Privacy Policy
Tutor Track ("we", "us", "our"), operated by [legal entity name] of [registered address], provides online tutoring for children in Grades 1–6. This policy explains what personal information we collect, why, how we protect it, and the rights you and your child have. It is written to meet our obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Nigeria's Data Protection Act 2023 (NDPA), and reflects the heightened care required when handling children's data.
1. Who this policy is for
Our service is bought and controlled by parents and legal guardians. Children use the service only through an account a parent creates and consents to. We do not knowingly allow a child to create an account or provide personal information to us directly without parental consent.
2. What we collect
| Who | Data | Why |
|---|---|---|
| Parent | Name, email, mobile number, timezone, payment records (via Stripe — we never receive card numbers) | Account management, billing, scheduling, service messages |
| Child (student) | First name (and optional last name), age, grade, lesson work, scores, homework, attendance | Delivering and tracking the tutoring the parent purchased |
| Child + tutor | Audio/video recordings of every live session | Safeguarding, quality assurance, and dispute resolution |
| Tutor | Name, date of birth, nationality, contact details, government ID and a selfie, qualifications, payout details | Identity verification, safeguarding checks, and paying tutors |
3. Recording of live lessons
Every live tutoring session is recorded to secure cloud storage. Recording is a core safety feature, not optional — it protects both children and tutors. You consent to this recording when you create an account, and both participants are shown an on-screen notice and hear an audible announcement when recording begins. Recordings are accessible only to authorised administrators for safeguarding or dispute review, are never made public, and are automatically deleted after [90] days.
4. Our legal basis
We process personal information on the basis of the consent you give when creating an account, our need to perform the tutoring contract you enter into, and our legitimate and legal interest in keeping children safe (which underpins session recording and tutor identity checks). You may withdraw consent at any time by deleting your account (see section 8), subject to any records we must keep by law.
5. Who we share it with
We do not sell personal information. We share it only with service providers who help us run the platform, each bound to protect it:
- Stripe — payment processing (card data goes directly to Stripe; we never see or store it).
- Daily.co — live video and encrypted recording storage.
- Twilio / Africa's Talking — SMS verification and reminders.
- Paystack — tutor payouts.
- Our hosting provider ([hosting/region, e.g. OVH — Canada]).
Some providers are based outside your country, so your data may be processed abroad under contractual safeguards. [Confirm each provider's data-processing region and add cross-border transfer wording your lawyer approves.]
6. How long we keep it
- Account and lesson data: for as long as the account is active, then deleted within [30] days of account closure.
- Session recordings: automatically deleted after [90] days.
- Payment and tax records: retained as long as the law requires ([e.g. 6–7 years]).
- Tutor identity documents: kept only while a tutor is active, then securely deleted.
7. How we protect it
Data is transmitted over HTTPS, access is restricted by role (parents see only their own children; tutors see only assigned students), passwords are hashed, and recordings are stored by a specialist provider. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the sensitivity of children's data.
8. Your rights
As a parent you may, at any time, on your own and your child's behalf:
- Access — download a copy of all data we hold (Parent dashboard → Account → "Download my data").
- Correct — update your details in your dashboard, or ask us to fix anything you can't.
- Delete — permanently erase your account, your child's data and associated recordings (Parent dashboard → Account → "Delete my account").
- Withdraw consent — by deleting your account.
- Complain — to us first, and then to the Office of the Privacy Commissioner of Canada or the Nigeria Data Protection Commission.
9. Contact
Privacy questions or requests: [privacy@yourdomain]. Our data-protection contact is [name / role].
10. Changes
If we make material changes we will update the version above and notify account holders by email. Continued use after a change means you accept the updated policy.