Privacy Policy

1. Who We Are

Tutorioo is operated by Janzay LLC, a Wyoming limited liability company, trading as "Tutorioo" ("Tutorioo", "we", "us", "our"). For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Janzay LLC is the data controller.

Janzay LLC
30 N Gould St Ste 100, Sheridan, WY 82801, United States
Email: support@tutorioo.com

Because Janzay LLC is established outside the United Kingdom and processes personal data of individuals in the UK, we are subject to UK GDPR and the Data Protection Act 2018. You can contact us about any data-protection matter, or to exercise your rights, at support@tutorioo.com.

2. Information We Collect

Information you provide directly

• Account information: name, email address, date of birth, year group
• Student learning data: lesson history, quiz answers and scores, homework submissions, progress reports
• Payment information: subscriptions are handled by Paddle, our payment provider and merchant of record. We do not receive, process, or store any card or payment details — all payment data is held exclusively by Paddle under their own privacy policy.
• Communications: support requests, feedback, and emails you send us

Information collected automatically

• Technical data: IP address, browser type and version, device type, operating system
• Usage data: pages visited, features used, session duration, error logs
• Cookies: see our Cookie Policy and Section 9 below

2A. Special-category data

The service does not require, and does not ask the student to provide, any data described as a "special category" under UK GDPR Article 9 (or "sensitive personal information" under US state privacy laws) — including data about health, racial or ethnic origin, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, or data concerning sex life or sexual orientation.

However, because tutoring sessions involve free-text input from the student, content of that kind may incidentally appear in the student's answers, support messages, or uploaded homework — for example, where a science homework question concerns a health topic, or where a student volunteers information about their religion in a humanities answer.

Where Tutorioo processes special-category data only because the student has incidentally provided it during use of the service, we rely on Article 9(2)(a) explicit consent (in the form of the student's — or, for a child, the parent's — voluntary provision of that content for the purpose of receiving tutoring), and we limit our processing strictly to what is necessary to deliver the tutoring service. We do not use this content for advertising, profiling for non-educational purposes, or sale. If you would prefer that we not process such content, please avoid including it and contact us to have any incidental special-category content removed.

3. How and Why We Use Your Information

Under UK GDPR, we must have a lawful basis for each way we use your personal data. The table below sets out our processing activities and the legal basis for each:

4. Who We Share Your Data With

We do not sell your personal data. We share data only with trusted service providers ("processors") who help us operate our platform, and only to the extent they need it to provide their service to us.

Updates to this practice. We are in the process of reducing the personal data we send to Slack so that internal staff notifications contain only obfuscated identifiers rather than names and email addresses. We are also reviewing whether we can pin AssemblyAI processing to a European endpoint. These changes will be reflected in this table as they are deployed.

A note on Paddle

Paddle acts as our merchant of record, meaning Paddle is the legal seller for all subscription transactions. When you purchase a Tutorioo plan, your payment contract is with Paddle, who collects and processes your payment details under their own privacy policy and terms of service. We receive only a transaction confirmation and your subscription status from Paddle — your card details never pass through our systems at any point.

5. International Data Transfers

Our primary database and file storage are hosted in the United Kingdom (London region). However, some of the service providers listed above are based in, or process data in, the United States, so using them involves transferring some personal data outside the UK and EEA. The United States does not currently have an adequacy decision from the UK government.

We limit what is shared with each provider to what they need to deliver their service to us. For our AI providers, we send data only through their business/enterprise tiers, on which submitted content is not used to train their models. If you have questions about a specific provider or how your data is handled, contact us at support@tutorioo.com.

6. How Long We Keep Your Data

We retain different types of data for different periods:

When you delete your account, your personal data is deleted immediately. Some data may be retained longer if required by law (e.g., payment records for tax purposes).

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — ask us to delete your personal data
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time

To exercise any of these rights, contact us at support@tutorioo.com. We will respond within one month.

Parents and guardians may exercise these rights on behalf of their children by contacting us from the email address associated with their parent account.

You can also download a copy of your data directly from your account settings, and delete your account from the settings page.

8. Right to Lodge a Complaint

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

We would appreciate the opportunity to address your concerns before you contact the ICO, so please reach out to us first at support@tutorioo.com.

9. Cookies

We use strictly necessary cookies to operate our platform (such as authentication cookies). These do not require consent.

We also use optional analytics cookies (Google Analytics) and advertising cookies (Meta Pixel, Google Ads), which are only activated after you give consent via our cookie banner. The banner allows you to accept or reject all optional cookies at once, or use the "Customise" option to enable analytics and advertising cookies independently. You can change your preferences at any time by clicking "Manage Cookies" in the footer of any page.

For full details, see our Cookie Policy.

10. Children's Privacy

Tutorioo is intended for users aged 13 and over. The service is designed for students in UK secondary education and above. We take children's and young people's privacy seriously and design our service with their best interests in mind, in accordance with the ICO's Age Appropriate Design Code.

We do not knowingly collect personal data from children under 13

We do not knowingly collect personal data from children under the age of 13. Every account-creation path on Tutorioo asks for a date of birth and rejects the registration if the user is under 13. No account is created, and no personal data is retained, when a sign-up is blocked by this age check. There is no parental-consent pathway that would allow a child under 13 to use the service — the service is simply not available to anyone under 13.

If we learn that we have inadvertently collected personal data from a child under 13 (for example, because the user provided a false date of birth at sign-up, or because a parent or guardian notifies us), we will promptly delete that data and close the account. Please contact us at support@tutorioo.com if you believe an account on Tutorioo belongs to a child under 13.

