Privacy Notice

This Privacy Notice is issued by Robert Allen Melnyk, operating under the trade name Loris Media ("Clasivo," "we," "us," "our"), a persona física con actividad empresarial registered under the RESICO tax regime in Querétaro, México, responsible for the processing of personal data in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), as reformed and in effect since March 21, 2025.

For the personal data that schools, academies, and other Customers place on Clasivo about their students and staff (for example attendance, grades, submitted work, imported historical records, and class recordings), the Customer is the data controller ("responsable") and Clasivo processes that data on its behalf as its processor ("encargado"). The Customer's own privacy notice governs that data; this Notice describes how Clasivo handles it as processor, and governs the data Clasivo processes as controller (such as account, billing, and technical data).

Personal data protection in Mexico is currently supervised by the Secretaría Anticorrupción y Buen Gobierno (Secretariat of Anti-Corruption and Good Governance), which assumed these responsibilities following the dissolution of INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales) under the March 2025 reform.

We collect only the personal data reasonably necessary to operate and administer the Platform:

• Name and email address
• Date of birth, which each User states to confirm they are 18 or older
• Login and authentication credentials
• Platform usage data (feature use, session activity)
• Technical logs, including IP address and browser/device information
• Live-class attendance: when each participant joined and left a class, and the resulting attendance mark
• Class recordings, where a Customer chooses to record a class: video, audio, and screen content of the class as shown on the recording person's screen, which may include participants' images, voices, names, shared screens, whiteboards, and chat; and a record of which participants acknowledged the recording notice, and when
• Records a Customer imports from its own files or enters by hand (for example past attendance, lessons, homework, and grades), together with the files it uploaded for that purpose
• Changes made to attendance by hand: who made them, when, the reason given, and what the record showed before; and reports of a suspected Platform failure, with the class, the description given, and browser information
• Billing data: payment references and transaction status (full card data is never stored by us; it is processed exclusively by our payment processors), the country and issuing institution of the payment card, the billing and fiscal details a Customer provides (such as RFC, tax regime, fiscal address, country of residence, and, for foreign customers, a tax identification number, stored encrypted), and the IP address and approximate country at the time of purchase (stored encrypted) as evidence for determining the applicable tax
• Records of acceptance of these documents and of checkout authorizations: the version accepted, date and time, IP address, and browser information
• Where a User enables a Google integration: Google Account profile data and, for Google Drive, OAuth tokens and file metadata (see Section 9)

We do not knowingly collect sensitive personal data (health, biometric, religious, political, or similar categories) as defined under the LFPDPPP, except where a Customer independently chooses to include such information in Customer Content, in which case the Customer — not Clasivo — is responsible for obtaining any required express consent. Class recordings contain people's images and voices; Clasivo does not process them to identify people by biometric means, and does not analyze them for any purpose other than storing and playing them for the people entitled to watch them.

Primary purposes (necessary to provide the Service):

• Provide and operate the Service
• Account management and authentication
• Confirming that Users are 18 or older
• Measuring live-class attendance, and keeping a traceable history of any change made to it by hand
• Recording classes, storing recordings in the Customer's Google Drive, and playing them to the people entitled to watch them, when a Customer chooses to record
• Importing and keeping the historical records a Customer brings in, and letting the Customer correct or undo them
• Investigating reported Platform failures against our system records
• Payment processing, recurring billing, electronic invoicing (CFDI), and determining and evidencing the applicable tax
• System and security notifications
• Technical support and maintenance
• Legal compliance

Secondary purposes (you may opt out):

• Product improvement analytics using aggregated/de-identified data
• Planning our advertising (where and how to advertise) using anonymous website visit statistics
• Marketing communications about new features (only where separately opted in)

To opt out of secondary purposes, contact contact@clasivo.online. Opting out does not affect your ability to use core Platform functionality.

We process personal data based on: (a) your consent, given upon account creation and on acceptance of this Notice; (b) performance of the contract represented by the Terms of Use; and (c) compliance with applicable legal obligations, including tax obligations. For data a Customer places on the Platform as controller, including class recordings and imported records, the Customer is responsible for the lawful basis, for its own privacy notice, and for obtaining any consent required, and we process that data on its instructions.

