Privacy Policy

Beta Trainers LLC · Classroom Management for Very Young Learners

Last updated: October 15, 2026 · Effective: October 15, 2026 · Version 1.0

https://betatrainers.com/privacy-policy

1. Who we are, and the two roles in this policy

1.1 The Service is operated by Beta Trainers, LLC, a Delaware limited liability company, 1111B South Governors Avenue, Dover, DE 19904, United States ("Beta Trainers", "we", "us"). "Beta Trainers" is our trade name; "Classroom Management for Very Young Learners" is our product.

1.2 This policy explains how we handle personal data when you visit betatrainers.com, create an account, subscribe, or use the Service — including the iOS application Classroom Management for VYL.

1.3 Two roles — read this first, because it decides who to contact.

1. (a) We are the controller for your data as a visitor, account holder and subscriber: your name, contact details, billing data, support messages and technical/usage data. For those, we decide the purposes and means.
2. (b) You are the controller, and we are the processor, for the data you enter or upload about pupils, parents and families — registers, attendance, ratings, notes, development reports, lesson photographs, parent and guardian details, invoices and messages. We process that data only on your instructions and under our Data Processing Agreement (the "DPA"). We do not use it for our own purposes.

1.4 The Service is a professional tool for adults. Accounts are for users aged 18 and over (§9). Data about children enters the Service only because a teacher puts it there.

1.5 This policy does not reduce rights you have under mandatory law in your country.

2. Data we collect

2.1 Data you give us (account holder)

2.2 Payment data. Card details are entered into Stripe's hosted payment fields and go directly to Stripe. We do not receive, process or store card numbers, security codes or full card data. We receive a payment token and limited metadata (brand, last four digits, expiry, status). Stripe is responsible for card data under the PCI DSS.

2.3 Data we collect automatically. IP address, device and browser type, operating system, language, referring page, pages viewed, timestamps, session and security logs.

2.4 Cookies and similar technologies. Strictly necessary cookies (session, security, load balancing), preference cookies, and — only as permitted — analytics cookies and an advertising pixel. See §5.

2.5 Data about children and families. Supplied by the teacher only: pupil first name or identifier chosen by the teacher, attendance and lateness status, lesson ratings, notes, development reports, lesson photographs, parent/guardian name, email, telephone/WhatsApp, invoices, messages.

2.6 What we do not collect. We do not open accounts for children. We do not knowingly collect personal data directly from anyone under 18. We do not ask children to register. We do not collect biometric identifiers or facial-recognition templates.

2.7 Purchases in the mobile app. The Service also includes our mobile applications for iOS and Android ("Classroom Management for VYL"). A subscription bought inside the iOS app is sold and processed by Apple under your Apple Media Services terms; a subscription bought inside the Android app is sold and processed by Google Play under Google's terms. In both cases payment is handled by the store and we never receive your card details. The store sends us the transaction identifier, the product and the subscription state (active, in a trial, expired, refunded). RevenueCat acts as our subscription management processor, keeping that state and the entitlement that decides whether the app opens. Managing or cancelling an in-app subscription is done in your Apple ID settings or in Google Play (§10.9 and §10.10 of our Terms).

3. Why we use personal data, and our legal bases

3.1 We do not use pupil, parent or family data for our own marketing, analytics, product development or profiling.

4. Children's data, photographs and the parents' portal

4.1 The Service is an educational tool used by teachers of English to children of about 3 to 7 years of age. The children are not our users and do not have accounts.

4.2 Children's data reaches us only because a teacher enters it, and only for that teacher's own educational purpose. We process it as a processor, on the teacher's instructions, under the DPA.

4.3 The teacher must: (a) obtain and document consent from each child's parent or legal guardian for the processing of that child's personal data, and in particular verifiable, specific consent for lesson photographs and for any publication or sharing of a child's image; (b) comply with the strictest rule that applies where the child or the family lives — some jurisdictions require the consent of both holders of parental responsibility for a child's image; (c) inform parents that the Service is used, what is recorded, and for how long; (d) enter only what is necessary for the educational purpose; (e) keep consent records and produce them to us on request; (f) honour a parent's withdrawal of consent, including deleting photographs already uploaded.

