Cookie Policy

1. About this policy

1.1 What this policy covers

This policy explains how we use cookies and similar technologies, what each category does, how the marketing website differs from the authenticated platform, and how you control what is set on your device.

It covers two quite different environments, and the difference matters:

• The marketing website — classe365.com and its subpages. This is the public site where people read about our products, request a demonstration, download material and start a free trial. Analytics and marketing technologies operate here.

• The authenticated platform — Classe365 and Hiree365, once you have logged in. This is where student, learner and candidate records live. Marketing and advertising technologies do not operate here.

1.2 Which entity is responsible

Customers located in the United States contract with 365 Software, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Customers located anywhere else contract with Sprout On Web Pty Ltd, ABN 72 138 602 418, 22 Palm Street, St Ives, NSW 2075, Australia. Support and engineering are provided 24/7 by Classe365 group staff in Australia, India, the Philippines, Spain and the United States. Together we are “Classe365”, “we”, “us” and “our”.

For cookies and similar technologies on classe365.com, the controller is Sprout On Web Pty Ltd, except that for prospective customers and customers located in the United States the controller is 365 Software, LLC. Inside the platform, your institution is the controller and we act on its behalf.

1.3 Related documents

Read this policy together with our Privacy Policy, our Children’s Privacy Policy, our US State Privacy Notice and our AI Use and Transparency Statement. Where a term is defined in the Privacy Policy, it has the same meaning here.

2. What cookies and similar technologies are

2.1 Cookies

A cookie is a small text file that a website asks your browser to store on your device. When you return, the browser sends the cookie back, which lets the site recognise the browser, keep you logged in, remember a setting, or count a visit.

Cookies are described in two ways:

• First-party or third-party. A first-party cookie is set by the site you are visiting. A third-party cookie is set by another organisation whose code runs on that page — an analytics provider, for example.

• Session or persistent. A session cookie is deleted when you close your browser. A persistent cookie stays on your device until it expires or you delete it.

2.2 Similar technologies

Several other technologies do similar jobs, and this policy treats them the same way as cookies:

• Local storage and session storage — browser storage the site can read and write. The platform uses local storage to hold interface state so that pages load correctly and your work is not lost between screens.

• Pixels and tracking images — a tiny image or script embedded in a page or an email that records that the page was opened or the email was read. We use these in our business marketing emails, and on the marketing website for our own analytics and campaign measurement. We do not run advertising or retargeting pixels on classe365.com. We do not use them in platform notification emails sent to students.

• Software development kits and embedded scripts — code from a third party running in a page, such as an analytics or support-messaging script.

• Persistent identifiers — any identifier that recognises a user or device over time, including a cookie identifier, a device identifier, an account identifier or a session token. Section 5 explains how these are used in the platform, and why we treat them carefully.

2.3 What we do not use

We do not use browser fingerprinting to identify users, and we do not use cookies to build advertising profiles of students, candidates or children.

3. The four categories we use

We group everything we set into four categories. Strictly necessary technologies, and preference technologies that only remember a choice you have actively made, are set without asking you. Analytics, marketing and other non-essential technologies on the marketing website — including Intercom — are loaded only after you consent, where consent is required by law.

3.1 Strictly necessary

These are required for the website or the platform to work. Without them, pages will not load correctly, you cannot log in, and security controls fail. They cannot be switched off through our consent tool, because switching them off would break the service. In most jurisdictions consent is not required for them.

3.2 Analytics

These tell us how the marketing website is used — which pages are visited, how visitors arrive, how long they stay, where they leave — so we can improve it. They are set on the marketing website only, and only where you have consented in jurisdictions that require consent.

3.3 Preference

These remember choices you have made, so you do not have to make them again: language, region, an interface option, whether you have dismissed a banner, or your cookie preferences themselves.

3.4 Marketing

These support our business-to-business marketing: recognising a returning visitor to the marketing website, measuring whether a campaign led to a demonstration request, and recording whether one of our marketing emails was opened or a link followed. They are set on the marketing website and in our business marketing emails only. They are never set inside the authenticated platform, and they are never served to any authenticated user of the platform, including students.