Consent under the LFPDPPP may be express or implied for standard operational processing; express consent is required for sensitive, financial, or patrimonial data, which we do not knowingly collect directly (see Section 3).

Consistent with the LFPDPPP's requirement that controllers establish and disclose defined retention periods, we retain personal data as follows:

After the applicable retention period, personal data is deleted or blocked in accordance with LFPDPPP requirements. We do not guarantee that deleted information can be recovered after the applicable retention period.

We use cookies and local storage to maintain secure sessions and essential Platform functionality. We do not currently use third-party advertising or tracking cookies.

To understand how people find and use our public website, we count visits without cookies: we record the page, the website that sent the visit (or a tag on a link we shared), whether it was a phone or a computer, the browser and operating system by name (for example, Chrome on Android), the approximate place the visit came from (country, state and city), a random identifier kept only for that browser tab, which visit it is from that browser (a simple count the browser keeps in its own storage, not an identifier), and what the visit did on each page: which parts of the page came into view, which buttons or links were clicked (their names, never anything typed into a form) and which videos were played. The place is worked out from the visitor's IP address when the visit arrives, using an IP location database kept on our own servers: the IP address is not sent to anyone and is not stored. Visitors are counted with a code that changes every day, so no one can be identified or followed over time; each visit is anonymous and is never linked to a person or an account. We use these statistics to improve the website and to decide where and how to advertise. They are kept for one year and are not shared.

We do not sell or rent personal data. Data sharing is limited to what is strictly necessary for the purposes described in Section 4:

• Infrastructure and hosting providers (cloud hosting, storage, email delivery)
• Payment processors Stripe and Openpay (to process payments and recurring charges; they do not receive full card data from us)
• An IP geolocation provider, which receives the IP address of a purchase to determine its approximate country for tax purposes
• AI service providers, where AI features are used, limited to processing necessary for the requested output (see also Terms of Use, Section 14); and translation or AI providers, which receive only the column names of an uploaded file to read them in other languages
• Legal authorities, where required by law
• Google, where a User has enabled a Google integration, limited to the data described in Section 9, including class recordings and copies of submitted homework stored in the school's own Drive

Under the reformed LFPDPPP, any third party processing personal data on our behalf ("encargado") is directly and independently subject to LFPDPPP obligations, in addition to our own obligations as data controller.

A Customer may also copy its own records out of Clasivo to paste into an artificial-intelligence service of its choosing. That transfer is made by the Customer, not by Clasivo, and is the Customer's responsibility.

Clasivo offers two optional integrations with Google. Neither is required in order to use the Platform, and each is authorized separately by the person who enables it.

Where a User chooses to sign in with Google, we receive the name, email address, email verification status, and profile picture associated with that Google Account, under the "openid", "email", and "profile" scopes. This information is used solely to identify the User and to match or create their Clasivo account. No Google credential or access token is retained once sign-in completes.

Where a school or teacher chooses to connect Google Drive, Clasivo requests the https://www.googleapis.com/auth/drive.file scope. This is a per-file scope: it grants Clasivo access only to files and folders that Clasivo itself creates, and to individual files a teacher explicitly selects through the Google Picker. Clasivo creates and manages its own folders for classroom materials and shares them by link so students can open them; it reads only the specific files a teacher chooses to attach. In a school's Drive it also creates two private folders that are not shared by link: one for copies of homework students hand in (shared only with the course's teachers, and with the student once marked), and one for class recordings, which are watched through Clasivo rather than through Drive links. Clasivo cannot see, list, or access any other file in the user's Drive.

We store OAuth access and refresh tokens for the connected Google Account, encrypted at rest and never returned in any Platform response; and file metadata for the files Clasivo creates or a teacher attaches: Google file identifier, file name, MIME type, view/icon/thumbnail links, and last modified time.

We do not keep the contents of Google Drive files. Where a lesson plays an audio or media file, or a class recording, held in Drive, that file is streamed through the Platform on request and is not written to our servers — so the file need not be made public, and no Google credential ever reaches the student's browser. File contents pass through our servers only temporarily: while copying a submitted homework file into the school's Drive, and while a class recording is processed before it is sent to the school's Drive (or until the school connects a Drive).

