Privacy Notice
Last updated: 16 October 2026
Effective: 18 October 2026
1. Who is responsible
TutorBoost is the controller of the personal data described here. Contact us about privacy at privacy@tutorboost.org.
Stripe and PayPal act as independent controllers for the identity checks, bank details and payment data they collect themselves; their own privacy notices apply to that data. This notice covers TutorBoost’s website and app and adds to the Privacy Policy, which continues to apply to everything not described here.
2. What we use, why, and on what legal basis
| Purpose | Data | Legal basis (EU and UK) |
|---|---|---|
| Create and secure your account | Name, email, role, sign-in identifiers (through Clerk), IP address and device data for security | Contract; legitimate interests (security) |
| Publish and show tutor profiles; review applications | Profile text, photo, video, subjects, price, country, qualifications and documents you upload | Contract |
| Messaging, and screening messages for scams and abuse | Messages, screening results, reports | Contract; legitimate interests (safety, fraud prevention) |
| Book, pay for and refund lessons | Lesson time, price, service fee, commission, status, Stripe payment and refund identifiers; card details are handled by Stripe, not us | Contract; legal obligation (accounting) |
| Run the lesson room and decide attendance | Who joined and left the room and when, and your role; audio and video pass through LiveKit to the other person and are not recorded | Contract; legitimate interests (fair settlement of disputes) |
| Pay tutors | Stripe connected-account identifier, payout country, payout status; Stripe collects identity, bank and tax details itself | Contract; legal obligation |
| Tax reporting (EU tutors under DAC7, US tutors under IRS rules) | Name, address, date of birth, tax and VAT numbers, bank account identifier, earnings and fees | Legal obligation |
| Complaints, contested lessons, chargebacks and safety reports | Your report, the lesson and payment records, messages relevant to the report | Contract; legitimate interests (resolving disputes, defending claims) |
| Record your acceptance of terms and your early-start request | Document version, time, and the booking or account it relates to | Legal obligation; legitimate interests (proof of agreement) |
| Transactional email (bookings, cancellations, payouts, account) | Email address, message content and delivery events (through Resend) | Contract |
| Pro subscription and the advertising programme (tutors) | Subscription status, billing identifiers, ad briefs, creative, budgets, spend and results reported by Meta | Contract |
| Understand how the site is used and fix errors | Pages and actions, a 30-minute visit identifier, the advert or link that brought you (kept 7 days), error reports (Sentry), cookieless page statistics (Vercel) | Legitimate interests (running and improving the service); consent where the law requires it for cookies |
| Measure our own advertising on Meta, Reddit and in ChatGPT | Cookie identifiers, IP address, browser data, and a hashed email when you sign up | Consent in the EEA, UK and Switzerland; elsewhere legitimate interests, with an opt-out |
Where we rely on legitimate interests, they are the ones named in the table; you can object (section 8). Giving us account, booking and payout data is necessary to use those services; without it we cannot provide them. Tax data for tutors is required by law.
3. Lesson recording
We do not record the audio or video of lessons and do not allow recording through the lesson room. We record only attendance: when each person joined and left. Do not record a lesson by other means without the clear agreement of the other person.
4. Automated decisions
Two decisions are made automatically. First, after a lesson the room record decides whether the lesson went ahead, whether someone did not turn up, and therefore whether the tutor is paid or the student refunded (rules on Fees and Refunds). This is necessary to perform the lesson contract. Second, messages are screened and a message that looks like a scam or abuse may be refused or held for review. In both cases you are told the reason, and you can ask for a person to review the decision: contest a lesson outcome from your lessons page, or write to us.
5. Who receives your data
- The other person in a lesson: tutors and students see each other’s name, messages and booking details. Tutors’ public profiles are visible to everyone.
- Service providers acting for us: Clerk (accounts and sign-in), Supabase (database and file storage), Vercel (hosting and cookieless page statistics), Stripe (payments, refunds, payouts), LiveKit (lesson video rooms and attendance events), Resend (email), Sentry (error monitoring), Anthropic (only when a tutor uses the optional lesson-drafting tool), and, when it is switched on, PayPal (tutor payouts).
- Video providers: a tutor’s intro video is hosted by YouTube (Google), Vimeo or Loom. Nothing is loaded from them until you press play; when you do, the provider receives your IP address and browser details and may set cookies under its own privacy policy. YouTube videos use its privacy-enhanced mode (youtube-nocookie.com).
- Advertising platforms: Meta, Reddit and OpenAI receive measurement data as described in the Cookie Notice. Meta also receives the ad content and budgets for ads tutors ask us to run.
- Authorities: tax authorities (an EU Member State tax authority under DAC7, the US Internal Revenue Service), and police, courts or regulators where the law requires it or to protect someone’s safety.
- A buyer of our business, if TutorBoost is sold, under the same protections.
We do not sell personal data and we do not receive money for sharing it.
6. International transfers
TutorBoost is based in the United States, and our providers process data mainly in the United States. When you give us data directly from the EU, EEA or UK, it is collected by us in the United States. When we pass data from the EU, EEA or UK to a provider in a country without an adequacy decision, we rely on the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses and the UK addendum. You can ask us for a copy of the relevant safeguards.
7. How long we keep data
- Account and profile: while your account is open. After a deletion request, removed or anonymised except for the records below.
- Payment, refund, payout, commission and tax records: for as long as tax and accounting law requires, generally up to 7 years after the year of the transaction.
- Lesson, attendance, dispute and safety records: while needed to settle lessons, handle disputes and chargebacks, and defend legal claims, and for safety records as long as needed to protect others.
- Records of your acceptance of terms: for as long as the agreement lasts and the limitation period afterwards.
- Lesson room attendance events: 24 months after the lesson, which covers every card chargeback window.
- Usage statistics: 25 months. Our email delivery log: 90 days after sending.
- Visit identifiers and attribution cookies: 30 minutes and 7 days respectively; error reports and logs for the period set by the provider.
- Payment records past their legal period are anonymised rather than deleted, so the accounts still balance. A scheduled job applies these periods.
8. Your rights
Depending on where you live, you can ask to access, correct, delete or receive a portable copy of your data, to restrict or object to how we use it, and to withdraw consent at any time. You can:
- download a copy of your account data from Settings, Privacy, while signed in;
- request deletion of your account from the same page. A person reviews each request so that open lessons, payments and payouts are resolved first and only records we must keep are kept; we aim to complete it within 30 days;
- make any other request by emailing privacy@tutorboost.org. We may need to confirm your identity. We reply within one month (or 45 days where California law applies), and tell you if we need longer and why.
EU, EEA and UK: you can complain to the data protection authority where you live or work. In the UK that is the Information Commissioner’s Office.
California and other US states with privacy laws: you have the rights to know, delete, correct, and opt out of the “sale” or “sharing” of personal information and of targeted advertising, and not to be treated differently for using them. We do not sell personal information. Advertising measurement counts as “sharing” for cross-context behavioural advertising; you can opt out with Cookie settings in the footer of any page, and we treat a Global Privacy Control signal from your browser as an opt-out. You may use an authorised agent.
9. Adults only
TutorBoost is only for people aged 18 or over. If we learn that we hold data about someone under 18, we close the account and delete the data, except records we must keep for safety or by law. Tell us at privacy@tutorboost.org.
10. Security
We use encryption in transit, access controls, a payment processor that keeps full card details away from our systems, and monitoring. No system is perfectly secure; if a breach puts you at high risk we will tell you as the law requires.
11. Changes
We will post changes here with a new date, and tell you by email or in your account before a material change takes effect.