Privacy Policy

The short version

TutorLab provides software and a tutor directory. We use personal data to operate accounts, profiles, enquiries, teaching records, payments, security and the features people request. We do not sell student or parent data, run advertising, or share one tutor's private records with another tutor. Email harry@trytutorlab.uk to ask a privacy question or exercise a data-protection right.

Who we are and our data-protection roles

TutorLab is operated in the United Kingdom by Harry Wright trading as TutorLab. Contact: harry@trytutorlab.uk. TutorLab is the controller for account administration, the public directory, parent enquiries, platform security, billing records and its own service analytics. A tutor is normally the controller for the student, parent and teaching records they choose to enter; TutorLab processes those records on the tutor's behalf to provide the service. Stripe and some other providers may act as independent controllers for activities they determine themselves, such as payment compliance and fraud prevention.

Personal data we handle

Tutor accounts and profiles: name, email, optional phone number, country, business and profile details, qualifications, availability, subscription and account status. Authentication is provided by Supabase; TutorLab does not store a plain-text password.

Student and teaching records entered by tutors: full name, year group, subjects, exam board, school where entered, rates, attendance, lesson and progress notes, homework and session history. Free-text fields could contain information about health, disability or special educational needs. Tutors must only enter what is necessary and must have an appropriate Article 6 basis and, where relevant, an Article 9 condition.

Parent and client data: names, email addresses, phone numbers, child details, enquiries, bookings, invoices, payment status and messages. After a parent messages a tutor we ask one optional question, what the lessons are for (exams, catching up or confidence). The answer is one of those three choices, never free text; it is saved with the enquiry and shown to that tutor so their reply can speak to it, and a parent can skip it. We show the people you are messaging when you are online and when you were last online, and you can turn off last seen in Settings.

Payments: Stripe handles card and bank details. TutorLab receives identifiers, status, amount, fee and limited display details, but not full card numbers. If Stripe asks for identity evidence, an uploaded document passes transiently through TutorLab server memory to Stripe; TutorLab does not persist the document in its database or filesystem.

Identity check: before TutorLab introduces a tutor to a family, it confirms the tutor's identity (Conduct of Employment Agencies and Employment Businesses Regulations 2003, regulation 19; lawful basis: legal obligation). Setting up payments does this through Stripe, free of charge, and a tutor never has to take a payment through TutorLab. TutorLab records the outcome, how it was confirmed and the date. A tutor who prefers not to set up payments can email harry@trytutorlab.uk to confirm their identity another way.

AI features: prompts, relevant teaching context and generated output for the feature a tutor invokes. Avoid unnecessary identifying or special-category information in prompts.

Technical and security data: request details, IP address, user agent, device/browser information, security events and a first-party pageview count. The pageview counter converts IP, user agent, host and day into a one-way daily pseudonymous hash; raw IP and user agent are not written to that analytics dataset. On the tutor directory, the town Cloudflare estimates from your IP address (city level only) is used during that page load to suggest a search and, when you have not chosen any filter, to list tutors in that town first. It is never stored and never filters out other tutors.

Purposes and lawful bases

Contract: creating and administering an account; delivering requested software, AI, invoicing and payment features; and providing paid plans.

Legitimate interests: keeping the service secure, preventing fraud and abuse, responding to support, improving the service with proportionate first-party statistics, operating and measuring the directory, sharing a parent's enquiry with a small number of tutors who teach the same subject and level so the family hears back quickly (the enquiry form says so before it is sent, and the parent can choose to send it to one tutor only), and handling ordinary business records, recording pseudonymous product events and errors on our own servers, and counting visits to the website without cookies (both described under service providers), to see where signing up, booking and paying go wrong and to fix bugs. We balance those interests against people's rights and honour objections where required.

Legal obligation: tax, accounting, regulatory and valid legal requirements.

Consent: Google Analytics, Microsoft Clarity session replay, PostHog cookies, sign-in identity and session replay in the browser, bounded signup attribution and optional marketing. Consent can be withdrawn at any time; none of these is used before it is given. A child-data privacy assessment and data protection impact assessment covering Clarity are on file.

For tutor-entered teaching records, the tutor decides and documents the lawful basis as controller; TutorLab acts on the tutor's instructions as processor except where it independently determines a purpose required to run or secure the platform.

Children and special-category data

TutorLab accounts are for tutors and parents, not student children, but teaching records often relate to children. We apply data minimisation, private-by-default records, access controls and heightened incident assessment. Tutors should tell parents or guardians how they use a child's information and should not enter unnecessary details. Health, disability, safeguarding, ethnicity, religion and similar information can be special-category data and needs both an Article 6 basis and an Article 9 condition. TutorLab does not use children's records for advertising or third-party model training.

