Privacy Policy

1. Who we are & our roles

For a tutor's own account data, the data controller is Rewarding Learning Ltd. Contact: privacy@tutor-desk.com (registered office available on request).

Where a tutor uses TutorDesk to manage information about their students and parents/guardians, the tutor is the data controller for that information and we act as their data processor (see our Data Processing Agreement).

2. Data we collect

• Tutor account: name, email, password (stored only as a bcrypt hash), business/trading name, approximate number of students, subjects.
• Operational data the tutor enters: students' names, year/grade, subjects, contact details, parent/guardian names and emails, lessons, homework, grades, invoices, payments, messages and uploaded files.
• Portal accounts: a student's or parent's email and a bcrypt-hashed password used to access their portal.
• Technical data: limited security logs such as IP address and timestamps for rate-limiting and abuse prevention (e.g. failed login attempts), automatically purged within ~1 hour.

3. Children's data

TutorDesk is used by tutors to record information about students, who may be children. The tutor is responsible for having a lawful basis (and, where required, parental consent) before entering a child's data. We process it only to provide the Service to the tutor, and we do not use children's data for marketing or profiling.

4. How we use data & lawful bases

• Providing and operating the Service — performance of a contract.
• Securing accounts and preventing abuse — legitimate interests.
• Sending essential service emails (verification, password reset, account notices) — performance of a contract / legitimate interests.
• Retaining certain communications for safeguarding and to defend legal claims — legitimate interests / legal claims (UK GDPR Art. 17(3)(e)).
• Complying with legal obligations (e.g. tax records for invoices).

5. Where your data is stored

Your core data (your database records and uploaded files) is stored in the United Kingdom (London region). We use trusted sub-processors:

• Supabase — database, authentication and file storage (UK / London region).
• Resend — transactional email (verification, resets, notices).
• Vercel — website & application hosting and privacy-friendly, cookieless analytics.
• Stripe — card payments, if/when you subscribe to a paid plan.

Some of these sub-processors (for example email, hosting and payments) may process limited personal data outside the UK. Where that happens, we rely on appropriate safeguards — such as UK adequacy regulations or the UK International Data Transfer Agreement/Addendum — to keep your data protected to UK standards.

6. Data security

We use HTTPS encryption in transit, per-account database isolation (row-level security), bcrypt-hashed passwords, short-lived signed URLs for file access, and rate limiting on authentication. See our Security page for detail. No system is completely secure, but we work to protect your data and will notify you and the ICO of a personal-data breach where legally required.

7. How long we keep data (retention)

• Account data — kept while your account is active.
• A student's portal data & files — deleted when the tutor deletes the student; otherwise automatically removed once a student has been archived for 12 months, or has had no lesson for 18 months.
• Messages between tutors, students and parents — retained for up to 3 years to support safeguarding and the defence of legal claims, then deleted.
• Inactive free accounts — we email a warning after 12 months without sign-in and delete the account 30 days later if it remains inactive.
• Security logs (IP/timestamps) — automatically purged within ~1 hour.
• Invoices/financial records may be retained for up to 6 years to meet tax obligations.

When an account is deleted, we erase its data — including students, lessons, invoices, portal accounts, messages and uploaded files. You can export your data first (see your rights below).

8. Your rights

Under UK GDPR you can access, rectify, erase, restrict or port your personal data and object to certain processing. Tutors can export all their data and delete their account at any time from Settings. To exercise any right, contact privacy@tutor-desk.com. If a tutor holds your data (you're a student or parent), please contact that tutor (the controller); we'll assist them as processor. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

9. Cookies & local storage

We use essential browser storage (e.g. localStorage) to keep you signed in and remember preferences. Our analytics (Vercel) is cookieless and does not track you across sites. We do not use third-party advertising cookies.

10. Changes

We may update this policy from time to time. Material changes will be notified within the Service or by email.

11. Contact

Questions? Email privacy@tutor-desk.com.