TutorFlow

1. Who processes your data

TutorFlow provides software used by independent tutors and tuition centres. For account, platform-security and subscription data, TutorFlow acts as a data controller. For student, guardian, lesson, homework, assessment and billing records entered by a tutor or tuition centre, that tutor or centre determines the educational purpose of the processing and is generally the controller; TutorFlow provides the platform used to process that information.

2. Data we process

Depending on how TutorFlow is used, data may include account name and email, organisation membership, student name, school/class information, guardian name/contact details, lesson schedules, attendance for group lessons, homework, assessments/grades, billing records, payment status and technical/security records needed to operate the service. TutorFlow should not be used to store unnecessary sensitive information.

3. Why we process it

Data is processed to provide and secure TutorFlow, authenticate users, organise teaching, show authorised parents information about their child, maintain billing records, provide support, comply with legal obligations and protect the service against misuse. Tutors and centres are responsible for having an appropriate lawful basis for the student and guardian information they enter.

4. Children and students

TutorFlow is designed so student records are created and managed by tutors/centres and guardian access is linked to the guardian email recorded for the student. Student data should be limited to what is reasonably necessary for tutoring administration. A child should not create a Teacher or Parent account.

5. Who can see data

Access is role-based. Centre admins can manage their organisation. Centre teachers are intended to see only teaching data assigned to them. Parents can access data linked to their own child. TutorFlow uses service providers needed to host and operate the application, including Supabase for application database/authentication, Vercel for hosting and Stripe where payment features are enabled.

6. Retention

Personal data is kept only for as long as reasonably necessary for the purposes for which it was collected, subject to legal, accounting, dispute-resolution and security requirements. Tutors and centres should archive or delete student records when they are no longer needed. Archive keeps the record; permanent deletion is intended to remove the student's TutorFlow records.

7. Security

TutorFlow uses authenticated accounts, role-based access, database Row Level Security, private file storage with signed access, HTTPS through the production hosting platform, and server-side handling of privileged credentials. No online service can guarantee absolute security, so users must protect passwords and devices and report suspected unauthorised access promptly.

8. Your rights

Subject to applicable law, individuals may have rights to information, access, correction, deletion, restriction, objection and data portability. Requests can be started from the Privacy & data rights page or, for signed-in users, from Settings. Identity may need to be verified before a request is completed.

9. Complaints

You may raise a privacy concern with the relevant tutor/centre or TutorFlow. You also have the right to lodge a complaint with the competent data-protection supervisory authority, including the Office of the Commissioner for Personal Data Protection in Cyprus where applicable.

10. Changes

This notice may be updated when the service or legal requirements change. Material changes will be reflected by an updated date and, where appropriate, an in-app notice.

Privacy Policy