Privacy Policy

Last updated: 23 September 2026

1. Who we are

Cactus Class is an online workspace for live teaching, interviews and collaboration, available at https://cactusclass.com (the "Service").

The Service is operated by:

Finteka, LLC A limited liability company formed under the laws of the State of Delaware, United States, on 5 August 2025. Postal address: 1111B S Governors Ave, STE 39180, Dover, DE 19904, United States Registered agent: Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States Email: support@cactusclass.com

In this policy, "we", "us" and "our" mean Finteka, LLC. "You" means any person who uses the Service.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), Finteka, LLC is the controller of the personal data described in this policy.

Where a Host uses the Service in a professional or business capacity to teach, interview or collaborate with their own clients or students, that Host acts as an independent controller of the content they create and of their relationship with those individuals. The Host is responsible for their own compliance with data protection law in respect of that content.

2. Scope and the laws that apply

We serve users internationally. This policy is written to comply with:

• the UK General Data Protection Regulation and the Data Protection Act 2018;
• the EU General Data Protection Regulation (Regulation (EU) 2016/679);
• the Privacy and Electronic Communications Regulations 2003 (PECR) in the United Kingdom, and the ePrivacy Directive in the European Economic Area, as regards cookies and electronic mail;
• the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable United States state privacy laws;
• applicable federal law of the United States, including the CAN-SPAM Act and, as to children, the Children's Online Privacy Protection Act (COPPA).

We apply the standards above to every user, wherever they live. Where the law of your own country gives you stronger rights than this policy describes, that law prevails.

3. Our approach in short

• We do not sell or share your personal data, and we do not "sell" or "share" it as those terms are defined in the CCPA/CPRA.
• We do not send marketing or promotional email. The only email we send is the six-digit sign-in code you ask for.
• We do not use advertising cookies, analytics cookies, tracking pixels, or third-party analytics of any kind. The Service itself sets a single first-party cookie, which is strictly necessary to keep you signed in. Sign-up loads Google reCAPTCHA to stop automated abuse; that is a third-party script, not our analytics (see sections 7.2 and 8).
• We do not use your content, your recordings or your messages to train artificial intelligence or machine learning models.
• We collect the minimum we need to operate the Service.

4. The personal data we collect

4.1 Data you give us when you create and use an account

• Email address. Required. It is your account identifier and the address to which we send your sign-in code.
• Name. Required at sign-up, stored as a first name and, where given, a last name.
• Role. Either Host or Participant.
• Profile photo. Optional. If you upload one it is stored as an image file in our object storage.
• Invitation code. If you join through a Host's invitation code, we record the link between your account and that Host.

4.2 Authentication data

• One-time sign-in codes. When you sign up or sign in, we generate a six-digit code and email it to you. We never store the code itself. We store only an irreversible SHA-256 hash of it, the purpose of the code, the time it was sent, the number of failed attempts, and its expiry time. The record expires ten minutes after it is created and is deleted as soon as the code is used.
• OTP send counters. To stop bulk sending of codes, we count how many codes we have sent to each email address and from each IP address in the current hour and calendar day. Those counters live in our database and are deleted within two days.
• Bot check on sign-up. Creating an account, and asking us to resend the sign-up code, uses Google reCAPTCHA. There is no checkbox. Your browser loads Google's script on the Sign Up form only. We send Google the resulting token and your IP address. We accept the request only if Google reports a valid token, the expected action, and a score of at least 0.5. We do not store the token. Google may also collect device and browser data for bot detection, as described in Google's privacy policy. A small reCAPTCHA badge appears on that form because Google requires it; it is removed after you are signed in.
• Session cookie. See section 8.
• Account security counters. The number of consecutive failed sign-in attempts and, if your account is locked, the time until which it is locked.
• Last activity time. We record when you were last active, so that other members of your workspace can see whether you are online.