4. What we set, and what it does

The table below names the technologies in use and what each does. Where a technology is provided by a third party, the third party sets its own expiry periods and publishes them in its own documentation.

Payment pages provided by Stripe and PayPal may set their own strictly necessary cookies to complete and secure a transaction. Those cookies are governed by the payment provider’s own policy.

If your institution has enabled SMOWL for online quiz proctoring, SMOWL is contracted by the institution directly under SMOWL’s own terms, and any technologies it uses are governed by SMOWL’s own privacy policy rather than this one. Similarly, where a customer has configured Zapier, the customer controls that integration.

5. The platform is different from the marketing website

This section is the one we ask school administrators, IT teams and parents to read most carefully.

5.1 No marketing or advertising cookies for authenticated students

Marketing and advertising cookies are not served to authenticated student users.

Once a user is logged in to Classe365 or Hiree365, no advertising technology runs, no advertising network is loaded, no advertising identifier is set, and no advertising profile is created. There is no advertising inside the platform at all. This holds for every student and learner, at every age, in every country, and it is not a setting an institution can switch on.

Analytics and marketing technologies — Google Analytics, Semrush, Mailchimp and ActiveCampaign — operate on the classe365.com marketing website only and never receive student or candidate records from the platform.

5.2 Persistent identifiers inside the platform

The platform necessarily uses persistent identifiers. A session token identifies your browser as belonging to your logged-in session. An account identifier associates an action with the person who took it. A tenant identifier keeps one institution’s data separate from another’s. Local storage holds interface state between screens.

Persistent identifiers within the platform are used only to support the internal operations of the service. By internal operations we mean:

• authenticating a user and maintaining a logged-in session;

• keeping one institution’s data separate from every other institution’s;

• remembering a user’s own interface and language preferences;

• maintaining audit trails of activity in the platform;

• protecting the security and integrity of the service, including detecting intrusion, abuse and fraud;

• diagnosing and fixing faults, and measuring performance so pages load reliably;

• fulfilling a request the user made, such as an in-platform support conversation;

• complying with a legal obligation.

We do not use persistent identifiers in the platform to profile users for advertising, to build or enrich a marketing audience, to track a user across other companies’ websites or apps, or to target content to a user based on behaviour observed elsewhere.

5.3 Why we state this so precisely

The FTC’s amended COPPA Rule treats a persistent identifier as personal information in its own right, whether or not it is attached to a name. That means a cookie identifier or device identifier associated with a child is regulated data. The Rule permits the use of a persistent identifier to support the internal operations of a service without notice or consent, but it does not permit its use to build a profile or to target advertising.

The platform is designed so that these identifiers are used to support the internal operations of the service, as listed above — authentication, tenant separation, security, auditing and fault diagnosis — and not to build profiles or target advertising. Our full position on children’s data, including the institution’s authorisation of our collection and use of children’s information for its educational purpose, retention and our written children’s information security program, is set out in the Children’s Privacy Policy.

Hiree365 has a minimum age of 16 and no users under 13. We do not collect audio recordings of children’s voices.

6. How we ask for consent, and how you change your mind

6.1 The consent banner

When you first visit classe365.com from a jurisdiction where consent is required for non-essential cookies, a banner appears before any analytics or marketing technology is loaded. You can:

• accept all — allow analytics, preference and marketing categories;

• reject all non-essential — allow only strictly necessary technologies; the site works normally, and you are not asked again for the life of your preference record;

• manage preferences — turn each category on or off individually and save.

Rejecting non-essential cookies does not restrict access to any part of the marketing website, and it does not affect your ability to use the platform.

6.2 Changing your preferences later

Your choice is not permanent. You can reopen the preference centre at any time from the “Cookie preferences” link in the footer of every page on classe365.com, change any category, and save. The change takes effect for technologies loaded after that point, and technologies you switch off are not loaded again. Switching a category off stops those technologies loading from that point; cookies they have already set remain until they expire or you delete them.

