Privacy Policy

Who we are

The service is operated by Walker Software Solutions (My Class Media). We provide a private school media gallery platform for schools to manage and share approved media with staff, parents, and guardians.

Scope

This policy covers the My Class Media web application and associated services we run. It does not replace a school's own privacy notice for how that school uses personal data.

Roles

• School-managed content: In general, the school is the Data Controller for personal data contained in content the school uploads or manages (for example, photos, albums, and associated metadata). Walker Software Solutions acts as a Data Processor for that content, processing it on the school's documented instructions.
• Service operation: Walker Software Solutions is the Data Controller for personal data needed to operate the service (for example, account credentials, security logs, and support communications).

Data we process

• Account data: email address, authentication identifiers, and role (e.g. staff/admin/parent).
• Google sign-in data: basic profile details provided when you choose “Continue with Google” (such as your email address, name, profile picture, and a Google account identifier).
• School and gallery data: school name and configuration, media uploaded by schools, and related metadata (such as album/taxonomy labels).
• Usage and security data: technical logs necessary to keep the service secure, reliable, and to prevent abuse.
• Support communications: messages you send to us (including the support email above) and our responses.

Cookies

We use cookies that are essential for the service to function and to remember basic preferences.

• Essential cookies: used for authentication and security, including cookies used by our authentication provider and server-side session handling.
• Hosting and security cookies: our hosting and security providers may set strictly necessary cookies for load balancing, abuse prevention, and security protections.
• Preference cookie: we set an HttpOnly cookie named active_school_id to remember the last selected school.
• Analytics (Google Analytics): we use Google Analytics (GA4) on our website to understand aggregated usage (for example which pages are visited and basic device/browser information). Google Analytics may set and read first-party cookies or similar identifiers to distinguish browsers for measurement purposes.
• No advertising/marketing cookies: we do not use advertising or marketing cookies and we do not use third-party marketing trackers.

Lawful bases

We process personal data as needed to provide and secure the service, to comply with legal obligations, and where applicable based on a school's instructions and lawful basis for school-managed content.

Sharing and subprocessors

We share personal data with service providers (subprocessors) only as needed to operate My Class Media.

We do not sell personal data and do not use third-party marketing trackers.

• Supabase: database, authentication, and storage infrastructure.
• Vercel: hosting and deployment infrastructure.
• Mailgun (used to send service emails such as one-time codes and notifications).
• Google Analytics (Google): website analytics and measurement.

Google sign-in (Google user data)

If you choose “Continue with Google”, we receive basic account information from Google (such as your email address, name, profile picture, and an account identifier). We use this data to authenticate you, create or link your My Class Media account, and operate the sign-in flow.

We do not request access to other Google services (for example Gmail, Google Drive, or Contacts), and we do not use Google user data for advertising.

Retention

We retain personal data for as long as necessary to provide the service, meet contractual obligations with schools, and comply with legal requirements. Schools control retention of school-managed content and can instruct us to delete or export it, subject to applicable law.

Rights and requests

Under UK GDPR, you may have rights including access, rectification, erasure, restriction, objection, and portability (as applicable).

If your request relates to school-managed content (for example, media uploaded by the school or access decisions), please contact the school first. The school is typically the Data Controller for that content.

If we receive a request about school-managed content, we may only act on the school's instructions. We can help route requests to the right school contact where possible.

If you're unsure who the controller is, email support@email.myclassmedia.com and we'll help identify the right contact.

To help us process your request, please include the email address you used, the school name (if relevant), and what you are requesting.

For requests about service operation data (for example, support communications), contact us at support@email.myclassmedia.com.

You also have the right to complain to the UK Information Commissioner's Office (ICO) if you believe your data protection rights have been infringed.

International transfers

Our service providers may process data in different countries. Where personal data is transferred internationally, we use appropriate safeguards required by applicable data protection laws.

Updates

We may update this policy from time to time. The “Last updated” date above shows when changes were last made.