Age 13 to 17

Students aged 13 to 17 may create their own accounts. They have the same data rights as adult users and can manage their own data through the platform. A parent or guardian may exercise those rights on the student's behalf by contacting us from the email address associated with the relevant parent account.

AI tutoring and students' data

Our AI tutoring service (see Section 11) processes limited student data to provide personalised lessons. Only the student's first name, year group, subject, and their quiz or homework answers are shared with the AI provider. No email addresses, dates of birth, full names, or other identifying information are sent to the AI. The AI does not retain student data between sessions.

What we do not do

• We do not use students' data for marketing or advertising purposes
• We do not profile students for commercial purposes
• We do not share students' data with advertisers
• We do not send students' personal identifiers (email, date of birth, full name) to AI providers
• Analytics cookies are not activated for any user without explicit consent

For more detail on how we keep students safe on our platform, including our AI content filtering, moderation policies, and reporting mechanisms, please see our Safety Policy.

11. Automated Decision-Making and AI

Tutorioo uses artificial intelligence to provide personalised tutoring. The AI is used to:

• Generate explanations tailored to the student's year group and subject
• Evaluate quiz and homework answers
• Provide hints and feedback
• Generate progress reports

These AI features assist in the educational experience but do not produce decisions with legal or similarly significant effects on students. The AI does not make decisions about school admissions, grading, or any consequential outcomes. All AI-generated content is supplementary educational material.

What we send to AI providers. To deliver the tutoring service, we send the following categories of information to our AI providers (currently Google Gemini as the primary provider and OpenAI as a fallback and for vision and speech-to-text; see the sub-processor table above for the complete list):

• The student's display name (typically a first name) and year group, so the model can address the student appropriately and generate age-suitable content.
• The subject, exam board, and curriculum context of the lesson.
• The student's verbatim answers to tutoring prompts, quiz questions and homework questions, and the conversation history of the active session.
• Uploaded homework images. When a student uploads a photo of handwritten work for marking, we send that image to the AI provider for optical character recognition (OCR) and assessment. We cannot reliably guarantee that an uploaded image does not incidentally contain the student's full name, the school's name, a date, or other content that the student has written on the page. Where students or parents do not want this information to leave our service, they should redact it from the page before uploading, or use the text-entry alternative where available.
• Voice recordings. Where students use the lecture-recording feature, the audio is sent to our speech-to-text provider for transcription. The transcript is then available to AI features that summarise the lecture or generate study notes from it.
• AI-generated observations and learning patterns about the student (see "AI inferences about your learning" below) are re-fed into AI providers when generating personalised study plans, audio recaps and similar features.

What we do not send to AI providers. We do not send: payment information; the student's date of birth; the parent's name, email or phone number; the student's legal name (where it differs from the display name).

AI training. We do not use student-submitted content to train AI models. We send data to our AI providers through their business/enterprise API tiers, on which submitted content is not used to train their models, and we select no-training and zero/limited-retention settings where a provider offers them.

Automated decisions. AI features at Tutorioo are educational personalisation tools. They do not produce decisions that have legal or similarly significant effects on the student (UK GDPR Article 22).

11A. AI inferences about your learning

AI inferences about your learning. To personalise the tutoring experience, Tutorioo's AI features generate inferences about each student over time — for example, which topics the student appears to find difficult, the student's apparent learning speed, the times of day at which the student studies most productively, and short narrative observations that summarise patterns the AI has noticed across recent sessions. These inferences are stored against the student's account and re-used by features such as study-plan generation, weekly review summaries, audio recaps, and adaptive question selection.

These inferences are an automated form of profiling under data protection law, but they are used only for the educational purpose of personalising tutoring. They do not produce decisions that have legal or similarly significant effects on the student.

Your rights over these inferences. A parent (or a student aged 13 or over acting on their own behalf where appropriate) can ask us to show what inferences we hold about a student, request correction of an inference the student believes is wrong, or request deletion of all stored inferences. Requests can be made by contacting support@tutorioo.com.

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (TLS/HTTPS).
• Field-level encryption at rest, in our primary stores, for sensitive personal data including:
  • legal names and display names;
  • dates of birth;
  • phone numbers;
  • IP addresses, user-agent strings, and device fingerprints;
  • free-text personal information you submit through support tickets, contact forms, affiliate-program profiles, invite flows, and email-delivery logs.
• Some fields are stored without field-level encryption by deliberate design, because the system cannot function correctly without them being directly readable:
  • email addresses, which we use as your account identifier and for operational routing (e.g. delivering the email itself);
  • your tutoring-session content (lesson transcripts, conversation history, and lesson-step data), which the AI tutor needs to read during the session;
  • pseudonymous identifiers issued by our payment processors (Paddle and PayPal subscription and customer IDs), which are pointers to records held by those processors rather than personal data themselves.
• Application-layer tenant isolation. For full transparency: rather than relying on database row-level security, we enforce strict per-family ownership checks in our application on every request, combined with the field-level encryption described above. This application-layer isolation is the control that keeps one family's data inaccessible to another.
• Regular security audits and monitoring.
• Access controls and authentication requirements.

While we take reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure.

12A. Real-time activity for support and safety

Real-time activity for support and safety. While a student or parent is signed in to the service, we record the page or screen they are currently viewing and the time they were last active. This information is used to (a) keep the session open while the user is active, (b) generate accurate study-time totals for parent reports, and (c) allow our support team to see the context of a problem when a user contacts us for help. The information is not used for advertising and is not shared with third parties for their own purposes.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through a notice on our platform. The "Last updated" date at the top indicates when the policy was last revised.

14. Contact Us

For any questions about this Privacy Policy or how we handle your personal data, please contact us:

Janzay LLC
30 N Gould St Ste 100, Sheridan, WY 82801, United States
Email: support@tutorioo.com