Privacy Policy

Your studio decides how family information is used. When a parent registers with a studio on ClassRoot, the studio collects that information to run its classes, and we process it on the studio's behalf, following its instructions and this policy. For questions about how a studio uses your family's information, contact the studio first; you can also contact us and we'll help.

We are responsible for studio account information (the owner's and staff members' names and emails) and for how ClassRoot itself works and is secured.

Studio accounts: studio name, address on the web (its ClassRoot link), time zone, logo and colours, settings, and the names and email addresses of the owner and staff.

Families (entered by parents when they register, or by the studio):

• Parent or guardian names, email addresses, phone numbers, home address and emergency contact.
• Students' names, dates of birth, gender (optional), and medical notes the parent chooses to share for safety.
• Classes, enrolments, waitlists, attendance, absences, make-up credits and trial class requests.
• The studio's agreements (for example its waiver, policies and photo consent): for each one, the exact wording shown, whether it was accepted, the typed signature, and the date, time, IP address and browser used.
• Preferences such as photo, text message and WhatsApp choices, which parents can change at any time.

Payments: charges, payments, discounts, credits and their status. Card and bank details are entered directly into Stripe's secure form and held by Stripe. ClassRoot never sees or stores full card or bank numbers; we keep only the type, the card brand or bank name, and the last four digits.

Messages: announcements a studio sends through ClassRoot, who they went to, and when.

Technical information: IP address, browser and device type, and the times pages were used, for security, preventing abuse and fixing problems.

ClassRoot is used by adults: studio staff and parents or guardians. It is not directed to children, and children do not create accounts or sign in. Information about a student is provided by their parent or guardian, who confirms they are an adult and the child's parent or legal guardian, or by the studio.

We use students' information only to provide ClassRoot to their studio: to run classes, keep students safe and bill tuition. We never use it for advertising, never sell it, and never build profiles of children. Medical notes are shown only to studio staff, not to the AI features described below. A parent can ask the studio, or us, to review, correct or delete their child's information.

• To provide ClassRoot: registration, rosters, attendance, make-ups, trials, billing, autopay, receipts and messages.
• To send emails on the studio's behalf (for example registration confirmations, payment notices, class cancellations and reminders) and to send sign-in links.
• To keep ClassRoot secure: preventing fraud and spam (including Cloudflare's bot check on public forms), and keeping an audit log of important changes.
• To support studios and fix problems, and to improve ClassRoot using overall usage patterns.
• To meet legal obligations.

ClassRoot includes optional AI features powered by Anthropic's Claude models. We send them as little as possible:

• Message drafting and translation receive only the studio's own notes and message text. Parents' names are added to each email afterwards, by ClassRoot, not by the AI.
• Ask ClassRoot (for studio owners and admins) can look up class names, students' first names and family names, enrolment status, and amounts billed, paid and owed. It never receives email addresses, phone numbers, home addresses, dates of birth, medical notes or payment details, and it can't change anything.

Under Anthropic's commercial terms, information sent through its API is not used to train its models. Studio staff review AI drafts and translations before anything is sent.

We don't sell personal information or share it for advertising. We share it only:

• With the studio the family registered with. Staff see what their role needs; instructors see their class rosters, not payments.
• With the service providers that run ClassRoot, under contracts that limit their use of it: Stripe (payments; card and bank details), Supabase (database, hosted on Amazon Web Services in the United States), Vercel (hosting), Resend (email delivery), Anthropic (the AI features above) and Cloudflare (bot protection on public forms).
• When the law requires it, or to protect the safety, rights or property of people using ClassRoot.
• If Payanai's business is transferred, for example in a merger, under the same protections described here.

Payments are made to the studio through its own Stripe account. Stripe's own privacy policy covers the card and bank details it holds.

• Information is encrypted in transit (HTTPS) and at rest in our database.
• Family data can only be read by ClassRoot's servers, never directly from a browser; every request is checked against the signed-in person's studio and role.
• Sign-in uses one-time email links, and parents are linked to their family only through an email address they've proved they control.
• Card and bank details never reach our servers.
• Important changes (billing runs, payments, refunds, enrolments, agreement changes) are recorded in an audit log.

We keep information for as long as the studio uses ClassRoot, so it can keep accurate records of classes, payments and the agreements families accepted. A studio can correct family information, mark a family as no longer active, and ask us to delete a family's records; parents can ask their studio to do so.

If a studio closes its ClassRoot account, we delete its information within 90 days, except records we must keep longer by law (such as payment records for tax purposes), which we keep only for as long as required.

• Parents can see their family's classes, payments and agreements in the parent app, and turn optional choices (photos and videos, text messages, WhatsApp) on or off at any time.
• Parents can ask their studio to correct or delete their information, or to stop using it. Some records, such as payments and signed waivers, may need to be kept by the studio.
• Studios can update information in ClassRoot, and can ask us to delete a family's records, for a copy of their data, or to close their account.

Depending on where you live (for example California and several other US states), you may have rights to access, correct, delete or get a copy of your personal information. Email support@payanai.com; if your request is about a studio's records, we'll work with that studio to respond. We won't treat you differently for using these rights.

ClassRoot uses only the cookies it needs to work: one to keep you signed in, and a short-lived one that lets a parent finish setting up payment right after registering. We don't use advertising or tracking cookies. The bot check on public forms is provided by Cloudflare Turnstile.

If we make significant changes, we'll update this page and the date at the top, and tell studio owners by email before the changes take effect.

Questions or requests: support@payanai.com
Payanai LLC, Texas, USA