Privacy policy
Last updated 2026-09-28
This policy explains what SpiralClass does with personal data, why, and what you can ask us to do about it. It is written to be read, not to be survived — if any part of it is unclear, ask and we will explain it in plainer words.
Who we are
SpiralClass is operated by Jay Stewart, established in the United Kingdom and trading as SpiralClass. For everything described here we are the data controller: we decide what is collected and why.
Because we are established in the United Kingdom, UK GDPR and the Data Protection Act 2018 govern this policy. Where we serve people in the European Economic Area, the EU GDPR applies to that processing and gives you the same rights. Our Terms are governed by the laws of England and Wales.
Two kinds of people use SpiralClass, and this policy covers both. Teachers hold an account and run their business on it. Students book, pay for and attend classes. A teacher decides what to teach and what to record about a student's learning; we provide the software that makes that possible and we hold the data on their behalf as well as our own.
What we collect
We collect only what the product needs to work.
- Account details — your name, email address, the language you prefer, your time zone, and an optional phone number. A teacher also has a public profile: a photo, a short biography, and an optional intro video they record themselves.
- Class records — what was booked, when, whether it happened, what was taught, and any notes or homework attached to it.
- Payment records — the amount, date, currency and status of each payment, and the identifiers our payment providers give us. We never see or store your full card number. A teacher who takes payment by direct transfer also stores the payee details students pay into, such as an account number or an IBAN; those are the teacher's own, and a student never gives us their bank credentials.
- Things you write and upload — messages between a teacher and a student, homework answers and files, lesson materials, and images.
- Technical data — your IP address, device and browser, and the pages you visit. We use it to keep the service working and to understand which parts of the product people actually use.
- Live class audio and video — carried between the two participants while the class is running, and not recorded by us: class recording is switched off in production today. When it is on, a class is recorded only if a teacher starts a recording. Separately, where a teacher has live captions on and a student has consented to learning insights (or their parent or guardian has, if they are under 18), recorded against that teacher, the caption text of that class is kept as a written transcript; the audio itself is not.
We do not buy personal data from anyone, we do not sell it to anyone, and we do not use it to train anybody's AI models.
Why we use it, and our lawful basis
UK GDPR requires us to have a specific lawful reason for each thing we do with your data. Ours are these.
| What we do | Data involved | Lawful basis |
|---|---|---|
| Run your account, your bookings and your classes | Account details, class records | Contract |
| Take payment and pay teachers out | Payment records, name, email | Contract |
| Send booking confirmations, reminders and service messages | Email address, phone number, class records | Contract |
| Keep the service secure, prevent abuse, and diagnose faults | Technical data, error reports | Legitimate interestsKeeping a service that handles money and personal data safe and working. |
| Understand which parts of the product are used, and improve them | Technical data, actions taken in the product | Legitimate interestsImproving a product used by a small number of people, where guessing would waste their time as well as ours. |
| Record where a new student first came from, so a teacher can see what works | A first-touch attribution cookie and a hashed visitor identifier | Legitimate interestsLetting an independent teacher find out which of their own efforts actually brought them students. |
| Keep a written transcript of a class and produce learning insights from it | Class transcripts and learning notes; class audio only where a teacher records a class | Consent |
| Live captions and translation during a class | Speech audio and caption text while the feature is on | Consent |
| Keep financial and tax records | Payment records, invoices | Legal obligation |
Where we rely on consent you can withdraw it at any time, and withdrawing it is as easy as giving it. Where we rely on legitimate interests you can object, and we will stop unless we have a compelling reason not to that overrides your rights.
AI features, and what they do with your data
Several parts of SpiralClass use AI models. We think you should know exactly which, and exactly what each one sees.
- Lesson materials — when a teacher asks the product to draft or edit a teaching material, the text of that material and the teacher's own lesson template are sent to Anthropic. Student data is not included.
- Live captions — when a teacher turns captions on during a class, the teacher's speech, and a student's where that student has consented (or their parent or guardian has, for a student under 18), is recognised by the web browser of someone in the call: on the device itself where the browser can, and otherwise by that browser's own speech service (Google, for Chrome). When no device in the call can recognise speech (two phones, for example), each person's own browser sends their speech to Deepgram instead, which returns the text and is instructed not to keep the audio or use it to train its models. Each finished line is translated on the device where possible, and otherwise by Google Cloud Translation, which receives only the text. The captions themselves are not stored; where the class's learning insights are on, the recognised text is kept as a written transcript, as the next item describes.
