Privacy policy

classghor is a business based in Dhaka, Bangladesh ("classghor", "we").

Contact: the support email and WhatsApp number on our Contact page.

• Account data: the name, email and phone of people who sign up or are invited. We decide how this is used.
• Center records: students, guardians, teachers, batches, fees, attendance, exams, photos and messages your center enters. Your center decides what is entered and why. We process it on the center's behalf, only to run the service for that center.

• (a) Account: name, email, mobile number, password (stored only as a one-way hash), language preference.
• (b) Center records, as entered by the center.
• (c) Technical: sign-in session cookies, the time and kind of actions taken (an audit log), and server logs kept for security and fixing faults.
• We do not use advertising or analytics trackers.

To provide the service:

• keep the center's records;
• produce receipts, ID cards, result cards and reports;
• send the SMS and WhatsApp messages the center sends;
• answer support requests;
• keep the service secure;
• tell account holders about their plan (trial, renewal).

We do not sell personal data or use it for advertising.

Many students are under 18. The center is responsible for having the guardian's agreement to keep the student's and guardian's details and to send them messages. Guardians can ask the center, or us, to correct or remove their details.

Only service providers that run part of the service for us, and only what they need:

• the SMS provider (currently BD Bulk SMS) receives the phone number and the message text;
• WhatsApp (Meta), when the center turns WhatsApp on;
• our hosting and email providers.

We disclose data to authorities only when Bangladeshi law requires it.

On servers in Singapore, with backups also in Singapore. Data in transit is encrypted (HTTPS). Storing it outside Bangladesh lets us use well-run data centres close to Bangladesh; the same protections apply there.

• While the center's account is open.
• The owner can delete the center from Settings (or ask us to). Deletion happens 30 days later; until then it can be cancelled and the data can still be exported. After that, the records are deleted, and they leave our backups within a further 90 days.
• We keep payment and invoice records as long as the law requires.

• Owners and staff can see and correct their account details in the app, and export all center records (Excel/PDF) on every plan.
• Anyone can ask us what we hold about them, ask for a correction, or ask for deletion, through the Contact page. We answer within 30 days.

We use two cookies, both needed for the service:

• cg_token: keeps you signed in;
• cg_locale: remembers your language.

There are no tracking cookies, so there is no cookie banner.

Passwords are hashed. Access inside a center follows the roles the owner sets. Each center's records are separated from every other center's. Staff access is logged. No system is perfectly secure. If a breach affects your data, we will tell the affected centers promptly.

If we change this policy, we update the date above, show what changed on this page, and tell account holders by email and with a notice in the app when the new version is published.