Privacy Policy

In the past 12 months we have collected the following CCPA categories of personal information ("PI"):

• A. Identifiers — name, email, account ID, IP address, device identifiers.
• B. Customer records — payment metadata (handled by Stripe; we never store full card numbers), billing address.
• D. Commercial information — bookings, transaction history, refunds.
• F. Internet/network activity — pages viewed, searches, click events, browser, device, basic analytics.
• G. Geolocation — approximate location from IP; for tutors, the city / ZIP / service-radius coordinates you provide.
• H. Audio / visual — profile photos and, during live sessions, voice and video streams transmitted via our video provider (we do not record sessions by default).
• I. Professional info — for tutors: bio, subjects, grade levels, hourly rate, years experience, awards.
• J. Education info — for students: grade level, subjects, learning goals, session reports, mastery levels, monthly progress reports. This is treated as student educational records.
• K. Inferences — topic mastery, AI-generated summaries and goals.
• L. Sensitive personal information (SPI) — account credentials, precise geolocation (only if you enable it), and education records of minors. We use SPI only for the purposes permitted by Cal. Civ. Code §1798.121 (operating the Service, security, and limited internal uses) and do not use it to infer characteristics about you.

• You, when you create an account, fill in profile fields, book sessions, send messages, or upload content.
• Parents, when they invite or link a student account.
• Tutors, when they submit reports, summaries, and goals about a student.
• Service providers (Stripe payment confirmations, Daily video session metadata, our email provider).
• Your browser/device automatically (cookies, log files — see our Cookie Policy).

• Provide, personalize, and operate the marketplace and live sessions.
• Process bookings, payments, refunds, and tutor payouts.
• Generate session summaries, monthly progress reports, and tutoring copilot suggestions (AI features).
• Authenticate users and prevent fraud, abuse, and platform misuse.
• Communicate with you about your account, sessions, and important policy updates.
• Comply with tax, legal, audit, and dispute-resolution obligations.
• Aggregate, deidentified analytics to improve the Service.

We do not use personal information for cross-context behavioral advertising, and we do not use student data to train third-party AI models.

We disclose PI only to the categories of recipients below, each bound by data-protection terms:

• Other users: the tutor you book, the student you tutor, and the parent linked to a student account.
• Service providers (processors): Stripe (payments), Daily (live video), Supabase (database and storage), Resend (transactional email), and our AI provider for lesson summaries / copilot. Each is contractually limited to performing services for us and may not sell or share PI.
• Authorities: when required by law, subpoena, or to protect rights and safety.
• Successors: in connection with a merger, acquisition, or asset sale, subject to equivalent privacy commitments.

We do not sell personal information for money, and we do not share it with third parties for cross-context behavioral advertising.

• Account profiles: while the account is active, plus up to 24 months after closure for audit/dispute defense.
• Booking and payment records: 7 years (tax/audit obligations).
• Session messages, reports, summaries, and mastery data: while the related student account is active; deleted on verified request.
• Server access logs and analytics: 13 months, then aggregated.
• Marketing email lists: until you unsubscribe.

Depending on where you live, you may have the right to:

• Know / access the PI we hold about you.
• Correct inaccurate PI.
• Delete PI we collected from you.
• Port a copy of your PI in a machine-readable format.
• Opt out of "sale," "sharing," or targeted advertising (we do none of these by default).
• Limit our use of sensitive personal information.
• Opt out of profiling for legal or significant effects.
• Appeal a denied request (VA, CO, CT, TX, FL).
• Be free from discrimination for exercising these rights.

Submit a request from your profile settings or email privacy@tutorfy.app. We will verify your identity using your account email and respond within 45 days (extendable once by 45 days). You may designate an authorized agent in writing.