- Class transcripts and learning insights — where a teacher has live captions on and a student has consented to learning insights (or their parent or guardian has, for a student under 18), the lines the caption recognisers above produce are kept as a written transcript of the class, and that transcript is read by Anthropic to suggest what to work on next. No audio is recorded or stored for this: the transcript is the caption text, recognised as described above, and is kept only with that consent. Every suggestion is a draft the teacher reviews before it counts for anything.
- Homework review — when a teacher asks for an AI first pass on a homework answer, that answer is sent to Anthropic. It produces a draft for the teacher to review; it never reaches the student without the teacher.
- Intro-video coaching — a teacher's own promotional video, which is public, is transcribed and reviewed to give them feedback on it. No student is involved.
- Promotional posts and images — text and images are generated from a teacher's own public profile, by Anthropic and by Google's Gemini model respectively. No student data is used.
No AI feature makes a decision about you that has a legal or similarly significant effect. Every one of them produces a draft that a person reviews. Nothing here is used to train anybody's AI models.
Children and students under 18
Language teaching involves young people, so this deserves its own section rather than a clause buried elsewhere.
A teacher records whether a student is a minor. Where a student is a minor, the features that capture a student's voice or produce learning analysis about them require a parent's or guardian's consent, recorded against that pairing — the student's own consent is not accepted and is not sufficient. Those features are off by default for everyone: with no consent recorded, nothing is captured.
An SpiralClass account is intended to be held by an adult. If you believe a child has given us personal data without the right permission, write to us and we will delete it.
Where your data goes
Most of our infrastructure is in the United States. The application servers run in Chicago, the database in Ohio, and our error tracking and analytics are on their providers' United States regions. If you are in the United Kingdom or the European Economic Area, your data is therefore transferred out of it.
Those transfers are made under the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, as incorporated in each supplier's data processing terms, or under an adequacy decision where one covers the supplier. If you want to know which applies to a particular supplier, ask and we will tell you.
How long we keep it
We keep data for as long as it is doing a job, and then we get rid of it.
| What | How long |
|---|---|
| Your account and profile | While the account is open, then deleted or anonymised after you close it |
| Class and booking records | While the account is open; anonymised when it closes |
| Payment and invoice records | Six years, to meet UK tax and accounting obligations, even after an account closes |
| Messages, homework and materials | While the account is open, then deleted with it |
| Your notification history | Visible to you for 90 days |
| Error reports and analytics | As set by our providers' own retention windows, typically under 12 months |
| Live class audio and video | Not stored — class recording is switched off in production today. When it is on, a class is stored only if a teacher records it, and a recording is audio only, never video |
| The written transcript of a class, kept for learning insights | While the teacher's account is open, then deleted with it. No audio is kept for it. Ask us and we will delete it sooner |
| A class recording a teacher started, and its transcript | While the teacher's account is open, then deleted with it. Ask us and we will delete it sooner |
Your rights, and how to use them
Under UK GDPR you have the following rights. They are free to use, and we will answer within one month.
- Access — get a copy of the personal data we hold about you.
- Rectification — have anything inaccurate corrected.
- Erasure — have your data deleted, where we have no overriding reason to keep it.
- Restriction — have us pause what we do with it while a question is resolved.
- Portability — receive the data you gave us in a machine-readable format, or have it sent elsewhere.
- Objection — object to processing we base on legitimate interests, including the analytics and attribution described above.
- Withdraw consent — for anything we do on the basis of your consent, at any time.
You do not have to write to us for the first two of these. Signed in, you can download everything we hold about you from your account settings, and you can request deletion of your account from the same place. Both are self-serve and take effect without us reading your reasons.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office, the United Kingdom's supervisory authority, at https://ico.org.uk/make-a-complaint/. We would rather you told us first, so we can put it right.
How we protect it
Traffic is encrypted in transit. There are no passwords to steal — signing in is by a one-time code or link, or through Google — and card details never reach our servers, because Stripe collects them directly. The most sensitive things we do store, a teacher's payment-provider credentials and the token that connects their calendar, are separately encrypted at rest under a key held outside the database. Our database is a managed service reachable only over an encrypted connection. Administrative access requires a second factor, and every administrative action taken on an account is written to an audit log.
No system is perfectly safe. If a breach ever put your rights or freedoms at risk we will tell you, and we will report it to the Information Commissioner's Office as the law requires.
Changes to this policy
When this policy changes we update the date at the top. If a change materially affects your rights we will tell you directly rather than relying on you to re-read the page.
Contact us
For anything in this policy, including a request to use one of the rights above, write to us. A person reads it.
privacy@spiralclass.comData controller: Jay Stewart, United Kingdom