Privacy Policy
Last Updated: December 1, 2025
Geographic Availability: ClassHub / クラスハブ is available to organizations in Japan, North
America, and select Asia-Pacific regions. This service is not available to organizations or users located in
the European Economic Area (EEA) or United Kingdom.
1. Introduction
Welcome to ClassHub / クラスハブ (hereinafter referred to as "ClassHub," "we," "us," or "our"). We operate the
website https://kurasu.app and provide scheduling and student management
software for educational institutions.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our
service. Please read this privacy policy carefully. If you do not agree with the terms of this privacy
policy, please do not access the service.
Important Note: Business-to-Business Service
ClassHub is a business-to-business (B2B) service for schools, tutoring centers, training studios,
and independent teaching and instructing businesses. We do not directly collect information
from students or end-users. All student data entered into the system is provided by our customers
(business owners and administrators) who are responsible for:
- Obtaining appropriate consent from their students and parents/guardians
- Complying with applicable privacy laws in their relationship with their students
- Ensuring they have the legal right to input student information into our system
As the data processor, we process student information only on behalf of and according to the instructions
of our customers (the data controllers). Our customers retain full responsibility for the lawfulness of
the data they input into our system.
2. Information We Collect
2.1 Information You Provide to Us
We collect information that you voluntarily provide when using our service:
- Account Information: Name, email address, school/organization name, phone number, and
payment information
- Student Data: Information about students that you (as the school administrator) input
into the system, which may include names, contact information, course enrollment, attendance records,
and scheduling information
- Teacher Data: Information about teachers/instructors including names, contact
information, availability, and qualifications
- Course and Schedule Data: Information about courses, lessons, bookings, and scheduling
preferences
- Communications: When you contact us for support or communicate with us through the
service
2.2 Information Collected Automatically
When you access our service, we automatically collect certain information:
- Log Data: IP address, browser type, operating system, pages viewed, and timestamps
- Device Information: Device type, unique device identifiers
- Usage Data: How you interact with our service, features used, and time spent
- Session Management: We use browser local storage and session storage to maintain your
login session and user preferences. This data is stored locally on your device and is not used for
tracking or advertising purposes.
3. How We Use Your Information
We use the collected information for the following purposes:
- Service Delivery: To provide, maintain, and improve our scheduling and management
services
- Account Management: To create and manage your account, process payments, and provide
customer support
- Communication: To send you service updates, technical notices, security alerts, and
administrative messages
- Analytics: To understand how users interact with our service and improve functionality
- Legal Compliance: To comply with applicable laws, regulations, and legal processes
- Security: To protect against fraud, unauthorized access, and other security issues
Note: We process student data solely on behalf of our customers and according to their
instructions. We do not use student data for our own marketing purposes or share it with third parties
except as necessary to provide our service or as required by law.
4. Information Sharing and Disclosure
We may share your information in the following circumstances:
4.1 Service Providers
We may share information with third-party service providers who perform services on
our behalf:
- Amazon Web Services (AWS) - Cloud infrastructure and email delivery
- Heroku (a Salesforce company) - Application hosting
- MongoDB Atlas - Database services
These providers are contractually obligated to protect your information and use it
only for the purposes we specify.
4.2 Legal Requirements
We may disclose information if required by law, court order, or governmental authority, or to:
- Comply with legal obligations
- Protect our rights, property, or safety
- Prevent fraud or security issues
- Respond to emergencies involving personal safety
4.3 Business Transfers
If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will
notify you before your information becomes subject to a different privacy policy.
4.4 With Your Consent
We may share information with third parties when you explicitly consent to such sharing.
5. Data Security
We implement appropriate technical and organizational security measures to protect your information:
- Encryption of data in transit (SSL/TLS)
- Encryption of sensitive data at rest
- Regular security assessments and updates
- Access controls and authentication requirements
- Regular backups of your data
Password Security: For security purposes, we do not have access to your password. Passwords
are encrypted using industry-standard hashing algorithms. If you lose access to both your password and
registered email address, we may be unable to restore access to your account. Please keep your login
credentials secure and ensure your email address is kept up to date.
However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to
protect your information, we cannot guarantee absolute security.
5.1 Data Breach Notification
In the event of a data breach that affects personal information, we will:
- Notify affected customers via email within 72 hours of discovering the breach
- Provide details about the nature of the breach, the data affected, and steps we
are taking to address it
- Comply with all applicable data breach notification requirements under APPI and
other applicable laws
You (as the data controller) are responsible for notifying your students and their
parents/guardians as required by applicable law.