4.3 Content you and other users create in the Service

• Meetings. Title, scheduled start time, duration, type, any notes, and any price and payment status that a Host records for their own bookkeeping.
• Messages. Text of chat messages between members, text of messages sent inside a meeting room, any text you quote from a page, and the page address a message was sent from.
• Whiteboards and documents. The contents of shared whiteboards and shared documents created during a meeting.
• Files. Any file you upload to a meeting or a library, including its file name, type and size.
• Recordings. Where a Host records a meeting, the resulting video and audio file. See section 6.
• Video library. Videos a Host uploads and the record of which Participants they were sent to.
• Notifications. The record of notifications generated for you and whether you have read them.

Content of this kind may contain personal data about you and about other people, including your voice, your image, and anything you choose to say, write, draw or upload.

4.4 Technical data collected automatically

For every request to our application programming interface, we record the request method, the address requested, your IP address, your browser user agent string, the response status code, how long the request took, and the size of the response. We use these records only to operate, secure and debug the Service, to detect abuse, and to investigate incidents.

4.5 Data we do not collect

We do not collect payment card details, bank details, government identifiers, precise location data, biometric identifiers, or special category data as defined in Article 9 of the UK GDPR. We ask you not to upload such data to the Service.

5. Why we process your data, and our lawful basis

Under the UK GDPR and EU GDPR we must have a lawful basis for each purpose.

To create and maintain your account, and to provide the Service you have asked for — including hosting your meetings, messages, files and recordings. Lawful basis: performance of a contract (Article 6(1)(b)).

To authenticate you — sending the one-time code to your email address, verifying it, and keeping you signed in. Lawful basis: performance of a contract (Article 6(1)(b)).

To notify you about activity in your own account — a meeting arranged with you, a message sent to you, a file shared with you. Those notices appear in the Service; we do not email them. Lawful basis: performance of a contract (Article 6(1)(b)).

To keep the Service secure and to prevent abuse — rate limiting, locking accounts after repeated failed attempts, retaining technical request logs, investigating suspected misuse. Lawful basis: our legitimate interests in protecting the Service, our users and our infrastructure (Article 6(1)(f)).

To fix faults and improve reliability — diagnosing errors from technical logs. Lawful basis: our legitimate interests in operating a working service (Article 6(1)(f)).

To respond to your support requests. Lawful basis: performance of a contract, and our legitimate interests in supporting our users (Articles 6(1)(b) and 6(1)(f)).

To comply with legal obligations — for example responding to a lawful request from an authority, or meeting tax and accounting duties. Lawful basis: compliance with a legal obligation (Article 6(1)(c)).

To establish, exercise or defend legal claims. Lawful basis: our legitimate interests (Article 6(1)(f)).

Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests and rights, and we have concluded that they are not. You may object to that processing at any time: see section 11.

6. Meetings, live audio and video, and recordings

Live audio and video. When you join a live meeting, audio and video are transmitted using WebRTC. Where the network allows, the media stream travels directly between participants and does not pass through our servers. Where a direct connection cannot be established, the stream is relayed through a TURN server we operate. To establish connections, your browser contacts a public STUN server operated by Google (stun.l.google.com), which will see your IP address. We do not store the contents of live audio or video except where a meeting is recorded.

Recording. Only a Host can start a recording. Whenever a meeting is being recorded, a clear on-screen notice is shown to everyone in the room for the whole time the recording is running. The recording is captured in the Host's browser and uploaded to our object storage when the meeting ends.

Your choices. If you do not consent to being recorded, leave the meeting or turn off your camera and microphone. The Host who starts the recording is responsible for having any consent that the law of their country, or yours, requires, and for the lawful use of the recording afterwards. In some jurisdictions, including a number of United States states, recording without the consent of every participant is a criminal offence.

Access. A recording is available to the Host and to the Participants of that meeting. Recordings are stored in our object storage and delivered through a content delivery network.

7. Who we share data with

We do not sell your personal data. We do not disclose it to third parties for their own marketing. We share it only as set out below.

7.1 Other users of the Service

By design, the Service shares your data with the people you work with. Your name, profile photo and online status are visible to Hosts and Participants linked to you. Your messages are visible to the people you send them to. Content you add to a meeting is visible to the other people in that meeting.

