Privacy policy

This policy applies to Classistant Technologies Inc. (“Classistant”, “we”, “us”), and to everything you do on classistant.ca and through the Classistant text and voice assistant.

We are a Canadian organisation and we handle personal information under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), plus provincial privacy law where it applies to you, including Quebec’s Law 25. Our commercial messages and automated texts follow Canada’s Anti-Spam Legislation (CASL).

Classistant is an independent product. We are not affiliated with, endorsed by, or operated by any university, college, or by Google LLC.

We collect four kinds of information, and no more than the assistant needs to work.

Information you give us during onboarding.

• Your full name and your school email address.
• Your school, so we know which portal to sign in to.
• Your Canadian mobile number, which is where texts and calls go.
• Your student portal username and password.
• Your preferences: how hard the assistant should push, your quiet hours, and whether you want phone calls.

Information from your Google account, with your consent. When you sign in with Google you grant scoped access. We read course-related email and announcements, read and write calendar events, and read syllabus and course files in your Drive. We send email only from your address and only after you approve the specific message.

Information from your school portal. Using the credentials you supplied, we sign in to your portal on your behalf and read your course list, class and exam schedule, posted grades, course content, and syllabus documents.

Information generated by using the service. The texts and calls between you and the assistant, the deadlines and tasks it derives, how quickly you tend to complete work, and basic technical logs such as IP address, browser type, and error traces.

We use your information only for the following purposes.

• To build and maintain your semester: courses, schedule, deadlines, and exam dates.
• To write those items into your Google Calendar and our task database.
• To decide what to remind you about, when, and how insistently, based on your own past pace.
• To detect new grades and course announcements and tell you about them.
• To draft email you have asked for, and send it once you approve it.
• To place the voice calls you opted into.
• To keep the service running, debug failures, and prevent abuse.

We do not sell your personal information. We do not use it for advertising. We do not use the contents of your school email, portal, or Drive to train general-purpose machine learning models.

Classistant’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. In practice that means Google user data is used only to provide and improve the features you can see, is never transferred to anyone except as needed to run the service or where you direct it, is never used for advertising, and is never read by a human except with your explicit permission, to resolve a support issue you reported, or where the law requires it.

You can withdraw our Google access at any time from your Google account permissions page, without contacting us first. Doing so stops calendar writes and email scanning immediately.

Course pages and posted grades sit behind your portal login and there is no API for them, so the assistant signs in as you. That means we have to hold the credential.

• It is encrypted at rest in Google Firestore using envelope encryption, with keys held in a separate key management service.
• It is decrypted only inside an isolated browser session that is signing in to your school's own login page.
• It is never displayed back to you, never written to application logs, and never sent to any destination other than your school.
• No Classistant staff member can read it.
• Deleting your account destroys it immediately rather than on a retention schedule.

If your school’s own IT policy forbids sharing your credentials with a third party, do not enter them. That is a rule between you and your school, and it is your responsibility to check it.

We share personal information with the service providers below, only to the extent each one needs it to do its job. They are bound by contract to protect it and to use it for no other purpose.

Some of these providers operate outside Canada, so your information may be stored or processed in the United States and elsewhere. While it is in another country it is subject to that country’s laws, including lawful access by its courts and law enforcement.

We will also disclose information if we are legally required to, or where it is necessary to protect someone’s safety. If we are ever bought or merged, your information may transfer to the new owner under this same policy, and we will tell you before that happens.

You give express consent to automated texts during onboarding, and again for voice calls if you turn them on. Standard message and data rates from your carrier may apply.

• Reply STOP to end all messages.
• Reply STOP CALLS to keep texts but end voice calls.
• Reply HELP for support, or email hello@classistant.ca.
• Reply DELETE to close your account and erase your data, or use delete my data.

Message content is retained so the assistant has conversational context. Voice calls are not recorded by default. If we ever need to record one for quality or safety, you will be told at the start of that call and can decline.

• Account details and preferences: until you delete your account.
• Portal credentials: until you delete your account or remove your school, then destroyed immediately.
• Course data, deadlines, and grades: for the current term plus twelve months, so the assistant can pace you better next semester. You can clear it sooner.
• Message and call history: twenty-four months.
• Technical logs: ninety days.
• Anything we are required to keep by law, for as long as the law requires.

Data is encrypted in transit with TLS and at rest. Credentials get a second layer of application-level encryption. Access to production systems is limited to the people who need it, requires multi-factor authentication, and is logged.

No system is perfectly secure. If a breach happens that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

You can, at any time and free of charge:

• Ask what personal information we hold about you and get a copy of it.
• Have anything inaccurate corrected.
• Delete your account and everything attached to it.
• Withdraw your consent to texts, to calls, or to Google access, without losing the rest.
• Ask us to explain how an automated decision about your reminders was made.
• Complain to us, and then to the Office of the Privacy Commissioner of Canada if you are not satisfied.

Email privacy@classistant.ca and we will respond within thirty days, which is the deadline PIPEDA sets. To delete, start at delete my data, which writes the request for you and sets out exactly what disappears.

Classistant is for post-secondary students and you must be at least sixteen to use it. We do not knowingly collect information from anyone younger. If we learn that we have, we delete it.

If we change this policy in a way that materially affects you, we will text you and email you at least thirty days before it takes effect, so you have time to leave if you disagree. The date at the top always reflects the current version.

Our privacy officer is reachable at privacy@classistant.ca.

Classistant Technologies Inc.
Toronto, Ontario, Canada

See also our terms of service.