6. Data Retention
We retain your information for as long as necessary to provide our services and fulfill the purposes outlined
in this Privacy Policy:
- Active Accounts: We retain your data while your account is active
- Lesson/Booking Data: We retain lesson and booking records for 3 years from the date of
the lesson. After this period, detailed lesson records may be archived or deleted. You can export this
data at any time during the retention period.
- Canceled Accounts: After account cancellation, we retain your data for 30 days to allow
for account reactivation, then permanently delete it unless retention is required by law
- Legal Requirements: We may retain certain information longer if required by law or to
resolve disputes
Important: Any data you manually delete is permanently and irretrievably removed from our
systems
and backups. We cannot recover user-deleted data under any circumstances.
7. Your Rights Under Japanese Law (APPI)
Under Japan's Act on the Protection of Personal Information (APPI), you have the following rights regarding
your personal information stored in our service:
7.1 Right to Request Disclosure (開示請求)
You may request disclosure of the personal information we hold about you.
We will provide this information unless disclosure would:
- Harm your or a third party's life, body, property, or other rights
- Interfere with our operations
7.2 Right to Request Correction (訂正等請求)
If you believe your information is inaccurate or incomplete, you may request:
- Correction (訂正)
- Addition (追加)
- Deletion (削除)
We will investigate promptly and update the information when appropriate.
7.3 Right to Request Suspension of Use (利用停止 / 消去)
You may request that we stop using or delete your personal information if:
- It was handled beyond the stated purpose
- It was acquired improperly
- You no longer wish your information to be used in the service
We will evaluate the request and comply as required by APPI.
7.4 Right to Request Suspension of Third-Party Provision (第三者提供の停止)
You may request that we stop providing your information to third parties.
Please note that we may continue to share information with:
- Service providers necessary to operate ClassHub (as listed in Section 4.1)
- Third parties where required by law or court order
- Third parties with your explicit consent
7.5 Procedures
To exercise any of the rights above, please contact us using the email address listed in Section 12.
We will:
- Acknowledge receipt of your request within 5 business days
- Respond to your request within 30 days (or notify you if more time is needed)
- Require identity verification before processing your request to protect your data
Please note that certain rights may be limited by APPI or other applicable laws.
7.6 Data Portability
You have the right to export your data using our built-in export tools. Exportable data includes:
- Student profiles and contact information
- Contract information
- Teacher information
- Course data
- Lesson data (limited to the most recent 3 years)
Data is provided in CSV format for easy import into other systems. You may use these export tools to download
your data before canceling your account.
8. Children's Privacy
ClassHub is a B2B service for school administrators, not for direct use by children. We do not collect
information directly from students. All student information in our system is provided by our customers
(school administrators and educational institutions).
Our customers are responsible for:
- Obtaining appropriate consent from students and/or parents/guardians as required by applicable law
- Ensuring compliance with applicable children's privacy laws in their jurisdiction
- Verifying they have the legal right to input student information into our system
9. International Data Transfers
ClassHub is operated from Japan and is intended for use by organizations in Japan, North America, and select
Asia-Pacific regions.
Data Storage Location: Your data is stored and processed on servers located in the United
States (AWS US-East region, Virginia) using:
- Heroku (a Salesforce company) for application hosting
- MongoDB Atlas for database services
Both providers maintain industry-standard security certifications including SOC 2 Type II and ISO 27001.
Data Protection in the United States: The United States does not have a comprehensive
national data protection law equivalent to Japan's APPI. However, our service providers are subject to
applicable U.S. federal and state privacy laws and maintain the security certifications mentioned above. Our
service providers have implemented appropriate technical and organizational security measures to protect
your data.
Your Consent: By using our service, you acknowledge that you have been informed about the
data transfer to the United States and the data protection framework described above, and you consent to the
transfer, storage, and processing of your data in the United States in accordance with this Privacy Policy.
Geographic Restrictions: This service is not available to organizations or users located in
the European Economic Area (EEA) or United Kingdom. By using this service, you represent that you are not
located in, operating from, or primarily serving customers in the EEA or UK.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal,
operational, or regulatory reasons. We will notify you of any material changes by:
- Posting the updated policy on our website with a new "Last Updated" date
- Sending an email notification to the address associated with your account
- Displaying a prominent notice within the service
Your continued use of the service after such changes constitutes your acceptance of the updated Privacy
Policy.
11. Third-Party Services
Our service may contain links to third-party websites or integrate with third-party services (such as video
conferencing platforms). We are not responsible for the privacy practices of these third parties. We
encourage you to read their privacy policies.
12. Contact Information
If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please
contact us:
We will respond to your inquiry within a reasonable timeframe.
Return to ClassHub |
Terms of Service