Recipients and providers

Supabase provides database hosting and authentication. Cloudflare provides hosting, security, Turnstile and first-party Analytics Engine storage. Stripe provides subscription and connected-account payments, including the identity check that setting up payments involves. Resend provides transactional email. Links in our emails pass through Resend so we can count which emails get clicked and improve them; we do not use tracking pixels to see whether you open an email. Brevo has provided outreach delivery; promotional cold sends are currently paused. Groq processes prompts for AI features. Google Analytics provides optional analytics only after consent. Microsoft Clarity provides consent-gated session replay and heatmaps with sensitive input fields masked; a child-data privacy assessment and DPIA are on file. PostHog provides product analytics, session replay, heatmaps and error tracking from its EU cloud, so we can see where signing up, booking and paying get stuck, fix bugs and make pages easier to use. PostHog runs only after analytics is accepted: before you choose, and after you choose essential only, it collects nothing. Only after analytics is accepted, in the browser: a random analytics identifier in its cookies, the pages visited, the steps taken, clicks (including repeated clicks and clicks that do nothing), scrolling, page speed, errors the page hits, browser and device type, and a session replay: a reconstruction of the page and of the mouse, taps and scrolling, built from the page's structure, not a screen video. Everything typed into a form is masked in the browser before anything is sent, and so are email addresses, phone, card and account numbers and money amounts on any page; on signed-in pages (the tutor app and the parent hub) all text is masked, and message text and card and bank fields are never captured. Replay records each session where analytics is accepted, and never runs on pages opened from a private link (booking, payment, claim, removal, message and sign-in links), on internal admin pages, or on any page with card or bank fields, including while those fields are open inside another page: card pages are never recorded. Heatmaps show where on a page people click and how far they scroll, as positions only. When the page hits an error, its type and a short message are sent with personal details removed, so we can fix it. We also record the steps of searching, booking and paying with no personal details: the subject, level and kind of location searched and how many tutors were found (never the words typed), which filter was changed, the position of the tutor opened, the booking and onboarding step reached, and a payment as a band (under £25, £25 to £50, £50 to £100, over £100), never the amount. On our servers: events for the steps that matter (for example signing up, publishing a profile, saving a profile section, sending a request, a tutor replying and how long after the enquiry, a lesson being taught or paid for) and errors; the profile and reply events are sent only if that person accepted analytics. Both use a pseudonymous id (whether the account is a tutor or a parent, and its record number), never a name, email address or message text; booking, payment and sign-in links, record identifiers in links and email addresses are removed before anything is sent. Staff and test accounts are flagged so they can be left out of the figures. Choose essential only in the cookie banner, at any time, to stop PostHog's cookies, sign-in identity and replay; PostHog then collects nothing, and our own cookieless visit count stops too. You can also object by emailing harry@trytutorlab.uk. Automattic may receive a one-way email hash when a Gravatar URL is requested. Providers receive only the data needed for their task. We do not share personal data with advertisers or data brokers.

International transfers

Some providers may process data outside the United Kingdom. Where UK personal data is transferred to a country without UK adequacy regulations, the relevant controller must use an appropriate UK GDPR safeguard, such as the UK International Data Transfer Agreement or UK Addendum, and complete any required transfer risk assessment. Provider location, contractual role and transfer mechanism are reviewed in TutorLab's internal supplier register; contact us for current information about a particular provider.

Retention

Account and teaching records are generally kept while the account is active and then deleted or anonymised within 30 days of a valid closure request, except where a legal hold or another stated retention rule applies. Billing, invoice and tax records may be retained for six years after the relevant accounting period. Security logs are kept only as long as needed for security and incident response. The first-party pageview dataset is retained by Cloudflare Analytics Engine for up to three months. PostHog session replays are kept for 30 days and then deleted. PostHog analytics events are kept for up to 7 years unless deleted earlier on request; erasing an account deletes or anonymises the TutorLab record behind that id, so the events no longer point to a known person, and the events themselves are deleted by hand on request to harry@trytutorlab.uk. Unclaimed profile suppression data is retained so a removal or marketing objection is not accidentally reversed. Backup deletion follows the provider's normal secure rotation. Category-level periods and exceptions are maintained in the internal retention register.

Your rights and complaints

Depending on the circumstances, you may have rights to access, correct, erase, restrict or receive your personal data, object to legitimate-interest processing, and withdraw consent. Email harry@trytutorlab.uk. We may verify identity and clarify a request. We normally respond within one month and do not charge for a straightforward request.

You can also make a data-protection complaint at that address. We acknowledge complaints within 30 days, investigate without undue delay, provide appropriate updates and explain the outcome. You may complain to the Information Commissioner's Office at https://ico.org.uk or 0303 123 1113.

Security and incidents

Controls include HTTPS, encryption at rest where provided by our infrastructure, server-side authorization, row-level security, least-privilege service credentials, strict input validation, rate limits, bot controls, payment-webhook signature verification and security logging. No service can guarantee that an incident will never occur. We assess suspected personal-data breaches, record the decision, notify the ICO within 72 hours where required, and notify affected people without undue delay where the law requires it.

Cookies and similar technologies

Essential authentication and security storage operates without optional consent where the law permits. Google Analytics and Microsoft Clarity do not load, and PostHog uses no cookies or browser storage, unless analytics is accepted. TutorLab's cookieless first-party pageview counter does not write to the visitor's device and is described above. See https://www.tutorlab.uk/cookies to change analytics choices.

Changes

We update this notice when processing changes. Material changes will be brought to registered users' attention where appropriate. The date above is the current version date.