Privacy Policy

1. Overview & Data Controller

Tutevia ("we", "our", or "us") is committed to protecting the privacy and personal data of our users. This Privacy Policy explains how we collect, store, process, and share personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For data protection inquiries, you can reach our team at help@tutevia.co.uk.

2. Information We Collect

• Clients & Parents: Name, email address, student academic year/subject requirements, and billing records.
• Tutors: Name, contact email, profile photograph, subject expertise, academic credentials, and Stripe Connected account IDs.
• Booking Records: Session times, Cal.com booking references, and transaction histories.
• Technical Data: IP addresses, browser types, and standard server log data collected when navigating the Platform.

3. How We Use Your Data

• Service Delivery: To facilitate lesson scheduling, manage calendar synchronisation, and process secure payments.
• Safeguarding & Communication: To generate verified introductory email threads between Tutors and Parents.
• Dispute Resolution: To verify attendance and process refunds or payouts via our automated webhook infrastructure.
• Legal Compliance: To maintain accurate tax and accounting records in compliance with UK law.

4. Third-Party Service Providers (Data Processors)

We rely on secure third-party processors to operate our automated infrastructure. Your data may be handled by:

• Stripe: Secure payment processing and tutor bank payouts via Stripe Connect. We never store raw debit/credit card numbers on our servers.
• Supabase: Encrypted cloud database infrastructure for maintaining user accounts and booking states.
• Cal.com: Interactive scheduling infrastructure and calendar event dispatching.
• Netlify: Cloud hosting, serverless functions, and secure webhook routing.

5. Children's Privacy & Safeguarding

Tutevia is designed for use by parents, legal guardians, and adult students. We do not knowingly collect personal data directly from children under 16 without verifiable parental consent. All correspondence and booking arrangements for minors must be managed through the registered parent or guardian.

6. Data Retention & Security

We retain transaction and booking data only for as long as necessary to satisfy accounting obligations, resolve disputes, and comply with UK statutory retention periods. We implement SSL/TLS encryption across the platform and enforce strict access controls on database records.

7. Your Rights Under UK GDPR

Under UK data protection law, you hold rights regarding your personal information, including:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure: Request deletion of your personal data where retention is no longer legally necessary.
• Right to Complain: You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.