1. Scope of this policy
This Privacy Policy explains how TutorAI Marketplace ("we", "us", "the platform") collects, uses, stores, and protects the personal data of students who use our website and services to find tutors, book lessons, and learn. It applies whenever you create a student account, browse tutor profiles, book or attend a lesson, or otherwise interact with the platform as a student.
If you are a tutor, please also read our Privacy Policy for Tutors, which covers information specific to teaching on the platform.
2. Information we collect
Account information
When you register, we collect your name, email address, password (stored as a one-way hash, never in plain text), and role (student). You may optionally add a phone number, profile details, learning goals, current level, target level, and preferred learning style to help us match you with the right tutor.
Lesson data
We store records of the lessons you book — the tutor, subject, service, scheduled time, status, and any notes exchanged around a booking. This lets you track your history, manage upcoming lessons, and lets your tutor prepare relevant material.
AI-generated content
Lesson plans, quizzes, and homework generated by our AI features are linked to your student account so they can be shown back to you and your tutor. Where an AI provider (see "Third-party services" below) is used to generate this content, the lesson context sent to it is limited to what's needed to generate useful material — it is not used by us to build an advertising profile of you.
Video lessons
Live lessons run through an embedded video classroom. We record technical join/leave events (who joined, when, and for how long) to maintain accurate lesson history and support. Video and audio streams are transmitted peer-to-peer or through the video provider's infrastructure for the live session itself; we do not record video lessons unless a tutor's lesson recording feature is explicitly enabled and disclosed to you in advance, per our platform settings.
Chat messages
Messages you send to a tutor through the platform's messaging feature are stored so both parties can refer back to the conversation. Please don't share sensitive personal information (financial details, government ID numbers, etc.) in chat.
File uploads
Files you or your tutor upload as part of a lesson (documents, images, audio) are stored via our file storage provider and linked to the relevant lesson. Only you, your tutor, and, where necessary for support, platform administrators can access these files.
Cookies
We use strictly necessary cookies to keep you logged in, remember your language and currency preference, and protect the platform against cross-site request forgery. We do not use third-party advertising cookies.
Analytics
We may collect aggregated, non-identifying usage statistics (e.g. which pages are visited, general error rates) to improve the platform. Where any analytics tool is added in the future, this policy will be updated and, where legally required, your consent will be requested first.
3. How we use your information
- To create and manage your student account
- To match you with suitable tutors and process bookings
- To generate AI-assisted lesson plans, quizzes, and homework relevant to your lessons
- To process payments for the lessons you book
- To communicate with you about bookings, platform updates, and support requests
- To maintain the security and integrity of the platform
- To comply with our legal obligations
4. Third-party services
We rely on a small number of third-party services to operate the platform. Each only receives the data it needs to perform its function:
- AI providers (e.g. Ollama, Gemini, Claude, or OpenAI, depending on platform configuration) — process lesson context to generate lesson plans, quizzes, homework, and AI Assistant replies.
- Video classroom provider (Jitsi Meet, or 8x8 JaaS in production) — hosts the live video/audio session for your lessons.
- File storage provider (Google Drive) — stores lesson media and uploaded files.
- Payment gateways (Paystack, PayPal, Telr, Tinkoff) — process lesson payments. See "Payment processing" below.
We do not sell your personal data to third parties, and we do not share it for third-party advertising purposes.
5. Payment processing
When you pay for a lesson, your payment details are entered directly into our payment gateway's secure checkout — we do not store your full card number on our servers. We retain a record of the transaction (amount, gateway used, status, and a gateway reference) to maintain your payment history and handle refunds or disputes.
6. Data retention
We retain account and lesson data for as long as your account is active, and for [retention period, e.g. 3 years] after account closure to meet legal, accounting, and dispute-resolution obligations. Chat messages and lesson files are retained for the same period unless you request earlier deletion under "Your rights" below. Data required for tax and payment records is retained as required by applicable law.
7. Your rights (GDPR-ready)
If you are located in the European Economic Area, United Kingdom, or another jurisdiction with similar protections, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion of your data, subject to legal retention requirements (see "Account deletion")
- Restriction — request that we limit how we process your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to certain kinds of processing
- Withdraw consent — where processing is based on consent, withdraw it at any time
To exercise any of these rights, contact us using the details in "Contact for privacy requests" below. We will respond within the timeframe required by applicable law (generally 30 days).
8. Children's privacy
The platform is intended for use by students who meet the minimum age required by their local law to consent to online services, or with the involvement and consent of a parent or legal guardian where required. If you believe a child has provided us with personal data without appropriate consent, please contact us using the details below and we will take steps to remove it.
9. Security
We use industry-standard measures to protect your data, including password hashing, encrypted connections (HTTPS), CSRF protection on all forms, and access controls that limit staff access to personal data to what's needed to provide support. No system is 100% secure, and we encourage you to use a strong, unique password for your account.
10. Account deletion
You may request deletion of your account and associated personal data at any time by contacting us at the address below. We will delete or anonymize your data within a reasonable timeframe, except where we are required to retain certain records (e.g. completed payment transactions) for legal or accounting purposes. Deleting your account will cancel any upcoming lessons — please coordinate with your tutor(s) beforehand.
11. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We'll update the "Last updated" date above, and where changes are material, we'll notify you by email or an in-app notice.
12. Contact for privacy requests
For any question about this policy or to exercise your privacy rights, contact our privacy team:
Email: support@tutorai.example
Data controller: [Company legal name]
Registered address: [Registered business address]