4.4 No advertising. No profiling. No sale. We do not serve advertising to children, do not build advertising or behavioural profiles of children, do not use children's data or images to train artificial-intelligence models, do not enrich children's data with third-party data, and do not sell or share children's personal information.

4.5 Analytics and pixels never touch child data. Google Analytics and any advertising pixel are excluded from the authenticated portal and from any page that displays pupil, parent or family data (§5.4).

4.6 Photographs. Uploaded only with documented parental consent. We do not perform facial recognition, do not create biometric templates, and do not run automated emotion or behaviour analysis on photographs of children.

4.7 Parents' portal. Parents access their own child's information as invited by the teacher. Parent and family data is supplied by the teacher. Parents exercise their rights against the teacher as controller; we support the teacher, and we forward to the teacher any request we receive (§10.5).

4.8 Deletion. A teacher can delete an individual child's records at any time. Deletion, account closure and backup retention follow §8.

5. Cookies, analytics and tracking

5.1 We use four categories: strictly necessary, functional, analytics, advertising.

5.2 Strictly necessary cookies (session, authentication, security, load balancing) are set without consent because the Service cannot work without them.

5.3 EU/UK: non-essential cookies and any advertising tag are set only after consent, through a banner offering accept and reject with equal prominence, with granular per-category choice, and with withdrawal as easy as giving. No cookie wall: refusing non-essential cookies does not deny access to the Service.

5.4 Firewall. No analytics script, advertising pixel, session-recording, heatmap or error-replay tool runs inside the authenticated portal or on any page that displays pupil, parent or family data.

5.5 Google Analytics. Used on public pages only (home, marketing, public teacher profile pages that contain no pupil data). Google Signals and ads personalisation are disabled, data-sharing with Google for advertising is off, and retention is set to 14 months. In the EU/UK it loads only after consent.

5.6 Advertising pixel. Used on public marketing pages only, after consent in the EU/UK. It is never linked to pupil, parent or family data.

5.7 Do Not Track / Global Privacy Control. We treat a browser's Global Privacy Control signal as a valid opt-out of sale and sharing.

5.8 Cookie inventory (name, provider, purpose, duration) is published alongside this policy and updated when it changes.

6. Who we share data with

6.1 We do not sell personal data. We share it only as follows:

1. (a) Infrastructure, storage, backups and email — Amazon Web Services, Inc., including Amazon SES, in the AWS region us-east-1 (N. Virginia, United States).
2. (b) Payments and billing — Stripe, Inc. (and, where applicable, the Stripe group entity that contracts with you), for checkout, subscription billing and tax calculation. Card data is handled by Stripe; we never store it.
3. (c) Analytics — Google LLC (Google Analytics), public pages only (§5.5).
4. (d) Professional advisers — lawyers, accountants and insurers, on a need-to-know basis and under confidentiality.
5. (e) Legal — courts, regulators and law enforcement where the law requires it. We challenge over-broad requests where we lawfully can, and we notify you unless prohibited.
6. (f) Corporate transaction — on a merger, financing or acquisition of the business or assets, with the same protections and notice to you.

6.2 Every processor is bound by written terms covering confidentiality, security, no use for its own purposes, assistance with data subject rights, and — for data from the EEA/UK — the Standard Contractual Clauses.

6.3 The current subprocessor list is in Appendix A. We give at least 30 days' notice before adding a subprocessor that touches pupil or family data, and you may object.

7. International transfers

7.1 We are established in the United States and our primary systems run there (AWS us-east-1). If you use the Service from the EEA, the UK or Switzerland, personal data is transferred to the United States.

7.2 Safeguards. For transfers from the EEA we rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914); for the UK, the UK International Data Transfer Addendum. Where a recipient is certified under the EU-US Data Privacy Framework, we rely on that certification instead. We carry out and keep under review a transfer impact assessment.

7.3 Pupil data. These transfers are controlled by the teacher as controller. The DPA incorporates the Standard Contractual Clauses so the teacher can rely on them, and we assist with the teacher's own transfer assessment.

