Privacy Policy

1. Who is responsible for your data

Tutorition is run by TODO: registered company name, TODO: company number and country of registration, TODO: registered address. Under UK and EU data protection law we act in two different roles, and which one applies changes who you go to with a request:

• Student and class data — we are the processor. An institute (a tutoring center, academy or school) signs up, adds its students, writes its tests and decides how long to keep the results. It is the controller. We only do what it instructs, and we do not use its students' data to sell anything to anyone. Students should send requests to their institute first; if you send one to us, we pass it on.
• Institute accounts and our own site — we are the controller. That covers the person who signs the institute up, the staff logins they create, billing records, support emails, and visitors to our marketing pages.

Institutes that need a written data processing agreement (UK GDPR Article 28) can request one at privacy@tutorition.com. Our UK ICO registration number is TODO: ICO registration number.

2. What we collect

When an institute signs up

• Name, work email, password (stored only as an argon2 hash — we never see it), institute name and subdomain.
• Billing details, which Stripe holds. We store the subscription status, the amounts and the invoice links, never the card number.
• The usual server records: IP address, browser, and the times of requests, kept for security and debugging.

When an institute adds a student, teacher or counselor

• Name, email, role, class or batch, and (for students) whatever the institute chooses to record, such as target exam, grade level or target score.
• Everything they do in the product: attempts, answers, scores, time per question, practice sessions, study plans, AI tutor conversations, written submissions and their feedback, career assessments and reports, and counseling session notes.
• Notification preferences, and whether emails we sent were delivered.

Our website

Our marketing pages carry no advertising or analytics trackers. We set cookies only to keep you signed in and to remember whether you asked us to. See cookies.

3. Why we may use it (our lawful bases)

• To provide the service under a contract — running exams, marking them, showing results, sending the emails the product depends on, and taking payment.
• On an institute's documented instructions — everything we do with its students' data, including AI features it enables.
• Legitimate interests — keeping the service secure and free of abuse, fixing faults, and (for institute contacts only) telling you about changes to the product you pay for. You can object at any time.
• Consent — any marketing email we send you that is not about a service you already have. Consent can be withdrawn, and withdrawing it is as easy as giving it.
• Legal obligation — tax and accounting records, and responding to lawful requests.

4. AI features

When a feature uses AI, the relevant text is sent to our AI provider, processed, and the result returned and stored with the attempt or conversation it belongs to. Under our agreement with the provider, content sent through the API is not used to train models. Spoken explanations send the explanation text to our text-to-speech provider; the resulting audio file is cached so the same explanation is not generated twice.

AI output can be wrong. Nothing generated by these features is a decision about a person on its own: scores come from the answer key, and a career report is a counselor's tool, not a verdict. You are never subject to a solely automated decision with legal or similarly significant effects.

5. Who else sees it

We do not sell personal data, and we do not share it for advertising. We use the service providers below, each under a contract that limits them to our instructions:

We also share data where the law requires it, and if our business is ever sold or merged, in which case the buyer is bound by this policy and you will be told before anything changes.

6. Where data goes

Data is stored in the region the institute chooses. Some of the providers above are in the United States, so personal data may be transferred there. Those transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with encryption in transit and at rest.

7. How long we keep it

• Student work, attempts and results: for as long as the institute keeps its account, and for 30 days after it deletes them, so an accident can be undone.
• Account and login records: while the account is open, then 30 days.
• Billing and tax records: 7 years, because we have to.
• Server and security logs: 90 days.

When an institute closes its account, its data is deleted within 30 days apart from what we must keep for tax purposes.

8. Students under 18

Tutorition is sold to institutes, and students receive their logins from the institute they attend. We do not knowingly let a child create an account directly. In the UK and EU, an institute that enrolls a child under 13 must have parental consent or another proper basis, and must tell parents what it is using. In the United States, institutes acting as schools are responsible for their obligations under FERPA and COPPA, including parental notice where it applies; we act only on their instructions and we do not use student data for advertising or profiling.

If you believe a child's data is here without the right permission, email privacy@tutorition.com and we will remove it and tell the institute.

9. Your rights

Depending on where you live you can ask us to give you a copy of your data, correct it, delete it, restrict or stop a particular use, or send it to someone else in a portable form. You can also withdraw consent, and object to processing we base on legitimate interests.

• UK and EU: rights under the UK GDPR and GDPR, including a complaint to the ICO or your local supervisory authority. We would rather hear from you first.
• California: the right to know, delete, correct, and to opt out of sale or sharing — we do neither — and the right not to be discriminated against for asking.
• Other US states with privacy laws: the equivalent rights those laws give you.

If your account was created by an institute, send the request to the institute — it holds the data and can act immediately. Requests to us are answered within one month and cost nothing.

10. Cookies

We use a small number of cookies, all of them necessary for the product to work. There are no advertising or analytics cookies.

• tt_access and tt_refresh — keep you signed in. They are host-only, so each institute's site has its own separate session.
• tt_remember — remembers that you ticked “Remember me”, so your session lasts 30 days instead of ending when you close the browser.

The exam page also stores your answers in your browser so that a dropped connection cannot lose your work. That stays on your device and is cleared once the answers reach us.

11. How we protect it

• Every institute's data is separated at the database level, so one institute's queries cannot reach another's rows.
• Passwords are stored as argon2id hashes. We cannot read them, and neither can anyone who takes a copy of the database.
• Everything travels over TLS, and files are stored privately and served through short-lived links.
• Backups are encrypted and restores are tested.

No system is perfectly safe. If a breach affects your data and is likely to be a risk to you, we will tell the institute and, where the law requires, the regulator and you — within 72 hours of becoming aware of it.

12. Changes

If we change this policy in a way that matters, we will email institute administrators and show a notice in the product before it takes effect. The date at the top always tells you which version you are reading.

13. Contact us

TODO: registered company name, TODO: registered address. Privacy questions and requests: privacy@tutorition.com. Everything else: hello@tutorition.com.