Privacy Policy

This Privacy Policy explains how [Company Name] ("NanoTutors", "we", "us") collects, uses and protects personal data when you use our website and tutoring services. We are the data controller responsible for your personal data. If you have any questions, contact us at [Contact Email].

1. Who we are

[Company Name] is a tutoring business registered in England and Wales, company registration number [Company Registration Number], registered address [Registered Address]. For any privacy matter you can reach us at [Contact Email].

2. The data we collect

• Account details: name, email address, role, and a password that is stored only as a secure one way hash, never as plain text.
• Student profiles, including data about children: curriculum country, level, and notes that help a tutor teach the student.
• Parent and guardian contact details: name, email and phone number where provided.
• Session and attendance records: lessons booked, scheduled times, join times and attendance.
• Billing records: the plan agreed for a student and the invoices generated from attended lessons. We do not collect card or bank details and we do not take online payments through this site.
• Learning materials: revision notes and practice papers prepared and reviewed by a tutor for a student.
• Contact form messages: the name, email, phone, country and message you send through our contact form.
• Limited technical data: an essential cookie used to keep you signed in. See our Cookie Policy.

3. How we use data and our legal basis

We process personal data under the UK GDPR. The legal basis depends on what we are doing:

• To provide tutoring and manage accounts: performance of a contract.
• To schedule lessons, record attendance and prepare progress materials: performance of a contract and our legitimate interests in delivering an effective service.
• To produce billing records: performance of a contract and our legal obligations for accounting.
• To respond to contact enquiries: our legitimate interests in answering you.
• To keep the service secure and working: our legitimate interests.

Where we rely on legitimate interests, we weigh them against your rights and freedoms.

4. Children's data and parental consent

Our service is for students, many of whom are children, and it is provided through a parent, guardian or school. Accounts for students who are minors are set up and managed with the involvement of a parent or guardian.

• We collect only the data needed to teach and support the child.
• A parent or guardian can access, correct or request deletion of their child's data by contacting us at [Contact Email].
• We do not knowingly activate accounts for children without the involvement of a parent, guardian or school.

5. Who we share data with

We share personal data only with service providers who help us run the service, and only as needed. These include:

• An email provider, to send account and lesson notifications.
• An AI provider, used by our staff and tutors to draft revision notes and practice papers. Every AI draft is reviewed by a human tutor before a student sees it, and students never have open or direct access to AI tools.

These providers act on our instructions under contract. We may also disclose data where the law requires it. We never sell your personal data.

6. International transfers

Some providers may process data outside the United Kingdom. Where they do, we rely on appropriate safeguards, such as a UK approved transfer mechanism, so your data stays protected.

7. How long we keep data

• Account, student profile, session, attendance and billing records are kept while the account is active and for a reasonable period afterwards to meet legal and accounting obligations.
• Contact enquiries are kept only as long as needed to deal with them.
• We delete or anonymise personal data when it is no longer needed.

8. Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you,
• ask us to correct data that is inaccurate or incomplete,
• ask us to erase data, where the law allows,
• ask us to restrict how we use your data,
• receive your data in a portable format,
• object to processing based on our legitimate interests.

A parent or guardian can exercise these rights on behalf of their child. To make a request, contact [Contact Email]. We may need to confirm your identity first.

9. Cookies

We use a single essential cookie to keep you signed in. We do not use advertising or tracking cookies. For details, see our Cookie Policy.

10. How we keep data secure

Passwords are stored only as secure hashes, access to personal data is limited to staff who need it, and our AI key and other secrets are held server side and never exposed to browsers. No system is perfectly secure, but we take reasonable steps to protect your data.

11. Complaints

If you have a concern, please contact us first at [Contact Email]. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk.

12. Changes to this policy

We may update this policy from time to time. When we do, we will post the updated version here with a new "Last updated" date.

13. Contact us

[Company Name], [Registered Address]. Email [Contact Email].