Looking for the plain-language version? Visit our Privacy & Security Center.
Privacy Policy
ArtClass Labs LLC · Last updated: August 23, 2026 · Effective: August 23, 2026
1. Who we are
ArtClass.me is operated by ArtClass Labs LLC, a Florida limited liability company registered at 2016 Glass Loop, Clearwater, FL 33763, United States.
ArtClass lets teachers upload student artwork, lets parents and guardians view their own child's artwork, lets parents order products featuring that artwork, and helps schools raise funds.
For data-protection purposes ArtClass Labs LLC is a data controller for the personal data described in this policy. Where we process data on documented instructions from a school under a written agreement, that agreement allocates controller and processor roles.
- Privacy contact: info@artclass.me
- Postal: ArtClass Labs LLC, 2016 Glass Loop, Clearwater, FL 33763, United States
2. A note about children — read this first
ArtClass exists to display children's artwork and to let families order products made from it. It is therefore directed in part to children, and we treat the personal data of every student on the platform as requiring parental protection regardless of the child's age or country.
We do not display a child's artwork to anyone, make it public, or produce any product from it until a parent or legal guardian has given consent through our Parental Consent flow. A school's or teacher's authorisation is not a substitute. This is because ArtClass sells products derived from student artwork: commercial use falls outside the school-authorisation pathway available to purely educational services, in the United States and in Europe alike.
Section 8 explains consent in full.
3. The personal data we collect
3.1 About students (children)
| Data | Why we hold it |
|---|---|
| Full name, first name, last name | Identify the child's artwork to their parent and teacher |
| Grade | Organise artwork within a school |
| Class and school (via enrolment) | Attribute artwork and fundraising correctly |
| Preferred language | Display the interface in the child's language |
| Profile image, where provided | Identify the child in their portfolio |
| Student email address and login credentials — only where a school enables student accounts | Let a student sign in to see their own portfolio |
| Parent email address and phone number, as supplied by the teacher | Invite the parent so consent can be obtained |
| Artwork images, titles and descriptions | The core service |
| AI-generated titles, descriptions and stories about the artwork | Optional AI features (§5) |
| Teacher notes and parent-facing messages about the child | Communicate about the child's work |
| Portfolio books (compiled PDFs of a child's artwork) | Optional annual keepsake product |
| An internal identifier we generate | Link records without exposing other identifiers |
3.2 About parents, guardians and customers
- Name, email address, phone number
- Relationship to a student (which children are linked to the account)
- Shipping address — street, city, state or province, postal code, country
- Order history and product choices
- Consent records — what was consented to, when, by what method, and against which version of our notice
- Payment is handled by our payment processor. We receive confirmation of the transaction and limited metadata such as the last four digits of the card. We never receive or store full card numbers.
3.3 About teachers, school staff and administrators
- Name, work email address, phone number, role, school affiliation
- Account credentials and activity logs
- Teacher application details, where someone applies to join
- Fundraising and reward balances, redemption requests and payout records
3.4 Collected automatically
- IP address, browser and device information, and usage and log data needed to operate and secure the service
- Cookies and similar technologies (§11)
- Email and campaign interaction data — whether a message was delivered, opened or clicked
3.5 ArtClass mobile app for teachers
ArtClass offers a mobile app that teachers may use instead of the website to add artwork to their classes. It collects the same information as the website and stores it in the same place — no additional categories of personal data are collected. Only teachers can sign in to the app; it has no student or parent accounts and no sign-up.
Camera. The app requests access to your device camera so you can photograph student artwork. Photographs are used only to add artwork to your own classes.
Photo library. If you choose to add a photo you have already taken, the app opens Apple's standard photo picker. ArtClass receives only the specific images you select and never has access to the rest of your photo library.
Photos stored on your device. So that a poor network connection cannot lose a teacher's work, photographs are saved on the device before upload and remain there until the upload is confirmed, at which point the local copy is deleted. Photos that have not yet uploaded stay on the device and can be deleted from within the app at any time.
No tracking. The app contains no advertising, no analytics or tracking software, and does not share data with third parties for advertising purposes.
4. Why we use data, and our legal basis
| Purpose | GDPR / Kosovo LPPD basis | COPPA treatment |
|---|---|---|
| Display a child's artwork to that child's linked parent or guardian | Consent — Art. 6(1)(a) with Art. 8 | Verifiable parental consent |
| Let a parent order a product featuring their child's artwork, and disclose what is needed to fulfil it | Contract — Art. 6(1)(b) — plus consent for the underlying child data | Verifiable parental consent covering disclosure |
| Display a child's artwork publicly (gallery, public school page, public campaign page) | Separate, specific consent — Art. 6(1)(a) | Separate verifiable parental consent |
| Generate optional AI-assisted titles, descriptions, stories and product previews | Legitimate interests, and consent for the underlying child data | Covered by verifiable parental consent |
| Process payments, fulfil and ship orders | Contract — Art. 6(1)(b) | Consent plus disclosure to any fulfilment vendor |
| Send service messages about your child's activity, your orders and your account | Contract — Art. 6(1)(b) | Not applicable — adult data |
| Operate, secure, debug and maintain the platform | Legitimate interests — Art. 6(1)(f) | Support for internal operations |
| Calculate and pay school fundraising shares and teacher rewards | Contract with the school or teacher; legitimate interests | Not applicable — adult data |
| Send marketing emails about products and offers | Consent, or soft opt-in for existing customers where permitted | Not applicable — adult data |
| Comply with tax, accounting and other legal obligations | Legal obligation — Art. 6(1)(c) | As required |
We do not use children's personal data for behavioural or targeted advertising, sell children's personal data, or disclose it to any third party for that party's own purposes.
