Privacy notice

Your tutor decides what is recorded about your child and their lessons. In data protection law they are the controller of that data. Tutoring stores and processes it for them, following their instructions: we are their processor.

For your account itself (your login, email address and the record that you accepted these terms) and for keeping the service secure, Tutoring is the controller.

This split is [to be confirmed by a lawyer]. Our contact details for privacy questions: [email address and postal address to be added].

About your child, only what lessons need:

• their first name
• their year group (optional)
• the short notes your tutor writes after each lesson
• their lesson times and whether each lesson happened

We only ask for a child's first name. Where a full name is shown, such as in your tutor's calendar, it is their first name with your family name. We never ask for a child's date of birth, school, photo or address, and children don't have logins.

About you:

• your name, email address and, if your tutor adds it, phone number
• your login (your password is stored only as a secure scrambled code that can't be turned back into it)
• the credit on your family's account: payments, lesson charges and corrections
• requests you make to move or cancel a lesson, and any message you add
• a record of when someone looks at, downloads or deletes your child's details (who and when, not what was seen)

Card details are entered on Stripe's payment page and go straight to Stripe. We never see or store your card number.

To provide the tutoring you've arranged: showing lessons, sending reminders and calendar updates, taking payments and keeping track of credit, and sharing lesson notes with you. The legal basis is that it's needed to carry out the contract between you and your tutor (and, for your account, between you and us) [to confirm].

We don't send marketing, we don't sell data, we don't use it to train AI and we don't run adverts or tracking. If that ever changes, we'll ask for your separate consent first.

The database is hosted in the European Union, in Stockholm, Sweden, by Supabase. Data is encrypted while it travels over the internet and while it is stored.

These companies handle data for us, each under a data processing agreement [agreements to be signed]:

• Supabase: database and logins.
• Stripe: card payments, into your tutor's own Stripe account. Stripe also has its own duties as a payment provider.
• Email provider: sends reminders and notices. [provider to be chosen]
• Website hosting: runs this website. [provider to be chosen]

Some of these companies are based in, or have staff in, the United States. Where data could be accessed from outside the UK and EU, the agreement must include the legal safeguards the law requires [transfer safeguards to be checked for each provider]. Nobody else gets your data.

You can add your lessons to Google, Apple or Outlook calendar with a private web link. Each lesson in it shows your child's first name, the time, your tutor's name and lesson link, and a link back to this website. Lessons in person show the address and any access notes instead of the lesson link. It doesn't include lesson notes, payments or anyone's contact details. Anyone who has the link can see these details, so treat it like a password: don't share it outside your family. Your calendar app keeps a copy of the lessons it has fetched.

Your tutor has their own private calendar link for all their lessons. It shows each student's first name with the family name, their year group, and the same lesson details.

The link is part of the web address, so our hosting provider's technical logs may record it when your calendar app fetches it. If you think the link has got out, make a new one from your family page: the old one stops working straight away.

• While your family has lessons with a tutor, we keep what's listed above.
• When a tutor ends their work with a family, the family's personal details (names, contact details, lesson notes and messages) are deleted automatically 12 months later. Your tutor can delete them sooner.
• Money records (payments, charges and corrections) are kept for 6 years, with names removed, because tutors may need them for tax and accounts [period to be confirmed].
• When you delete your account, your login and contact details are removed straight away.
• Backups are overwritten on a rolling schedule [backup period to be confirmed].

• See and copy your data. Signed in, go to Your account and download everything held about your family.
• Correct it. Ask your tutor: they can change names, year groups, emails and phone numbers.
• Delete it. You can delete your own account from Your account at any time. To have your child's details deleted too, ask your tutor, who can do it from your family page.
• Object or restrict. Ask your tutor first; you can also contact us.
• Complain. If you're unhappy with how your data is handled, tell your tutor or us. You can also complain to the Information Commissioner's Office (ICO), the UK regulator: ico.org.uk or 0303 123 1113.

As the controller of your child's data, your tutor is the first person to ask. If they can't help, we'll help them respond.

We only use cookies that are essential to keep you signed in and the site secure. There are no analytics, advertising or tracking cookies, which is why we don't show a cookie banner.

Access to children's details is limited to their tutor and their family and is recorded. If there's a data breach that puts you at risk, we'll tell your tutor, report it to the ICO within 72 hours where the law requires it, and tell you without delay.

If we change this notice in a way that matters, we'll tell you by email or when you next sign in. The version above changes each time.