Privacy Policy
How we handle personal data across Classable, and the rights you have under the GDPR.
Last updated: 15 July 2026
1. Who we are
Classable (operated by Jibble Ltd, Devonshire House, 582 Honeypot Lane, Stanmore, Middlesex, HA7 1JS, United Kingdom) provides a school attendance and management platform (the “Service”), available at classable.io and app.classable.io. This Privacy Policy explains what personal data we process, why, and the choices and rights you have.
For most personal data about pupils, teachers and staff, your school or organization is the data controller and Classable acts as a data processor that handles the data on your instructions (see section 5). For your own account and our website, Classable is the controller.
2. Data we process
Depending on how you use the Service, we process:
- Account data — your name, email address and a securely hashed password; the organization you create or join and your role within it.
- School data you enter — students, classes, subjects, timetables, attendance records, excuses, grades, messages, announcements and related records.
- Contact and demo requests — the name, email and message you submit through our forms.
- Technical data — IP address, device and browser information, and server logs, used for security, abuse prevention and diagnostics.
- Cookies — strictly necessary cookies for sign-in, security and preferences (see our Cookie Policy).
3. How we use data
We use personal data to:
- Provide, operate and secure the Service and authenticate users.
- Deliver attendance, timetable, reporting and communication features.
- Prevent fraud and abuse and keep the platform safe.
- Respond to contact and demo requests and provide support.
- Send essential service messages (for example security or account notices).
- Comply with our legal obligations.
4. Legal bases (GDPR)
Where Classable is the controller, we rely on: performance of a contract (to provide the Service you request); our legitimate interests (to secure, maintain and improve the Service) balanced against your rights; your consent where required; and compliance with legal obligations. Where your school is the controller, it is responsible for establishing the appropriate legal basis for processing pupil and staff data.
5. Student and children's data
Schools use the Service to process data about pupils, who may be minors. In that context the school is the data controller and Classable is the processor, handling the data only on the school's documented instructions and solely to provide the Service.
The school is responsible for ensuring it has the appropriate legal basis — including any parental consent required under local law — before entering pupil data. The Service is intended for use by school administrators and staff; pupils do not create their own accounts.
6. Sharing and sub-processors
We do not sell personal data. We share data only with vetted infrastructure providers that help us run the Service — for example cloud hosting and email delivery — who process it on our behalf under contract. We may also disclose data where required by law. Our current list of sub-processors is published at classable.io/subprocessors.
Where your school or organization is the controller, our processing on its behalf is governed by our Data Processing Agreement for business customers, available at classable.io/dpa.
7. Where data is stored
The Service is hosted on Amazon Web Services in the European Union (Ireland, eu-west-1). Where any transfer of personal data outside the EEA occurs, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
8. Retention
We keep personal data for as long as your account and organization are active and as needed to provide the Service. After an account or organization is closed, we delete or anonymize personal data within a reasonable period, unless we are required to keep it to meet a legal obligation.
9. Security
We protect data with encryption in transit (TLS), strict multi-tenant isolation so each organization only sees its own data, hashed passwords, access controls and least-privilege practices. No method of transmission or storage is completely secure, but we work continuously to protect your information.
10. Your rights
Subject to applicable law, you have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. You may also lodge a complaint with your data protection supervisory authority. To exercise these rights, contact us through our contact page. If your data was entered by a school, please contact that school, which is the controller.
11. Cookies
We use only strictly necessary cookies for sign-in, security and preferences. See our Cookie Policy for details.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you.
13. Contact
For any privacy question or to exercise your rights, please reach us through the contact page at classable.io/contact, or by email at paulmiu@jibble.io.