5. Artificial intelligence features
ArtClass offers optional AI-assisted features that can suggest artwork titles, descriptions, short stories, teacher notes, parent-facing messages and product previews.
- These features are optional and human-initiated. A teacher or administrator triggers them by choosing to; nothing runs automatically when artwork is uploaded.
- Our AI provider is OpenAI. We use it for text suggestions and for generating product preview images.
- When a feature is used we send OpenAI the artwork image and a short description of the artwork. We do not send your child's name. We send the child's school grade, which calibrates the reading level of generated text and does not identify anyone.
- Data submitted through OpenAI's API is not used to train its models.
- AI output can be inaccurate. It is presented as a suggestion for a human to review, edit or discard before anything is shown to a family.
- Only a teacher or administrator responsible for the class can trigger these features.
6. When artwork is visible, and to whom
This is important, so we state it plainly.
| Visibility | Who can see it | What it takes |
|---|---|---|
| Private (default) | The child's teacher, the child, and the child's linked parent or guardian | Parental consent to display |
| Public — gallery, public school page, public campaign page | Anyone on the internet, including people with no account | A separate, explicit parental opt-in |
Public display is never enabled by default and is not a decision a teacher can make. Only a parent or guardian linked to the child can make that child's artwork public, and they can turn it off at any time. This is enforced both in the application and by a database-level rule, so artwork without recorded parental approval cannot be served publicly by any route.
Where artwork is public, we display the child's first name only. We never publish a child's surname, class, grade, school year, date of birth or any contact detail on a public page, and a child's name never appears in a page address.
We also ask search engines not to index student portfolio pages, portfolio books or individual artwork pages. They remain reachable by anyone you share the link with, but we do not invite them to be crawled, listed or cached — because a cached copy held by a third party is one we could not remove on your request.
7. When we share data, and with whom
We share personal data only as needed to run the service.
| Recipient | What they receive | Why |
|---|---|---|
| Supabase — hosting, database, file storage, authentication | All service data, including artwork image files | To host the platform. Primary data region: eu-west-1, Ireland (EEA) |
| Stripe — payment processing | Payment and billing details supplied by the payer | To take payment. Stripe acts as an independent controller for its own compliance purposes |
| Resend — transactional email | Recipient name and email address, message content | Invitations, notifications and service email |
| OpenAI | See §5 | Optional AI features |
| The child's own school and teacher | Artwork and class information | The educational relationship |
| A gift-card provider, where a teacher redeems for a gift card | The redeeming teacher's name and email | To issue the reward that teacher has requested |
| Professional advisers, authorities | As legally required | Legal obligation, or to protect safety |
| An acquirer, in a business transfer | As applicable | Subject to the protections in this policy |
Gift cards. No gift-card provider is integrated. Rewards are issued by us. Before any gift-card provider receives a teacher's details, this policy will name them.
Print and fulfilment. No third-party print or fulfilment provider is integrated. Orders are currently produced and dispatched by us. Before any external print partner receives artwork, this policy will name them, a data processing agreement will be in place, and parental consent will cover the disclosure.
For aggregate traffic statistics we use Vercel Web Analytics. It sets no cookies and stores nothing on your device — visitors are counted by a short-lived request signature that is discarded within 24 hours — so it needs no consent and cannot track you across other sites. It records only which page was viewed; identifiers in the address (student, artwork, order and class ids, and any invite or class-join token) are stripped before anything is sent.
For page performance — how quickly pages load and respond during real visits — we use Vercel Speed Insights. It likewise sets no cookies and stores nothing on your device. It reports the shape of the address rather than the address itself — the kind of page you visited, never which particular artwork or child — so no student, artwork or order identifier is transmitted.
Administrative pages are excluded from both services entirely. We use no advertising or error-tracking services, and no other third-party trackers on any page.
8. Children and parental consent
8.1 What we require
Before a child's artwork is shown to anyone or used to make any product, we obtain verifiable consent from that child's parent or legal guardian. We record what was consented to, the date and time, the method, the version of the notice shown, and a cryptographic fingerprint of that notice's text — so we can demonstrate exactly what a parent agreed to.
