Built on trust, transparency, and child safety.

Class2Class ApS is a Danish company, so we operate under Danish and EU law as our primary regime. The most material instruments are the GDPR (data protection), the EU Digital Services Act (online platforms with minor users), the EU AI Act (AI feature transparency and AI literacy), and the EU Whistleblower Directive (reporting channels).

Because we connect classrooms in 160+ countries, we also align with the UN Convention on the Rights of the Child (UNCRC) and, for US-based partner schools with under-13 students, COPPA. The full regulatory map sits inside our Safeguarding & Governance Framework.

Most platform data lives in the EU (our backend on Xano with EU residency; our data warehouse on Google Cloud BigQuery in EU regions). Some sub-processors are based in the US (e.g., Mixpanel, OpenAI for the Project Creation Assistant) — those transfers are covered by Standard Contractual Clauses, the EU–US Data Privacy Framework where applicable, and Transfer Impact Assessments.

The full sub-processor list with location, transfer mechanism, and contractual no-AI-training commitments is published in our Sub-processor List.

No. We have signed contractual no-AI-training commitments with every AI sub-processor we use. Your messages, project work, recordings, and images are not used to train AI models — neither our own nor any third party's.

This commitment is reflected in our Data Processing Agreement (Appendix D.6) and in our Privacy Policy.

Our Child Safeguarding Policy is the institutional answer. The shortest version: a teacher-gatekeeping model (no direct student registration), parental consent for under-13s, group-only messaging for under-16s, a named Designated Safeguarding Lead (Anton Skriver), mandatory criminal-record screening for everyone who works with children at Class2Class, and an annual child-safety risk assessment.

If something feels wrong, the reporting channels above include an anonymous form designed specifically for children.

Write to our Data Protection Officer at [email protected]. The full table of rights and how to exercise them is in §11 of our Privacy Policy. We commit to responding within 30 calendar days of a verified request, in line with GDPR Art. 12(3).

If you're a parent or guardian asking about your child's data, our Parental Data Subject Access Request process gives you a clearer route in.

We acknowledge the report (normally within 7 calendar days) and give feedback on the outcome (normally within 3 months). We don't share your identity beyond what's strictly necessary, and we don't retaliate against anyone who reports in good faith.

Possible outcomes range from no further action through to dismissal, termination of partnership, or referral to a competent authority — proportionate to the conduct.