Google user data is used only to provide the features the User explicitly enabled: authenticating sign-in, listing and organizing class materials, creating and sharing classroom folders, playing media within a lesson, keeping copies of submitted homework, and storing and playing class recordings. It is not used for any other purpose.

Clasivo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

• Transfer or sell Google user data to third parties, including advertisers, data brokers, or information resellers
• Use Google user data for advertising, or for any purpose unrelated to the features described above
• Use Google user data to develop, train, fine-tune, or improve generalized or artificial-intelligence models
• Permit humans to read Google user data, except with the User's explicit consent for specific items, where necessary for security purposes such as investigating abuse, where required to comply with applicable law, or where the data has been aggregated and de-identified

A connected Google Account may be disconnected at any time from within Clasivo. Disconnecting revokes the token with Google and deletes the stored tokens and file metadata from our systems. Access may also be revoked directly by the account holder at https://myaccount.google.com/permissions.

We implement reasonable administrative, technical, and physical safeguards to protect personal data against damage, loss, alteration, destruction, or unauthorized access, use, or processing.

Clasivo is not currently available to anyone under eighteen (18) years of age. Each User states their own date of birth before using the Platform, and access is refused to anyone under eighteen. A school cannot confirm a User's age or a guardian's consent on that User's behalf.

• Customers must not bring minors' personal data onto the Platform, including through imports, manual entries, or class recordings.
• If we learn that a minor's personal data is on the Platform, we may block the related Account and delete or block that data.
• Where a minor's data was placed on the Platform before this restriction with guardian consent obtained by the Customer, the Customer remains responsible for that consent; we limit that data to what the educational purpose requires and never use it for marketing.
• Requests concerning a minor's data must be made by the minor's parent or legal guardian.

Class recordings are made only when a Customer's teacher or administrator chooses to record a live class. Everyone in the class is shown that it is being recorded, and anyone joining or present when a recording starts must acknowledge the notice before continuing; we keep a record of that acknowledgement. Participants who do not wish to be recorded may turn off their camera and microphone or leave the class.

Recordings are stored in the Customer's own Google Drive and can be watched, through Clasivo, by the class's teachers and administrators and by the students of that course. The Customer decides how long they are kept and is responsible for their use. Requests about a recording (for example, to access or delete it) should be addressed to the Customer, which controls it; we will assist the Customer as its processor.

Attendance is measured from participants' connections to live classes. If an administrator changes an attendance mark by hand, the change and its history (who, when, why, and the previous value) are kept with the record and shown in the Customer's reports. Records a Customer imports or enters by hand are labelled as such and are never presented as measured by Clasivo.

In accordance with the LFPDPPP, you have the right to:

• Access — know what personal data we hold about you
• Rectify — correct inaccurate or outdated data
• Cancel — request deletion of your data, subject to legal retention requirements
• Oppose — object to certain processing of your data

To exercise these rights, contact: contact@clasivo.online, including your full name, the right you wish to exercise, and sufficient detail to identify your data. We will respond within the timeframes established by the LFPDPPP.

Where the data in question belongs to a minor, the request must be made by the minor's parent or legal guardian.

For data a school or other Customer controls (such as its students' attendance, grades, submitted work, imported records, and class recordings), please address your request to that Customer; if you write to us, we will forward it to the Customer and assist it in responding.

Personal data may be processed on servers located outside Mexico (e.g., cloud hosting, payment processing, Google Drive, and AI service providers based in the United States or the European Union), under contractual and technical safeguards intended to provide a comparable level of protection to that required under Mexican law.

Where Clasivo's AI features generate content, suggestions, or assessments, this processing is used to support — not replace — decisions made by educators. We do not use personal data for fully automated decisions that produce legal or similarly significant effects on an individual without human review.

This Privacy Notice may be updated from time to time to reflect changes in our practices or applicable law. Material changes will be published on the Platform, and Users may be asked to accept the updated Notice before continuing. Continued use of Clasivo following such changes constitutes acceptance of the updated Notice.

This Privacy Notice supersedes and replaces any prior Privacy Policy previously published by Clasivo or Loris Media, effective as of the date above.