Privacy Policy
In force since September 10, 2026
Who is responsible for this data
Kliip is published by the person or company identified in the legal notice, who is the data controller under the General Data Protection Regulation (GDPR) and the person in charge of personal information under Quebec's Law 25.
For any question about this policy, or to exercise your rights: contact@kliip.school.
If you use Kliip without an account
The board is fully usable without creating an account. In that case, no data about you is recorded on our servers. Everything you enter stays in your browser’s local storage, on your own device.
That local storage holds, among other things:
- your student list: first name, last name, gender if entered, support markers if any;
- today’s attendance;
- your board layout, your tool settings and your display preferences;
- whether names are currently masked.
None of this is ever sent to us. It disappears if you clear the site’s data in your browser, and it does not follow you from one device to another.
Local storage is not a cookie and is not used for any tracking. Neither we nor any other website can read it.
Your students’ data
This is the part that matters most, so it is written plainly: your students’ data does not leave your browser. It is not sent to our servers, it is not backed up to the cloud, and we have no way to look at it.
That remains true when you are signed in: the account is for your preferences and your reports, never for your class.
Because this data stays with you, you and your school remain responsible for it towards families. We give you two tools to help: name masking, which reduces first names to initials on the projected screen, and a warning shown before the full list appears when the app detects that you are presenting.
Support markers are deliberately limited to two values — “helper” and “to pair up”. They describe a role in a team, never a health condition, and the field cannot accept free text. That limit is on purpose: it keeps these markers out of the realm of sensitive data.
When cloud synchronisation is offered, it will be optional, announced as such, and this section will be rewritten before it goes live.
If you create an account
Creating an account is optional. It lets you report a problem, suggest a tool, keep your display preferences and, if you wish, subscribe. Here is exactly what is then recorded:
| What is recorded | Why |
|---|---|
| Your email address | To identify you, let you sign back in and recover your password. |
| Your display name, if you set one | To show it in your own menu. It is never shown to students. |
| Your preferred language | To serve you the interface and emails in the right language. |
| Your country and your province, state or region | To adapt Kliip to your school system: the interface’s wording and language variant, the list of levels for a class, the Routine’s school calendar, the currency and taxes, and the rights that depend on where you are, such as cancellation in Quebec. They also feed a count by country and region, without names, and will serve the teaching content adapted to your country’s curriculum. We never ask for your city or the name of your school. |
| Your display preferences | Theme, density, text size, animations, confetti, sounds, haptics, and your notification choices. |
| The date the account was created and last changed | To keep the account current and answer an access request. |
| Proof that you accepted the terms | The version of the document accepted, the date and the method. GDPR and Law 25 require us to be able to demonstrate that consent. |
| Your reports and suggestions | The text you write, its category and its language, so we can reply and fix the product. |
Two technical traces accompany reports and administration actions: a fingerprint of your IP address — a computed value the address cannot be reconstructed from — and a description of your browser. They are used only to limit abuse and to reproduce a reported problem.
If you choose “Continue with Google”, we receive your email address and account identifier from Google. We do not receive your password, your contacts, or any other content from your Google account.
If you subscribe, payment is collected by Paddle, our merchant of record: Paddle is the one that receives your billing details and your payment method. Kliip holds no banking data — all we receive from Paddle is the state of your subscription, its currency and its dates.
On what legal basis
| Processing | Legal basis (GDPR, art. 6) |
|---|---|
| Your account, preferences, country and region | Performance of the contract formed when you open an account. |
| Proof that you accepted the terms | A legal obligation: being able to demonstrate the consent collected. |
| IP fingerprint and administration log | Our legitimate interest in protecting the service from abuse. |
| Service emails (confirmation, forgotten password) | Performance of the contract. |
None of this processing serves marketing purposes, and none of it leads to automated decision-making or profiling.
How long this data is kept
- Your account and preferences: for as long as the account exists. You can ask for deletion at any time.
- Proof that you accepted the terms: the lifetime of the account, then three years, because it is what demonstrates consent.
- Your reports and suggestions: twenty-four months, then archived with no link to your account.
- The administration action log: twenty-four months.
- Your browser’s local storage: until you clear it. We cannot do it for you.