7.2 Service providers acting on our instructions

Each provider is bound by a written agreement that restricts them to processing data on our instructions, except where that provider's own terms apply. We use the Amazon Web Services Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Google reCAPTCHA is subject to Google's Privacy Policy and Terms of Service; Google may process the data it collects for that service as Google describes.

7.3 Legal and safety disclosures

We may disclose personal data where we are required to do so by law, by a court, or by a competent authority; where it is necessary to investigate suspected fraud, abuse or a security incident; or where it is necessary to protect the rights, property or safety of any person. Where the law allows us to tell you about such a request, we will.

7.4 Business transfers

If our business or its assets are sold, merged or reorganised, personal data may be transferred as part of that transaction. We will tell you before your data becomes subject to a materially different privacy policy.

8. Cookies and similar technologies

The Service itself sets exactly one first-party cookie.

Because this cookie is strictly necessary to deliver a service you have expressly requested, it is exempt from the consent requirement under regulation 6(4) of PECR and under Article 5(3) of the ePrivacy Directive. We therefore do not show a cookie banner.

Google reCAPTCHA (sign-up only). When you create an account, or ask us to resend the sign-up code, your browser loads a third-party script from Google (www.google.com / www.gstatic.com). There is no checkbox. Google scores the interaction in the background and shows a small reCAPTCHA badge on that form. The badge is not shown once you are signed in. Google may set its own cookies and may collect device data, browser data and your IP address to tell humans from bots. Those cookies and that collection are Google's, not ours. We do not read Google's cookies, we do not use them for advertising or analytics of our own, and we do not combine them with a profile of you on Cactus Class. If Google's score is too low, we will not create an account or send a sign-up code. Google's use of the data is described in Google's Privacy Policy and Terms of Service.

We use no analytics cookies, no advertising cookies, no tracking pixels, no web beacons, and no device fingerprinting of our own. Your browser may also store data locally to keep the interface working; that data stays on your device.

9. International transfers of data

We are established in the United States and our users are located around the world. Our object storage, our email sending, and our MySQL database (Amazon RDS) operate in the Amazon Web Services Europe (London) region. Content delivered through CloudFront is cached at edge locations worldwide. Our application server and TURN relay are located in London, United Kingdom.

This means personal data of users in the United Kingdom, the European Economic Area and elsewhere is transferred to, and accessed from, the United States and other countries that may not provide the same level of protection as the law of the country where you live.

Where we make such a transfer, we rely on one or more of the following safeguards:

• the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum to those clauses, as incorporated into our agreements with our providers;
• an adequacy decision, where one covers the receiving country;
• your explicit consent or the necessity of the transfer for the performance of our contract with you, where Article 49 applies.

You may ask us for a copy of the safeguards we rely on by writing to support@cactusclass.com.

10. How long we keep data

Because chat history is shared, deleting your account does not erase messages you sent from the copy held by the person you sent them to, in the same way that deleting an email does not remove it from the recipient's mailbox. We explain how to request erasure in section 11.

11. Your rights

11.1 If you are in the United Kingdom or the European Economic Area

Under the UK GDPR and the EU GDPR you have the right to:

• be informed about how we use your data, which this policy is intended to do;
• access the personal data we hold about you, and receive a copy;
• rectification of data that is inaccurate or incomplete — you can correct your name, email and photo yourself in your profile;
• erasure of your data in the circumstances set out in Article 17 — you can delete your account yourself from your profile page;
• restrict our processing in the circumstances set out in Article 18;
• data portability — to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible;
• object to processing we carry out on the basis of legitimate interests, on grounds relating to your particular situation;
• not be subject to a decision based solely on automated processing that produces legal effects concerning you. We do not carry out such processing.

We do not rely on consent for the processing described in section 5. Where we ever do, you may withdraw it at any time without affecting the lawfulness of what came before.

To exercise a right, write to support@cactusclass.com. We will respond within one month. We may extend that by two further months for complex requests, and we will tell you if we do. We may ask you to confirm your identity first. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

Complaints. You can complain to a supervisory authority. In the United Kingdom this is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, https://ico.org.uk/make-a-complaint/. In the European Economic Area it is the authority in the country where you live, work, or where the alleged infringement took place. We would be grateful for the chance to resolve your concern first.

