Welcome to Digiklass! We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes what data we collect, how we use it, and how we protect it.
Digiklass is operated by Nutistu OÜ (registry code 14322776, Estonia). We are the data controller for this data within the meaning of GDPR Article 4(7).
Digiklass is a free web-based toolkit intended for the personal use of the registered user. The primary user group is teachers in their own teaching, but the tools are equally suitable for other private or small-scale events — for example, team activities at work, the programme of a party, a club's activities, or other similar situations. The user registers an account as a private individual using their email or Google/Microsoft account.
Session participants (e.g., players, respondents) do not create accounts in Digiklass and are not required to. A participant joins only via a link or session code shared by the user, predominantly anonymously or under a nickname of their own choice.
The user is responsible for ensuring that the data they enter (e.g., the names of persons in a list) is permitted to be entered under the applicable rules and law.
When you sign in with Google or Microsoft, we collect:
When you register with email and password, we collect:
To ensure account security, we collect:
To provide our services, we store content entered by the user or generated in their sessions:
We do not ask for or store from session participants email addresses, phone numbers, dates of birth, profile pictures, national identifiers, or other direct identifiers. For participants we only store what the participant themselves enters when starting the game/poll (e.g., a nickname), plus a technical session ID. In most tools, asking for the participant's name is optional and the user can turn it off.
When using the file collection feature with Google Drive or Microsoft OneDrive integration, we store:
We automatically collect:
We store in your device:
We implement the following security measures:
Hosting: Digiklass servers are located in the Opalstack hosting provider's Frankfurt (Germany) data centre. Data remains within the European Union.
Security updates and vulnerability management: We monitor security advisories for the libraries and server software in use and apply updates within a reasonable timeframe. Vulnerability tracking relies on public CVE databases. We do not perform regular external penetration testing — Digiklass is a free service intended for personal use.
Internal access: Access to the Digiklass system and databases is limited to Nutistu OÜ representatives for the purpose of system administration. In addition, the hosting provider (Opalstack) has technical access to the server infrastructure.
While we follow best practices, no system can guarantee 100% security.
If we become aware of a personal data breach (e.g., data leak, unauthorised access, loss or alteration of data), we will act as follows:
If you suspect that a personal data breach has occurred affecting the Digiklass system, please notify us immediately at mikk@nutistu.ee.
When loading pages, fonts and web frameworks are fetched from the following networks. They do not set cookies or collect personal data, but the service providers can see your IP address.
Some applications (Kuldvillak, Viktoriin, Kiirviktoriin) allow users to add YouTube videos. We use the youtube-nocookie.com domain, which does not set tracking cookies until the user actually plays a video.
Opalstack (a US-based company, with servers in Frankfurt, Germany) provides server hosting. Opalstack has technical access to Digiklass database files as part of the hosting service, but is not entitled to use the data for any other purpose.
We do not sell or rent your data. We only share data:
Under the EU General Data Protection Regulation (GDPR), you have the right to:
To exercise your rights, please contact us (see §15). You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee/en).
Backups: backups of databases and files are performed by Opalstack as part of the hosting service (see Opalstack documentation). Digiklass itself does not create additional backups. When an account is deleted, we remove the data from the production system; data in the host's backups expires according to their rotation schedule.
You may request deletion of your account and data at any time.
An account can only be created by users who are at least 13 years old, and by accepting the terms of service the user confirms their age.
Minors do not create accounts in Digiklass. When you use Digiklass together with minors (e.g., in class with students, in training, at a children's event, or in club activities) such that they take part in games or polls:
The user is responsible for ensuring that the use of the tools with minors complies with the applicable rules (e.g., the school's internal rules, instructions from the event organiser, notice to parents). If a user enters minors' real names into a list, we recommend first consulting with the responsible party and considering the use of nicknames or initials.
If your child's data has been entered into Digiklass and you wish to have it deleted, please contact us — we will delete the data without undue delay.
Digiklass only uses cookies strictly necessary for the service to function — we do not use tracking or advertising cookies:
Local storage (localStorage) is used on your device only to remember theme preferences (light/dark) and application card order — this data never leaves your device.
Because we only use strictly necessary cookies, we do not need prior consent for cookie use (EU ePrivacy Directive art. 5(3) exemption). You can manage cookies through your browser settings, but this may affect application functionality.
The primary Digiklass data (user account data, class lists, game and poll results) is hosted in Opalstack's Frankfurt (Germany) data centre — data remains within the European Union.
For third-party services that the user optionally chooses to use (Google OAuth, Google Drive, Microsoft Entra ID, OneDrive, jsDelivr/cdnjs/Google Fonts, YouTube), data may travel outside the EU (e.g., to the United States). Such transfers take place under the respective providers' standard contractual clauses and data protection frameworks. The user can decide whether to use these third parties — authentication is also available with email and password.
We may update this policy from time to time. We will notify you of changes by:
For questions or requests, please contact us at the email address above.
This Privacy Policy is governed by Estonian law and the EU General Data Protection Regulation (GDPR). The supervisory authority is the Estonian Data Protection Inspectorate (www.aki.ee/en), with which you have the right to lodge a complaint.