Privacy policy
Last updated: September 26, 2026
ClassFund.Club is the ledger for the money a school class shares. This policy explains what ClassFund.Club does with the personal data it decides about itself — your account, your preferences and, if your class buys a plan, your invoicing details. What happens to a class's own records — the children, the families, the bank transactions — is decided by the parents' community that runs the class, not by us; that is covered by the Data protection policy.
Who we are
ClassFund.Club is owned and operated by The Future Quest Kft., a limited liability company established under Hungarian law, with its registered seat at Budapest, Hungary. It is entered in the company register kept by the Fővárosi Törvényszék Cégbírósága under company registration number 01-09-349062. Tax number: 27094455-2-43. EU VAT number: HU27094455. Website: https://classfund.club; the application runs at https://app.classfund.club. General enquiries: hello@classfund.club.
The Future Quest Kft. is the controller for the data described in this policy, within the meaning of Article 4(7) of the GDPR. Where this policy says "we", it means The Future Quest Kft..
Questions about this policy, or about your data, go to privacy@classfund.club, and a person reads them. We do run a support desk for everything else, and a data request raised there reaches the same people on the same clock — but you never have to use it to exercise a right, and writing to that address is always enough.
What we hold, and why
| What | Why | Legal basis |
|---|---|---|
| Your name and email address, taken from the account you sign in with (Microsoft or Google) | To recognise you, to put you on a class, and to show the other members of your class who you are | Performance of a contract (Art. 6(1)(b) GDPR) |
| When you first signed in and when you last signed in | To tell an account somebody is really using from a placeholder a chair created for them and nobody has claimed | Performance of a contract |
| An audit trail of what happened in your class: each sign-in (with which provider, and when), invitations and reports sent, bank syncs and imports, changes to expenses, splits and balances, payment links opened, plan changes and recommendations — each with who did it and when. No IP address, no browser details, no bank line in full. | So that the chair who answers for the class's money can see who did what, and settle a question about the books without guesswork. Only the chairs of the class can read it | Legitimate interests (Art. 6(1)(f)): accountability for money a group of families holds in common |
| Your session, and your language and theme choices | To keep you signed in and to show the app the way you left it | Performance of a contract; preferences are strictly necessary for the service to work as you set it |
| Invoicing details: name, email, postal address, whether you are a private person or a business, and a VAT number if you gave one | To price an order correctly, to work out the VAT due, and to issue an invoice | Performance of a contract; legal obligation for tax and accounting records (Art. 6(1)(c)) |
| Orders: what was bought, for how many seats, at what price, with what VAT — and, once paid, when it was paid and Paddle's reference for the payment. Never a card number. | To bill it, to know it was paid, and to keep the accounting record the law requires | Legal obligation |
| A picture of you, if you chose to add one or agreed to copy the one from the account you signed in with; and a picture of your child, if you or the chair chose to add one | To show the members of your class who is who. Nothing else — a picture is never used to identify anybody automatically | Consent (Art. 6(1)(a)); you may remove either picture at any time from inside the app |
| Technical records: IP address, browser, and the time of a request, kept in server logs | To keep the service running and to investigate abuse or a security incident | Legitimate interests (Art. 6(1)(f)): running a service securely |
| If you recommend ClassFund.Club to somebody: your recommendation code, and for each email you send, a fingerprint (a one-way hash) of the address, when it went and in which language. If somebody recommended ClassFund.Club to you, who that was. | To send the email you asked us to send, never to write to the same person twice, and to show you how many people signed up through you | Legitimate interests (Art. 6(1)(f)): letting members tell people they know about the service, without it becoming a way to send unwanted mail |
| If — and only if — you agree: which pages you visited, with identifiers removed, and a count of a few things happening — an import finished, a report sent, a plan bought and what it cost — through Google Analytics | To see which parts of ClassFund.Club are actually used, and which are not worth keeping | Consent (Art. 6(1)(a)), which you may withdraw at any time and which we never assume |
We do not build a profile of you, we do not track you across other websites, and we do not sell or share personal data for anybody's marketing. There is no advertising anywhere in ClassFund.Club. We do count visits with Google Analytics, but only if you agree to it first — see Cookies below, where what that does and does not collect is set out plainly.
If a member recommended ClassFund.Club to you, we used the address they typed for one thing: sending you that one email, in their name. We do not keep the address itself — only a one-way fingerprint of it, so that nobody can send you the same letter again within six months, and so that, if you do sign up, the member who told you about us is credited. You are not added to any list and we do not write to you again. The link at the foot of that email stops recommendations to your address for good; we then keep the fingerprint for that reason alone. A recommendation link a member shares carries their code in the address itself — we do not set a cookie for it.
