Privacy Policy
This Privacy Policy explains how UpperClass (operated by Better Tech Pte. Ltd., "UpperClass", "we", "us") collects, uses, shares, and protects personal data on the UpperClass platform ("Platform"). It applies to institution staff, student creators, recruitment agents, prospective students, and visitors to our public pages. It should be read together with our GDPR commitment and Sub-processors list.
Our role: controller and processor
Data-protection law distinguishes between the party that decides why data is processed (the controller) and the party that processes it on the controller's behalf (the processor). UpperClass acts in both roles, depending on the data:
UpperClass as processor. When an institution runs a creator program on UpperClass, the institution is the controller of its program data — creator applications, content submissions, bookings, and the prospective-student leads its creators generate. UpperClass processes this data on the institution's instructions under a Data Processing Agreement (DPA). Each institution's data is held in strict isolation from every other institution's.
UpperClass as controller. For account registration, authentication, platform security, billing, service communications, and improving the Platform itself, UpperClass is the controller.
What we collect
Institution staff and agents: name, work email, role, and activity within the Platform.
Student creators: profile information you choose to publish (name, program, photos, bio), social account handles you verify, content you submit, your availability and bookings, and your points and redemption history. Gender and year of birth are collected at signup for program administration only and are never displayed publicly. Identity verification documents, where required, are stored securely, access-restricted, and deleted shortly after the verification decision.
Prospective students: if you contact a creator or submit an inquiry through an institution's page, your contact details and inquiry are shared with that institution — the party responsible for responding to you.
Visitors: we measure page views and link clicks on our public pages to understand how they perform. This measurement does not use cookies or any identifier stored on your device, and it does not track you across sites.
How we use personal data
- Operate the Platform, authenticate users, and provide the features you request.
- Run creator programs on behalf of institutions, including moderation, booking, and rewards.
- Communicate with you about your account, bookings, applications, and service updates.
- Secure the Platform, prevent fraud and abuse, and comply with legal obligations.
- Measure and improve our public pages and the Platform experience.
Lawful bases
We rely on contract to provide the Platform to registered users; legitimate interests for security, fraud prevention, aggregate page measurement, and service improvement; consent where we ask for it explicitly (for example, connecting a social or Google account via OAuth, session recording, or marketing email); and legal obligation where the law requires retention, such as payment records.
Cookies and analytics
UpperClass uses only strictly necessary cookies for authentication, session management, and security. We do not use Google Analytics or any third-party advertising cookies, and we do not sell personal data. Our public-page measurement records aggregate page views and link clicks server-side without setting a tracking cookie or a cross-site identifier.
Sharing
We share personal data with: (i) the institution controller when acting as its processor; (ii) verified sub-processors that help us deliver the service (see below); (iii) authorities where required by law; and (iv) an acquirer in the event of a corporate transaction, subject to the protections in this policy. We do not sell personal data.
Sub-processors
We use a small number of verified providers to deliver the service — cloud hosting, email delivery, payment processing, content moderation, video sessions, and reward fulfillment. The current list, with each provider's role and location, is published at upperclass.app/subprocessors. We notify institution customers at least 30 days before adding or replacing a sub-processor that handles their data, and institutions may object on reasonable grounds.
International transfers
UpperClass operates globally. Our platform infrastructure is hosted on Supabase (AWS, United States). Where personal data of EU or UK residents is transferred outside those regions, we rely on Standard Contractual Clauses — and the UK Addendum where applicable — with our infrastructure provider and every sub-processor that handles personal data.
Retention
We keep personal data only as long as needed for the purposes described here or as the controlling institution instructs. Our standard retention periods:
| Data | Retained for |
|---|---|
| Account and profile data | Life of the account, then removed within 30 days of confirmed deletion |
| Identity verification documents | 30 days after the verification decision, then deleted |
| Session recordings and transcripts | 90 days; the written session summary is retained with the booking |
| Prospective-student inquiries (leads) | 24 months from last activity, or as the controlling institution instructs |
| Payment and billing records | As required by applicable tax and accounting law (typically 7 years) |
| Security and audit logs | 24 months |
| Page-view measurement | Aggregated after 90 days; raw events deleted at 13 months |
| Deletion registry | A minimal record (no profile data) is kept indefinitely so your deletion is honored permanently |
Security
Access to data is enforced at the database layer with row-level isolation per institution, one defined role per user, and audit logging on sensitive operations. Verification documents and media are stored in institution-isolated storage. Administrative actions on accounts, bans, and deletions are logged. Details are on our Security page.
Your rights
Wherever you are, you have the right to access, correct, export, and delete your personal data, and to restrict or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time. You may also lodge a complaint with your local data protection authority. Most profile data can be corrected directly in your account; account deletion can be requested from the account settings and is verified by one-time passcode. If your data is held by an institution as controller, we will route your request to them and support their response.
Minors
Creator accounts are open to registered students aged 18 or over; we verify this against the year of birth provided at signup and do not accept creator applications from anyone younger. Institution pages may be visited by prospective students under 18. We collect only what a prospective student chooses to submit in an inquiry, and institutions are responsible for handling those inquiries in line with their own obligations to minors.
Changes to this policy
We version our legal documents and record acceptance. Material changes will be communicated to institution customers and reflected here with a new effective date.
Contact
Questions or requests: privacy@upperclass.app, attention: privacy team. We respond to data subject requests within 30 days.
Effective date: July 18, 2026