Who else sees this data
We sell no data, we rent none, and we pass none to anyone for advertising. Only the providers needed to run the service have access, each for its own part:
| Provider | Role | Where | What it sees |
|---|---|---|---|
| Supabase | Database and authentication | Paris, European Union | Your account, preferences and reports |
| Netlify | Website hosting | United States, global delivery | Your IP address and the pages requested |
| Resend | Sending service emails | United States | Your email address and the content of the message sent |
| “Continue with Google” sign-in, if you choose it | United States | The fact that you are signing in to Kliip | |
| Google Workspace | Receiving mail sent to our contact address | United States | Your email address and the content of your message |
| Google Analytics | Audience measurement of the presentation pages, only if you accept it | United States | The pages viewed, where the visit came from and a random identifier specific to your browser |
| Paddle | Selling and collecting payment for the subscription, if you subscribe | United Kingdom | Your name, email address, country and billing details |
The database is hosted in Paris on purpose: your account data stays inside the European Union. The other providers are established in the United States, except Paddle, whose selling company depends on your country — the United Kingdom one for buyers in the European Union, as set out in the terms of sale. Those transfers are covered by the European Commission’s standard contractual clauses.
“Continue with Google” sign-in only concerns those who choose it: if you register with an email address and a password, Google plays no part in your sign-in. Our contact address, however, is hosted on Google Workspace — if you write to us, your message is received and retained there, including when it is a request for access or erasure. The site’s typefaces are served from our own servers rather than from an online font service, so viewing a Kliip page passes your address to no third party.
Advertising and audience measurement
Kliip shows no advertising and sets no advertising cookie.
The classroom board and the embeds are entirely silent: no audience measurement, no ad pixel, ever. That is a product rule, not a setting.
The site’s presentation pages — the home page, the tool gallery, the per-tool pages, pricing, what’s new and these pages — use Google Analytics, an audience measurement service provided by Google LLC (United States), to know how many people visit the site, where they come from and whether they open the board. Nothing loads until you accept: a banner offers you the choice, declining is as simple as accepting, and your answer is kept in your browser’s local storage — not in a cookie. You are asked again with each new version of this policy, and you can change your mind at any time through the “Audience measurement” link in the footer.
If you accept, Google receives the pages viewed, where the visit came from, a random identifier specific to your browser and technical information (device type, browser, country). We have turned off Google signals and ad personalisation, we share this data with no other Google service, and it is kept for fourteen months. This processing relies on your consent; it involves a transfer to the United States, covered by the European Commission’s standard contractual clauses.
Cookies
The site sets no advertising cookie. The only cookies it may set are those of Google Analytics (named “_ga” and “_ga_…”), on the presentation pages only, and only after you agree in the banner described in the previous section. They serve to recognise your browser from one visit to the next, expire after two years, and are deleted if you decline measurement after having accepted it.
When you are signed in, your session is kept in your browser’s local storage so that you are not asked for your credentials on every page. That is strictly necessary to run the service and does not require prior consent. Signing out clears it. Your answer to the audience measurement banner is kept in the same place.
How this data is protected
- The whole site is served over HTTPS.
- Passwords are never stored in clear text.
- Database access is partitioned row by row: your account can only read its own data.
- We keep an internal register of confidentiality incidents, as Law 25 requires.
In the event of an incident presenting a serious risk, you would be notified along with the competent authority, within the time limits set by the GDPR and by Law 25.
Your rights
At any time you may ask:
- to see the data we hold about you;
- to have it corrected if it is inaccurate;
- to have it erased;
- to receive a copy in a machine-readable format, or have it sent elsewhere;
- to restrict a processing operation, or to object to it;
- to withdraw a consent you had given, without calling into question what was done before.
Two of these rights need no email. From your account page, “Download my data” immediately produces a file gathering your account, your settings, your reports, the log entries you are the author of, and the classes saved in your browser. Whatever the file does not contain is named in it, with the reason.
For the rest — correction, erasure, restriction, objection, withdrawal of a consent — one address: contact@kliip.school. We answer within one month, and within the thirty days set by Law 25 for requests from Quebec.
If our answer does not satisfy you, you can refer the matter to your country’s authority: the CNIL in France, the Data Protection Authority in Belgium, the Federal Data Protection and Information Commissioner in Switzerland, or the Commission d’accès à l’information in Quebec.
Students do not have accounts
Kliip is meant for teachers. No account can be created for a student, and we knowingly collect no data directly from a child.
The student names you enter for your class fall under “Your students’ data”: they stay in your browser.
If this policy changes
Any substantive change will be dated at the top of this page. If it affects what we do with your data, you will be told and asked to accept again before it applies.