or provide the Application. Providing other data is voluntary.
3.2. The content you create may contain personal data that you enter into it yourself. Do not include personal data of other persons, in particular pupils, in public content.
4. Children
4.1. A child under 15 may register only with the consent of their legal guardian. At registration, the child enters the guardian's e-mail address. We send the guardian a link to give consent. The Account cannot be used until consent is given. If the guardian refuses consent, we deactivate the Account.
4.2. The legal guardian may withdraw consent at any time by e-mail to info@forclassmates.com. We then cancel the child's Account.
4.3. A linked parent can see the child's statistics and content. A teacher can see the results and activity of pupils in their groups.
5. Profiling and automated decision-making
5.1. We evaluate learning progress, statistics, points and badges from answers and activity. This is used to provide the Application to you, your teachers and your parents. We do not make decisions about you by automated means that would produce legal effects or similarly significantly affect you (Art. 22 GDPR).
6. Who we share data with
6.1. Data is processed by our suppliers (processors), only on our instructions and to the extent needed for their service:
| Recipient | Purpose |
|---|---|
| Railway Corporation (USA) | hosting of the Application and databases |
| Amazon Web Services (servers in the EU) | file storage, sending service e-mails |
| Google (Gemini API) | AI Features |
| OpenAI | checking game nicknames, search in public content |
| Deepgram | speech-to-text transcription and dictation |
| Stripe | processing of payments and subscriptions |
| SmartEmailing (Czech Republic) | sending commercial communications |
| Functional Software, Inc. (Sentry) | error records of the Application |
| Mux | storage and playback of uploaded videos |
| Google (Analytics), Microsoft (Clarity), PostHog | measuring traffic and use; Clarity and PostHog only with consent |
| n8n automation tool | service e-mails about subscriptions |
6.2. Other recipients are:
a) other users, to the extent you make content or statistics available to them, for example members of your groups, teachers, linked parents and fellow players in a live game (username, nickname, profile photo, points),
b) Connected Applications (for example ChatGPT or Claude) that you have linked to your Account yourself; their operators process the data as independent controllers under their own terms,
c) Google, if you sign in with a Google account,
d) providers of embedded videos (YouTube, Vimeo) when you play them,
e) public authorities, where the law requires it,
f) our advisers (accountants, tax and legal advisers), who are bound by confidentiality.
7. Transfers outside the EU
7.1. Some recipients are based in or process data in the USA. We transfer data to them on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework) where the recipient is certified, and otherwise on the basis of standard contractual clauses approved by the European Commission. We will provide a copy of the safeguards on request.
8. Security
8.1. We protect data with technical and organisational measures, in particular encrypted transmission, storing passwords as one-way hashes, access control and backups.
9. Your rights
9.1. You have the right:
a) to access your personal data and obtain a copy,
b) to have inaccurate data corrected,
c) to erasure, where we no longer need the data or process it unlawfully,
d) to restriction of processing,
e) to portability of data you have provided to us,
f) to object to processing based on legitimate interest, including objecting to commercial communications,
g) to withdraw consent at any time; withdrawal does not affect processing before it.
9.2. You can exercise your rights by e-mail to info@forclassmates.com, preferably from your Account's e-mail address. You can change some data yourself in the Account settings. We will reply within one month; in complex cases we may extend this by two months.
9.3. You have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
10. Cookies
10.1. The cookies and similar technologies we use, and how you can change your choice, are described in the Cookie Policy.
11. Changes to these principles
11.1. We may update these principles. We will inform you of significant changes by e-mail or in the Application. These principles are effective from 9 October 2026 and replace the principles effective from 1 January 2024.