If you clear your browser’s cookies, you will clear the record of your choice as well, and the banner will appear again the next time you visit.

6.3 Consent signals

Where a state or national law requires us to honour a universal opt-out mechanism such as Global Privacy Control, we honour that signal on classe365.com as an opt-out of non-essential categories, without requiring you to interact with the banner.

6.4 What consent does not cover

Consent is not required, and is not requested, for strictly necessary technologies, because the service cannot be provided without them. Turning them off is not possible through our preference centre; it is possible through your browser, but the site and platform will not work correctly if you do.

We do not treat continued scrolling or continued browsing as consent, and we do not pre-tick consent boxes.

7. Controlling cookies through your browser

You can control cookies in your browser as well as through our preference centre. Every major browser lets you view stored cookies, delete some or all of them, block third-party cookies, and block all cookies from a specific site. The controls are usually under Settings, then Privacy or Privacy and Security.

Some things to know before you do:

• Blocking all cookies will prevent you logging in to Classe365 or Hiree365, because authentication depends on a session cookie.

• Deleting cookies removes your saved cookie preferences along with everything else, so the consent banner will reappear.

• Browser settings are per-browser and per-device. Changing them on a laptop does not change them on a phone.

• Private or incognito browsing usually discards cookies at the end of the session, which means your preferences are not remembered either.

• Most browsers also offer a “Do Not Track” setting. There is no common industry standard for how sites should respond to it, and we do not rely on it. We do honour Global Privacy Control as described in section 6.3.

Your institution’s IT team may also apply cookie or script controls centrally on managed devices. If a platform feature is not working on a school-managed device, that is worth checking.

8. How long cookies last

A cookie’s stated lifespan is a maximum, not a promise that it will survive that long. You can delete any of them at any time, and clearing site data removes all of them immediately.

Separately from cookie lifespans, personal information collected through these technologies is retained under the schedule published in our Privacy Policy — most relevantly, server and security logs for 30 days, and marketing and CRM contact data for 36 months from last engagement.

9. Cookies and international transfers

Some of the providers named in section 4 are located in the United States. Where information collected by a cookie is transferred out of the European Economic Area, the United Kingdom or another jurisdiction with transfer restrictions, we rely on an adequacy decision or adequacy regulations where one applies, including the EU–US Data Privacy Framework and its UK and Swiss extensions where the provider is certified, and otherwise on the transfer safeguards recognised by the law that applies to the transfer, as included in our contract with the provider. For customer data in the platform, the transfer mechanisms set out in our Personal Data Processing Agreement and described on our International Data Transfers page apply.

Our Privacy Policy also discloses that Classe365 group support and engineering staff in Australia, India, the Philippines, Spain and the United States may access customer data, including student data, remotely when providing 24/7 support and engineering.

10. Changes to this policy

We update this policy when we add, remove or materially change a technology described in it. Where a change requires your consent, we will ask for it before the technology is loaded, rather than relying on a consent you gave for something else. Minor corrections — a renamed provider, a clarified sentence, a fixed link — take effect when published.

Each version carries a “Last updated” date and an “Effective” date at the top. The current version was published on 22 September 2026 and takes effect on 22 October 2026.

11. Contact us

Questions about this policy, or about cookies on our site: clientservice@classe365.com Support: clientservice@classe365.com Accessibility line: +61 2 9472 5000

By post — United States customers: 365 Software, LLC 131 Continental Dr, Suite 305 Newark, DE 19713 United States

By post — all other customers: Sprout On Web Pty Ltd 22 Palm Street St Ives, NSW 2075 Australia

If you are a parent, a student or a school administrator and you want to confirm what runs inside your institution’s tenant, write to your institution, or to us, and we will help you find the answer.

Classe365 and Hiree365 are operated by 365 Software, LLC (United States customers) and Sprout On Web Pty Ltd (all other customers), with 24/7 support and engineering provided by our group team in Australia, India, the Philippines, Spain and the United States.