What we never ask for
ClassFund.Club is about money, so it is worth being explicit about what it does not want. We do not ask for, and have no use for, any of the following:
- A password. You sign in with an account you already have; we never see the password behind it.
- A card number for the class's money. Parents pay into the class's own bank account, by transfer, and ClassFund.Club never asks a parent for a card. The one card payment that exists is a class buying a plan from us — and even then the number is typed into the checkout of Paddle, our payment provider, and never reaches us. We do not see it, and we could not store it.
- Permission to move money. The bank connection is read-only and cannot initiate a payment — not by us, not by a chair, not by anybody who compromised the app.
- A child's date of birth, address, health or school record. A picture of a child is the one exception, and only because a parent may want one: a guardian, or the chair, may add a small picture to a child's page, and may remove it again at any time. We never ask for it, nothing needs it, and a child without a picture is shown with their initials.
- Special category data of any kind, as defined in Article 9 of the GDPR.
The class's data, and who decides about it
A class holds the names of children, the parents linked to them, the bank accounts those parents pay from, and every transaction on the class account. Two things are true about it, and both matter:
- We are a processor, not the controller. The parents' community — in practice the chair — decides which children are on the roster, which parents see them, and which bank account is read. We act on their instructions and we do not use that data for anything of our own.
- Some of it is about children. ClassFund.Club never collects anything from a child directly, children have no accounts here, and no child is asked to agree to anything. What is held is a name, the money their family has put in, and — only if a guardian or the chair chose to add one — a picture.
Each class also keeps its own audit trail of everything that happens in it: who signed in, who was invited, what a bank sync booked, how each cost was split and changed, which payment link was opened, which report was sent. It is there so the parents' community can account for its money transparently. Only the class's chairs can read it; nobody using the service — the chair included — can alter or delete an entry, and we do not either; each entry is deleted automatically after eighteen months. If you are a member of a class, what you do in it is recorded there under your name.
If you want a child's record corrected or removed, the fastest route is the chair of your parents' community, who can do it immediately. If that does not work, write to privacy@classfund.club and we will help.
Who else sees it
Only the suppliers we need to run the service. Each one is bound by a written contract, acts only on our instructions, and gets the least it can do its job with.
| Who | What for | What they see |
|---|---|---|
| The identity provider you choose to sign in with (Microsoft or Google) | Signing in | That you signed in to ClassFund.Club. They give us your name, email address and picture; we send them nothing about your class. |
| Enable Banking (Finland) | Reading the class bank account, when a chair has connected one | The consent, and the transactions of the accounts the chair selected |
| Cloudflare | Serving the site and protecting it | Connection data, including IP addresses |
| Google (Analytics) — only if you agreed | Counting visits, so we know which parts of ClassFund.Club get used | Which page was viewed, with identifiers stripped out, plus the usual device and approximate location. Never a child's name, a balance or anything about your class. Nothing at all unless you said yes. |
| Our hosting and backup infrastructure | Running the application and its database | Everything, encrypted at rest in backups |
| Paddle (Paddle.com Market Ltd, London, United Kingdom) | Taking the payment when a class buys a plan, and issuing the invoice for it | Your invoicing details, the order, and the payment itself. The card number is typed into Paddle's checkout and stays with Paddle; we never receive it. Not the class's records — no child, no balance, no bank account. |
| Atlassian (Jira Service Management) | Running our support desk — only if you ask us for help | Your name and email address, and the name of your class, so we know who is asking and what about. Then whatever you choose to write in the request. Nothing else about your class reaches them: no child's name, no balance, no amount, no bank account. |
| Microsoft (Teams) | Telling whoever is on duty that a request has come in | The request's reference, which kind it is, which class and who asked — and a link back to it. Never what you wrote. |
Paddle is different from the others in one respect worth stating. It is the merchant of record: when a class buys a plan, the sale is made by Paddle, Paddle's name is on the receipt, and Paddle works out and remits the VAT. For the payment itself Paddle is therefore a controller in its own right, under its own privacy policy at paddle.com, and a card number is handled by a regulated payment institution rather than by a class-fund app. What we get back is that the order was paid, when, and a reference — never the card.
The support desk is the only one of those you can switch on yourself, simply by asking us something — until you do, nothing about you is sent to Atlassian at all. Your class is set up there as a group so that a question is answered with your class's history in front of us, and so that whoever picks it up knows which books you mean. Your request itself is visible to you and to us. It is not shown to the rest of your class unless you choose to share it.
We hand personal data to an authority only where the law actually requires it, and we will tell you when that happens unless we are forbidden to.
