This is a great question!
Curipod is indeed GDPR compliant, and here is an easy to grasp overview of the most important things we have done to make sure we are compliant.
All data is stored and processed within EU.
We use data centres provided by Microsoft Azure (Ireland) and Google Cloud (Ireland)
All our third party sub processors store and process data within EU
If you decide to delete your account, you can do so and within 30 days all your data is completely deleted.
A DPA (data processing agreement) can be requested when a school or similar organisation is rolling out Curipod to all teachers and students