8.2 How consent is obtained
A teacher invites a parent by email. The invitation is a single-use, server-validated link that identifies the child, presents our Parental Consent Notice, and records the parent's response before the child is linked to their account. The link cannot be completed without a recorded consent.
Consent is captured in three separate parts, each an independent choice, none pre-selected:
- Required — viewing and ordering. Lets us show the child's artwork to that parent and lets them order products made from it.
- Optional — public display. Lets approved artwork appear on public pages.
- Optional — marketing email. Product and offer emails, unrelated to the child's data.
A parent can accept the first without the second or third.
Verification. For the first part — internal use only, no third-party disclosure — we verify the parent through the invitation sent to the email address the school holds for them, together with account confirmation. For any product purchase, which involves disclosing artwork for fulfilment, the parent's own payment transaction serves as a further verification step.
8.3 Age thresholds
Statutory ages of digital consent differ: United States — under 13 (COPPA); Kosovo — under 16; Germany — under 16; France — under 15; United Kingdom — under 13. Because ArtClass serves K–8 students and sells products made from their work, we require parental consent for every student, in every market, regardless of age.
8.4 Parental rights
A parent or legal guardian may at any time:
- review everything we hold about their child;
- correct it;
- withdraw consent, which stops all further display and all future product creation;
- refuse any further collection or use;
- request deletion of their child's data, handled under Data Retention & Deletion Policy.
You can submit a deletion request directly from the Privacy & data section of your account, or by emailing info@artclass.me. We respond within 30 days, and sooner where the law requires. We will tell you when your request has been completed.
Withdrawing consent stops all future use of your child's artwork. It does not cancel orders you have already placed, including any not yet shipped — those will be completed. If you would like an order cancelled, you can request that from the same Privacy & data section, or by contacting us.
8.5 Schools
Where a school introduces ArtClass to its families, the school's authorisation covers the educational context only. The sale of any product always requires that child's own parent's verifiable consent. We do not treat a school's word as consent for commercial use.
9. Where your data is stored, and international transfers
Our primary hosting, database and file storage are located in Ireland (eu-west-1), within the European Economic Area. Artwork images, student records and order data are stored there.
Some of our service providers process data in the United States: Stripe (payments), Resend (email) and OpenAI (the optional AI features). ArtClass Labs LLC is itself a United States company.
Where personal data is transferred out of the EEA, the United Kingdom or Kosovo to a country without an adequacy decision, we rely on Standard Contractual Clauses (or the equivalent instrument under the applicable law) together with supplementary technical and organisational measures.
Kosovo specifically: Kosovo is not a member of the European Union, so the storage of Kosovar users' data in Ireland is itself a cross-border transfer under Law No. 06/L-082. Ireland is subject to the GDPR, which provides a level of protection equivalent to Kosovo's own framework; the transfer is made on that basis and under the safeguards described above.
You may request a copy of the relevant safeguard from info@artclass.me.
10. How long we keep data
We keep personal data only as long as necessary. Our retention periods, the business reason for each, and our deletion process are set out in our Data Retention & Deletion Policy, which forms part of this Privacy Policy.
11. Cookies and similar technologies
We use cookies that are strictly necessary to run the service — authentication, security, and preferences such as your chosen language and currency. Where required by law, we ask for consent before setting any non-essential cookie.
We do not use cookies for behavioural advertising, and we do not permit third-party advertising trackers on any page. Our traffic analytics and performance measurement (Vercel Web Analytics and Vercel Speed Insights, §7) are cookieless and store nothing on your device.
12. Security
We maintain an information-security programme with safeguards appropriate to the sensitivity of children's data, including:
- role-based access control, enforced server-side and never inferred from a browser session token;
- row-level security on our database, so records without recorded parental consent cannot be served publicly by any route;
- isolation of sensitive operations behind server-side, permission-checked routes;
- encryption in transit;
- restricted access to personally identifying tables;
- append-only audit records for consent and for deletion, which cannot be edited or removed;
- logging and monitoring.
No system is perfectly secure. Where a personal-data breach occurs, we will notify the competent supervisory authority within 72 hours of becoming aware where GDPR or Kosovo law applies, and will notify affected individuals where the law requires.
13. Your rights
Depending on where you live, you — and, for a child, that child's parent or guardian — have the right to access, correct, delete, restrict, object to and port personal data, and to withdraw consent at any time without affecting processing already carried out.
Use the Privacy & data section of your account, or contact info@artclass.me. We respond within 30 days. We will not charge you or treat you differently for exercising a right.
You may also complain to a supervisory authority:
- United States — Federal Trade Commission, ftc.gov
- Kosovo — Information and Privacy Agency (IPA)
- EU/EEA — your national Data Protection Authority
- United Kingdom — Information Commissioner's Office, ico.org.uk
14. Changes
We will update this policy as the service and the law develop. Where a change materially affects children's data, we will notify parents directly and, where the law requires, obtain fresh consent.
15. Contact
ArtClass Labs LLC 2016 Glass Loop, Clearwater, FL 33763, United States info@artclass.me