Where it is
The application and its database run inside the European Union, and so do the backups. Some of the suppliers above are organisations with parents outside the EEA — Google Analytics in particular sends data to Google LLC in the United States, and Paddle is established in the United Kingdom. Transfers rest on the European Commission's adequacy decisions — for the United Kingdom, and for the EU–US Data Privacy Framework where the supplier is certified under it — and on Standard Contractual Clauses where neither applies. Ask us at privacy@classfund.club and we will tell you exactly which applies to which. If you would rather nothing of yours left the EU at all, decline the analytics cookies: then nothing is sent to Google in the first place.
How long we keep it
| What | How long |
|---|---|
| Your account | Until you ask us to delete it, or the class you belong to is deleted and you belong to no other |
| A class and everything in it | Until the chair deletes the class, and then it goes with it |
| Invoicing details and orders | Eight years from the end of the year the order was placed in, because accounting records have to be kept and we cannot delete them earlier even if you ask |
| Server logs | Thirty days, unless a specific security investigation needs them longer |
| The class's audit trail | Eighteen months from the event, then deleted automatically — or sooner, with the class |
| Copies of the messages the app sent (our compliance archive) | As long as the class exists, and for eighteen months after it is deleted; then deleted automatically |
| Bank consents and their tokens | Until the consent expires or is withdrawn, whichever comes first |
| Recommendations you sent (fingerprints of the addresses) | Until you delete your account. A fingerprint kept because somebody asked us never to write to them again is kept as long as the service runs — forgetting it would mean writing to them again |
Your rights
Under the GDPR you may ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use of it, and ask for it in a portable form. Write to privacy@classfund.club and we will answer within a month — usually the same week.
Two rights are worth pointing at specifically. You may withdraw a bank connection at any time, from inside the app, and reading stops immediately. And where we rely on legitimate interests, you may object, and we will stop unless we can show a reason that overrides yours.
If you think we have got this wrong, you may complain to the data protection authority where you live. In Hungary that is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), naih.hu. We would rather you told us first, but it is your right either way.
Cookies
Five cookies, and only the last one is optional. The first four are strictly necessary — without them the service cannot do what you asked it to:
- A session cookie, which keeps you signed in. Without it there is no app.
- Your language choice.
- Your light or dark theme choice.
- Which of your classes you are currently looking at, if you belong to more than one.
- Your answer to the analytics question below — kept whichever way you answer, so that we do not ask again. It is one answer for classfund.club and app.classfund.club together, so you are asked once, not once on each.
The fifth is there because of the sixth. **We use Google Analytics to count visits**, and its cookies are not strictly necessary, so we ask before setting them. Until you say yes, no Google script is loaded, no cookie is set and no request reaches Google at all. Saying no is one click, is remembered exactly as long as yes, and costs you nothing in the app.
What is measured is which pages get used, from what sort of device, and roughly where in the world. Alongside that we count a short list of things happening at all — a button pressed on this site to start using ClassFund, a sign-in started, a class created, a list of parents imported, a statement read in, a bank connected or synced, an expense recorded or a bill attached to it, an invitation, a report or a recommendation sent — with nothing but a count and a kind beside each: how many rows a file had, whether it was a .csv or an .xlsx, the name of the bank, whether a cost was split between everyone or between some children. Buying a plan is measured the same way, step by step from reading the prices to the payment going through — and because it is a purchase, it carries what the plan cost, the VAT on it, the currency, the kind of payment method used, and the seller's reference for the order. That is money a class pays **us**, and it is the only money that ever reaches Google: nothing out of a class's own books — not a contribution, not a balance, not a bank line — is ever sent. What is not measured, ever: identifiers of children or classes, anybody's name or email address, or anything typed into the app. Addresses such as /students/12345 are stripped to /students/[id], and everything after a question mark is dropped, before they are sent — the address of the page you came from as well — so the shape of the page reaches Google and the child does not. If you came from another website, only that site's name is sent, not the page or what you searched for. Nothing is used for advertising, and there is no advertising anywhere in ClassFund.
Changed your mind? Clearing your cookies for this site puts the question back, and answering no also deletes the Google cookies already set.
Keeping it safe
- Everything travels over TLS.
- What you can see is decided by your role in each class, on the server, for every request — a parent cannot reach another family's figures by changing an address in the browser.
- Bank access is read-only by design. There is no code path in ClassFund.Club that can move money.
- Backups are encrypted and kept apart from the running system.
- We store no passwords, because we never receive any — and no card numbers, for the same reason: a plan is paid on Paddle's checkout, and the number never passes through us.
- Pictures are resized and held in our own database, encrypted in backups like everything else, and served only to people who may see the person they show.
If a breach ever puts your data at risk, we will tell the supervisory authority within 72 hours and tell you without undue delay where the law requires it — and, frankly, where it does not but you would want to know.
Changes
When this policy changes in a way that matters, we will say so in the app before the change takes effect rather than quietly reposting the page. The date at the top always says when it was last revised.