Privacy notice
Version 1.1, effective 6 November 2026

Draft for pilot use. Review by a solicitor before relying on it.

# Privacy notice

This notice is for the **tutors, business owners and staff who use TutorMaestry**. It explains what we, **TutorMaestry** ([CONFIRM: address], ICO registration [CONFIRM: ICO registration number]), keep about you as the controller of that information.

**It does not cover your families' and pupils' data.** For that data you, the tutor, are the controller and TutorMaestry is your processor: the [Data processing agreement](/legal/dpa) covers it, and your own privacy notice tells your families how you use it.

## What we keep about you

- **Account details**: your name, email address, business name and contact details, and the role of anyone you add.
- **Sign-in information**: how you sign in (for example, your Google account email), and a record of significant actions in your account.
- **Plan and billing**: your plan, its dates, and payment references. Card details are handled by Stripe and never reach us.
- **Your agreement**: which versions of our terms and data processing agreement you accepted, when, and from which account.
- **Support**: what you tell us when you ask for help, and our replies.
- **Technical information**: error reports and service health, with personal data switched off.

## Why we use it, and our lawful basis

| What for | Lawful basis (UK GDPR) |
|---|---|
| Providing your account and the service, support, and billing | Contract (Article 6(1)(b)) |
| Keeping records of your agreement to our terms and of payments | Legal obligation (tax and accounting records) and legitimate interests (being able to show what was agreed) |
| Keeping the service secure, preventing misuse, and fixing faults | Legitimate interests |
| Telling you about your account: trial reminders, plan changes, changes to our terms, planned maintenance and incidents | Contract and legitimate interests |
| Occasional news about TutorMaestry | Only if you ask for it; you can stop at any time |

We do not sell your information or use it for advertising.

## Who we share it with

Only the suppliers on our [sub-processor list](/legal/subprocessors), for the purposes there, and anyone the law requires us to tell (for example, HMRC for tax records).

## Where it is kept

In your TutorMaestry instance, hosted in the EU (Paris). Some suppliers are in the United States; transfers are protected as described on the [sub-processor list](/legal/subprocessors).

## How long we keep it

- Account details: while your account is open, then deleted with the account (within 30 days of closing, with backups gone within a further 10 days).
- Billing and payment records: six years after the end of the financial year they relate to, as tax law requires.
- Records of your agreement to our terms: while your account is open and for six years after, in case of a dispute.
- Support conversations: while your account is open.

## Your rights

You can ask to see the information we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to receive a copy in a portable form. Write to [CONFIRM: support email]. We reply within one month.

If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.

## Changes

We publish any change here with a new version and date; for a change of substance we tell you in the app first.