Privacy Policy

English Classes (“we”, “us”, or “the Service”) is an online platform that connects teachers and students for small-group English conversation classes. This policy explains what information we collect, why we collect it, and how it is used, stored, and protected.

Questions about this policy can be sent to nabasp06@gmail.com.

Account information. We use Google Sign-In as the only way to create an account. When you sign in, we receive and store your name, email address, and profile photo URL from your Google account, along with your role on the Service (student, teacher, or admin).

Class and enrollment content. Teachers provide class titles, descriptions, levels, schedules, and capacity when scheduling a class. Students generate a request record (their name and email, and which class they requested) when they ask to join a class. Teachers may add a short bio shown on their classes.

Google Calendar data (teachers only). If a teacher chooses to connect their Google Calendar from Account settings, we request permission to create and manage calendar events on their behalf (the calendar.events OAuth scope) and to read their Google account email. We store an encrypted OAuth refresh token for that teacher so the Service can act on their calendar without asking them to sign in again each time. We do not request or store access to any calendar data unrelated to classes created on this Service.

Usage data. Standard technical information (such as request logs) may be generated by our hosting and database providers in the course of operating the Service.

• To create and maintain your account and determine your role (student, teacher, or admin).
• To operate class scheduling, the admin approval workflow, and student join requests.
• To automatically create a Google Calendar event and Google Meet video-call link for a class once it is approved by an admin, using the teacher's connected Google account, and to add approved students as attendees on that event so they receive a calendar invitation.
• To display class and enrollment information to the relevant teachers, students, and admins.
• To communicate with you about your account or classes, if necessary.
• To maintain the security and integrity of the Service.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: Calendar data obtained through a teacher's Google account is used only to create, update, or cancel the calendar event and Google Meet link for that teacher's own classes on this Service, and to manage the list of students invited to that event. We do not use this data for advertising, and we do not allow humans to read this data except where necessary for security purposes, to comply with applicable law, or with your explicit consent.

Account, class, and enrollment data is stored in Google Cloud Firestore, secured by access-control rules that restrict who can read or write each record based on their role and relationship to that record (for example, only a class's own teacher, an admin, or a student approved for that specific class can access its Google Meet link).

Google OAuth refresh tokens are never sent to or stored in the browser. They are held only on our server, encrypted at rest, and used solely to make Google Calendar API calls on the connecting teacher's behalf.

We do not sell your personal information. We share information only:

• With Google, to the extent necessary to operate Google Sign-In and, for teachers who opt in, the Google Calendar integration.
• With other users of the Service to the extent the product itself is designed to show it (e.g. a teacher's name and class details are shown to students; an approved student's name and email are shown to their teacher and added as a calendar attendee).
• Where required by law, or to protect the rights, safety, or property of the Service, its users, or the public.

• Teachers can disconnect Google Calendar at any time from Account settings, which deletes the stored refresh token and revokes the Service's access at Google. Classes already approved keep their existing Meet link; new classes won't get one until reconnected.
• You can review the third-party permissions you've granted at any time at your Google Account's security settings.
• You can request deletion of your account and associated data by contacting nabasp06@gmail.com.

We retain account and class data for as long as your account is active, or as needed to provide the Service. If you disconnect Google Calendar or delete your account, we delete the associated stored refresh token promptly. Class records tied to past sessions may be retained for record-keeping unless you request deletion.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will remove it.

We may update this policy from time to time. Material changes will be reflected by updating the effective date at the top of this page.

Grammar Connect UK. nabasp06@gmail.com