Privacy Policy
How Tutorise collects, uses and protects personal data.
Contents
1. Who we are
Tutorise provides online tutoring and the booking portal at tutoriseuk.co.uk. For the purposes of UK data protection law, Tutorise is the data controller for the personal data described in this policy.
For any privacy question or request, contact privacy@tutoriseuk.co.uk.
2. What we collect
2.1 Information you give us
- Account details, name, email address, phone number (optional), year group, whether you are a parent or guardian, and the date you accepted our terms.
- Student details, name, year group, subjects, exam board, qualification type, current grade and target grade.
- Booking information, session type, requested times, availability and any notes you provide.
- Messages, anything you send through the portal's messaging feature.
- Profile photo, if you choose to upload one.
- Correspondence, emails, WhatsApp messages and other contact with us.
2.2 Information created by using the service
- Lesson records, attendance, session history, lesson reports and progress notes written by Tutors.
- Account activity, an audit log of significant actions, such as changes to roles, account status, bookings and moderated messages, together with who made them and when. We keep this to investigate problems and protect students.
- Technical data, IP address, browser type and timestamps, collected when you use the site.
2.3 Information from third parties
If you sign in with Google, Google tells us your name, email address, and profile picture where you have one. We do not receive your Google password. Google's own handling of that sign-in is governed by its privacy policy.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Performance of a contract |
| Matching students with suitable tutors | Performance of a contract |
| Scheduling, delivering and recording lessons | Performance of a contract |
| Sending lesson reports and progress updates | Performance of a contract |
| Invoicing and collecting payment | Performance of a contract |
| Keeping accounting and tax records | Legal obligation |
| Safeguarding students and investigating concerns | Legal obligation; substantial public interest (safeguarding of children) |
| Preventing fraud, abuse and duplicate accounts | Legitimate interests, protecting our service |
| Securing our systems and keeping audit records | Legitimate interests, security |
| Handling complaints and defending legal claims | Legitimate interests, establishing or defending legal rights |
| Marketing emails, if you have asked for them | Consent, withdrawable at any time |
Where we rely on legitimate interests, we have considered the impact on you and are satisfied our interests do not override your rights. You can ask us for more detail on that assessment.
4. Children's data
Our service is designed to be booked and managed by a parent, guardian or other responsible adult, who is the Account Holder. Where a student is under 18, we expect the Account Holder to register and to supervise their use of the portal.
We collect the minimum we need about a student to arrange and deliver tutoring: name, year group, subjects, exam board and grades. We do not knowingly collect more than that, and we do not use children's data for marketing or profiling.
If you believe a child has provided us with personal data without appropriate authority, contact us and we will delete it unless we are required to keep it for safeguarding or legal reasons.
5. Messaging and monitoring
Messages sent through the portal are not private between you and a Tutor. Tutorise administrators can read them. Messaging is not end-to-end encrypted.
We do this deliberately, so that we can protect students, investigate safeguarding and conduct concerns, resolve disputes about what was agreed, and comply with our legal obligations. It is one of the reasons we ask you to keep contact with Tutors inside the portal rather than moving to personal phone numbers or social media.
Messages may be retained after a conversation ends, and remain visible to administrators. Deleted or moderated messages may be retained in our audit records.
6. Who we share data with
We do not sell personal data, and we do not share it for third-party advertising. We share it only with:
- Tutors, the details needed to teach a student: name, year group, subjects, exam board, grades, session history and lesson reports. Tutors see only the students allocated to them.
- Supabase, our database, authentication and file storage provider.
- Vercel, our website hosting and content delivery provider.
- jsDelivr, a content delivery network that serves part of the portal's code. It will see your IP address when a page loads.
- Google, only if you choose to sign in with Google.
- Professional advisers, accountants or legal advisers, where needed.
- Authorities, the police, a local authority, or another appropriate body, where we are required or permitted to disclose, including where we consider a child may be at risk. In a safeguarding situation we may do this without your consent.
7. Where your data is stored
Our database, including all account, student, booking, lesson and message data, is hosted in the United Kingdom, in Supabase's London region (eu-west-2). It is not routinely transferred outside the UK.
Two qualifications, so this is accurate rather than merely reassuring:
- Our providers are US-headquartered companies. Their support and engineering staff may, in limited and controlled circumstances, access systems from outside the UK in order to maintain them. Where that happens it is covered by the safeguards in their data processing terms, including the UK International Data Transfer Addendum where required.
- Our website's static files are served from a global content delivery network, so the page itself may be delivered from a server near you. Those files contain no personal data.
8. How long we keep it
We keep personal data for as long as we need it for the purposes in section 3, and then delete or anonymise it. In practice:
| Account and profile data | For the life of your account, and 6 years after your last session |
|---|---|
| Student details, bookings and lesson reports | 6 years after the last session |
| Invoices and accounting records | 6 years after the end of the relevant tax year, as required by HMRC |
| Portal messages | 6 years after the last session |
| Audit logs | 6 years |
| Safeguarding records and concerns raised | Retained for as long as necessary, which may be a considerable period and in some cases indefinitely |
| Suppression list (people who asked not to be contacted) | Kept indefinitely, so we can continue to honour your request |
The 6-year periods reflect the time limit for bringing most contract claims in England and Wales, and HMRC's record-keeping requirements. We may keep data longer where there is an ongoing complaint, dispute, investigation or legal claim, and for as long as that continues.
9. How we protect it
- All traffic is encrypted in transit using HTTPS, and enforced with HSTS.
- Every database table is protected by row-level security, so users can only reach their own records. Signed-out visitors have no database access at all.
- Privileged fields such as account role and status cannot be changed by the account holder, only by an administrator, and changes are written to an audit log.
- Uploaded profile photos are stored in a private bucket and served through short-lived links, not public URLs.
- Administrative access is limited to the smallest number of people needed to run the service.
No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you directly where the risk is high.
10. Your rights
Under UK data protection law you have the right to:
- be told how your data is used, and get a copy of it;
- have inaccurate data corrected;
- have data erased, where we no longer need it and no legal obligation requires us to keep it;
- restrict or object to processing, including processing based on legitimate interests;
- receive data you gave us in a portable format;
- withdraw consent at any time, where we rely on it; and
- not be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions.
To exercise any of these, email privacy@tutoriseuk.co.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to verify your identity first, and where a request concerns a child we may need to confirm you have authority to make it.
Some rights are not absolute. We may need to keep certain records, safeguarding, accounting and audit data in particular, even after an erasure request, and we will explain why if that applies.
11. Cookies and local storage
We do not use advertising cookies, analytics cookies or third-party trackers.
The portal uses your browser's local storage to hold your sign-in session, so you stay logged in between pages. This is strictly necessary for the service to work and is not used to track you. Clearing your browser storage signs you out.
12. Changes to this policy
We may update this policy from time to time. The current version is always on this page with a "last updated" date. Where a change materially affects how we use your data, we will tell you by email.
13. Contact and complaints
For any privacy matter, contact privacy@tutoriseuk.co.uk.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk
This policy was prepared for Tutorise and has not been reviewed by a data-protection professional. Before taking real student data, have it checked, and confirm whether Tutorise needs to pay the ICO's annual data protection fee, which most organisations processing personal data are required to do.