11.2 If you are in California

Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect, use and disclose; the right to delete it; the right to correct inaccurate information; the right to opt out of its sale or sharing; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising any of these rights.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not collect sensitive personal information as the CPRA defines it, other than account credentials, which we use only to authenticate you. We have not sold or shared personal information in the preceding twelve months, and we do not knowingly sell or share the personal information of anyone under 16.

The categories we collect are set out in section 4, our purposes in section 5, our disclosures in section 7, and our retention periods in section 10. To exercise a right, write to support@cactusclass.com. You may use an authorised agent, in which case we will ask for proof of their authority.

11.3 If you are elsewhere in the United States

Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah and Texas, have rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale and profiling. We do not carry out targeted advertising, sale or profiling. To exercise a right, or to appeal a decision we make about a request, write to support@cactusclass.com.

11.4 Everyone else

Wherever you live, you may ask us for a copy of your data, ask us to correct it, or ask us to delete it, and we will deal with your request in the same way and to the same standard.

12. Email we send you

We send one kind of email: the six-digit code you request when you sign up or sign in. We do not send marketing, newsletters, account notices or notices of changes to this policy by email.

These are transactional messages, not marketing. They contain no promotional content. Each message includes a List-Unsubscribe header of mailto:support@cactusclass.com?subject=unsubscribe. We monitor that mailbox. Mail with that subject is treated as a request to stop sending: we suppress the address permanently, the same as a complaint. That may prevent you from signing in, because the code is the only way in. You can also delete your account from your profile page, which stops all sending to that address.

If an email to your address hard-bounces, or if you mark one of our messages as spam, we likewise suppress your address and stop sending to it.

13. Security

• Sign-in codes are never stored in readable form; we keep only a salted, irreversible hash.
• Codes expire after 10 minutes, a new code cannot be requested more than once a minute, five wrong attempts invalidate the code, and we cap how many codes we send per email (5 per hour, 15 per day) and per IP address (10 per hour, 30 per day).
• Before we send a code we refuse disposable mail domains and addresses whose domain has no MX or A/AAAA record, so undeliverable addresses never reach the mail service.
• Sign-up and resend of the sign-up code use Google reCAPTCHA (invisible scoring; we reject scores below 0.5). The badge is not shown in the signed-in app.
• Session tokens are cryptographically signed; the cookie is HttpOnly, Secure and SameSite=Lax, so scripts in your browser cannot read it.
• All traffic between your browser and our servers is encrypted with TLS.
• Stored files are served over HTTPS; direct links to storage are time-limited where they are used.
• Access to production systems is limited to the people who need it.
• Repeated failed sign-in attempts lock an account.

No system is perfectly secure. We cannot guarantee the absolute security of data transmitted to us, and you send it at your own risk. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority, including the Information Commissioner's Office where the UK GDPR applies, within 72 hours of becoming aware of it, and we will notify you without undue delay where the breach is likely to result in a high risk to you.

14. Children

The Service is not intended for children. You must be at least 18 to open an account on your own behalf.

A person aged 13 to 17 may use the Service only through an account opened and supervised by a parent or legal guardian who accepts our Terms and Conditions on their behalf and remains responsible for their use of it.

We do not knowingly collect personal data from anyone under 13. If we learn that we have, we will delete it promptly. A parent or guardian who believes a child under 13 has given us personal data should write to support@cactusclass.com.

15. Automated decision-making

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not profile you.

16. Links to other sites

The Service may contain links to sites we do not control. This policy does not apply to them. Read their own privacy notices before giving them your data.

17. Changes to this policy

We may update this policy. The date at the top always shows when it last changed. If a change is material, we will tell you by a notice in the Service before it takes effect. Continuing to use the Service after a change takes effect means you accept the updated policy.

18. How to contact us

For any question about this policy, or to exercise a right:

Email: support@cactusclass.com Post: Finteka, LLC, 1111B S Governors Ave, STE 39180, Dover, DE 19904, United States

We aim to reply within 5 working days, and in all cases within the period the law requires.