7.4 We never transfer personal data for marketing purposes, and we make no onward transfer to a jurisdiction without equivalent protection unless the law allows it and safeguards are in place.

8. How long we keep data

8.1 After deletion we may keep aggregated, de-identified statistics that cannot be linked to any person.

8.2 Where the law requires longer retention, or where data is needed for a legal claim, the relevant data is kept isolated until that duty ends.

9. Accounts are for adults — children's privacy

9.1 You must be 18 or over to hold an account. We do not knowingly collect personal data directly from anyone under 18. If we learn that an account belongs to a minor, we close it and delete the data.

9.2 We do not direct marketing at children, do not offer incentives for children's data, and do not permit accounts, purchases or profiles for children.

9.3 US — COPPA (15 U.S.C. §6501 et seq.; 16 CFR Part 312). The Service is not directed to children under 13 and does not collect their personal information directly. Where a teacher's educational use requires parental consent for a child, the teacher obtains it, and we support and document it and use that data only to provide the Service as instructed.

9.4 EU/UK — GDPR Article 8. The Service is not offered directly to a child, and consent for a child's data is obtained by the teacher as controller from the holder of parental responsibility, as required by the applicable national law.

9.5 We never condition a child's participation in an educational activity on a parent providing more data than is reasonably necessary.

10. Your rights

10.1 If we are the controller (your account data) you may: access your data; correct it; delete it; restrict processing; receive it in a portable format; object to processing based on legitimate interests; withdraw consent at any time (without affecting processing already done); and not be subject to a decision based solely on automated processing. You also have the right not to be discriminated against for exercising these rights.

10.2 US state privacy laws. If you live in California, or in another state with a comprehensive privacy law, you may request to know and access personal information, request deletion, request correction, opt out of the sale or sharing of personal information, limit the use of sensitive personal information, and designate an authorised agent. We do not sell personal information and do not share it for cross-context behavioural advertising. We verify requests by matching your account and email, and you may appeal a refusal.

10.3 Complaints. If you are in the EEA, you may complain to your national supervisory authority; in the UK, to the Information Commissioner's Office. We would rather you came to us first.

10.4 How to exercise them. Write to [email protected] (or [email protected]) from the email address on your account. We answer within 30 days; for GDPR requests, within one month, extendable by two months for complex requests, with an explanation. No fee, unless a request is manifestly unfounded or excessive.

10.5 Pupils, parents and families. For pupil and family data, the teacher or their organisation is the controller — send your request to the teacher, who decides. If you contact us, we will forward it to the teacher, assist them in responding, and act only on their instructions, unless the law requires us to act ourselves.

10.6 We do not use your data for automated decision-making that produces legal or similarly significant effects.

10.7 We may refuse or limit a request where the law requires us to keep the data, or where it would affect another person's rights.

11. Security

11.1 We protect data with TLS encryption in transit, encryption at rest, least-privilege access controls, multi-factor authentication on administrative accounts, access and audit logging, vendor due diligence, and confidentiality obligations for anyone with access. We never store card data.

11.2 Access to pupil, parent and family data by our staff is restricted to what is needed to operate, secure or support the Service, on your instructions.

11.3 Breach notification. If we become aware of a personal data breach affecting the data we process for you, we notify you without undue delay and help you meet your 72-hour notification duty and your duty to inform data subjects. For breaches of the data we control, we notify the competent authority and, where there is a high risk, the affected individuals, as the law requires.

11.4 No system is perfectly secure. We do not promise absolute security.

12. Changes to this policy

12.1 We publish each version with its date and keep prior versions at the same URL.

12.2 For material changes to processing where we are the controller, we notify account holders by email at least 30 days before the change takes effect.

12.3 We will not use pupil, parent or family data for a new purpose without the teacher's agreement, because we are not the controller of that data.

13. Contact

Beta Trainers, LLC — 1111B South Governors Avenue, Dover, DE 19904, United States · Privacy: [email protected] · Support: [email protected]

[PLACEHOLDER — EU representative under GDPR Article 27: name, address, email] [PLACEHOLDER — UK representative under the UK GDPR and Data Protection Act 2018: name, address, email]

Appendix A — Subprocessors