Privacy Policy
ITworks Lessons · Effective 12 November 2026
1. Who we are
ITworks Lessons is a service operated by ITworks, an automation studio that builds internal systems for online schools (“we”). Contact: itworkscommunications@gmail.com.
We provide the service to online schools (“the School”) that engage us. For lesson data, the School decides why and how the data is used and acts as the controller; we process it on the School's behalf. For the teacher account data needed to run the connection (Zoom user ID, name, email, access tokens), we act as controller.
2. What the app does
A teacher who works with a School connects their Zoom account once. The app then receives information about meetings that teacher hosts, so the School gets an automatic record of each lesson (date, start and end time, how long the teacher and student were present together). The School uses this record to deduct prepaid lesson packages and to calculate teacher pay.
3. Data we collect
| Data | Source | Purpose |
|---|---|---|
| Teacher's Zoom user ID, account ID, name, email, user type | Zoom API after the teacher approves access | Identify which teacher connected and link meetings to them |
| OAuth access and refresh tokens | Zoom OAuth | Receive and verify meeting data. Stored encrypted (AES-256-GCM) |
| Meeting ID, meeting topic, meeting type, start and end time of meetings hosted by the teacher | Zoom webhooks and API | Record that a lesson took place and its duration |
| Participant display name, participant ID, join and leave time; participant email only if Zoom provides it | Zoom webhooks and API | Match the meeting to the School's student and measure attendance |
We never access recordings, audio, video, screen shares, chat messages, transcripts or files, and we do not request permissions for them. We do not use the data for advertising, profiling or training of AI models, and we never sell it.
4. Who receives the data
- The School the teacher works with, for lesson accounting.
- Service providers that host the service under data processing terms: Cloudflare (application hosting and database) and Supabase (the School's database).
- Authorities, only where required by law.
Meeting data of meetings that are not lessons of the School (for example private meetings) is not used and is deleted under the retention rules below.
5. Retention
- Raw meeting events: up to 180 days, then deleted.
- Lesson records (date, duration, teacher, student): as long as the School needs them for accounting and pay, under the School's own retention policy.
- Access tokens: deleted immediately when the teacher removes the app in Zoom.
- Connection record and raw events of a teacher who removed the app: deleted within 30 days, except lesson records the School must keep.
6. Legal basis
For teachers in the UK and EU, processing is based on the School's legitimate interest in accurate lesson accounting and on the performance of the agreement between the School and the teacher. Students' names and attendance are processed for the performance of their lesson agreement with the School.
7. Security
All traffic uses HTTPS (TLS 1.2 or higher). Every webhook is verified with Zoom's HMAC signature. Tokens are encrypted at rest. Access to the database is limited to ITworks staff who maintain the School's systems.
8. Your rights
You can request access to, correction or deletion of your data, or object to processing, by writing to itworkscommunications@gmail.com. You can disconnect the app at any time in Zoom App Marketplace → Manage → Added Apps → Remove. You also have the right to complain to your data protection authority (in the UK, the ICO).
9. International transfers
Our providers may process data outside your country. Where required, transfers rely on the providers' standard contractual clauses.
10. Changes
We will update this page and its effective date when the policy changes.