Privacy Policy

1. Controller and Scope

Effective date: August 14, 2026.

Aleksei Petrov, operating TutorPlan in Vienna, Austria ("TutorPlan", "we", "us"), is the controller for account, subscription, security, support, and product-operation data described in this notice. This policy applies to the TutorPlan app and related website and support services.

This is a privacy notice, not a contract or a request for blanket consent. Where a tutor enters personal data about students or parents, the tutor normally determines why that data is processed and TutorPlan acts as a processor on the tutor's behalf; see section 5.

2. Data We Process

Account and profile data

• name, email address, profile image, language, currency, week-start and notification preferences;
• account identifier, authentication provider, and authentication/session records supplied by email, Google, or Apple sign-in;
• referral code and referral relationship.

Content entered by the user

• student names or nicknames, contact details, profile photos, status, and group membership;
• lesson dates, subjects, recurrence, duration, status, notes, reminders, and lesson history;
• attachments uploaded to lesson notes, including their files and metadata;
• rates, balances, payment status, payment history, and calculated earnings/statistics.

Subscriptions and purchases

We receive product, entitlement, purchase, renewal, cancellation, expiration, refund, platform, and transaction identifiers from RevenueCat, Apple, and Google. TutorPlan does not receive full payment-card details.

Security, anti-abuse, and support

• IP address in security audit records;
• a one-way device fingerprint plus device model, operating-system version, and platform for referral-abuse prevention;
• referral activity dates, app-review prompt state, and feedback/support messages you submit;
• timestamps, record identifiers, and limited operational error information needed to diagnose a request.

We do not use third-party advertising SDKs, sell personal data, access your address book, or collect precise location. App notifications are scheduled for lesson reminders when enabled by you.

3. Purposes and Legal Bases

• Contract: create and authenticate your account; store, sync, display, export, and delete your data; provide reminders, statistics, subscriptions, purchase restoration, and support.
• Legitimate interests: secure accounts, prevent referral and payment abuse, keep a limited audit trail, diagnose failures, and improve reliability. We balance these interests against user rights and minimize retained data.
• Legal obligation: retain or disclose records where tax, accounting, consumer, or other law requires it.
• Consent: access optional photos/files and deliver notifications where the operating system or applicable law requires permission. You can withdraw device permission in system settings.

We do not make decisions producing legal or similarly significant effects solely by automated means.

4. Recipients and Service Providers

We disclose only what is necessary to operate the service:

• Supabase: database, authentication, server functions, and private file storage; primary project region Frankfurt, Germany (eu-central-1).
• RevenueCat: subscription entitlement and purchase lifecycle management.
• Apple and Google: sign-in, app distribution, in-app purchases, and platform notifications under their own policies; they may act as independent controllers for store transactions.
• Authorities or professional advisers: only where required by law or necessary to establish, exercise, or defend legal claims.

We do not sell or rent personal data and do not share it for cross-app behavioural advertising.

5. Student and Parent Data

For student, parent, and client data entered by a professional user, that user is normally the controller and instructs TutorPlan as processor to host, sync, display, export, and delete the data. We do not use this content for advertising or to contact students. Users must limit entries to information necessary for tutoring administration and handle rights requests from their students or parents. We will reasonably assist the account holder with deletion, export, security incidents, and data-subject requests.

6. Retention and Account Deletion

• account content is kept while the account exists and is deleted when the user deletes the account, subject to short-lived provider backups and legal obligations;
• security audit records are automatically deleted after 90 days;
• minimized RevenueCat webhook-event records are automatically deleted after 2 years and are deleted from our database when the related account is deleted;
• store and payment providers may retain transaction records independently where required for accounting, fraud prevention, or legal compliance;
• support correspondence is retained only as long as needed to resolve the request and meet legal obligations.

You can delete your account inside TutorPlan or follow the instructions on our Delete Account page. Deleting the app alone does not delete the account.

7. International Transfers

The main TutorPlan database and file storage are hosted in the EU. Some providers, including RevenueCat, Apple, or Google, may process data outside the EEA. Where TutorPlan transfers personal data to a country without an EU adequacy decision, we rely on an applicable transfer mechanism such as the European Commission's Standard Contractual Clauses and supplementary safeguards provided by the processor.

8. Your Privacy Rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent without affecting earlier lawful processing; and complain to a supervisory authority. We may need to verify your identity. Contact us using the address below.

If you are in Austria, you may contact the Austrian Data Protection Authority. You may also complain to the authority in your EEA country of residence or work.

9. Children

TutorPlan accounts are intended for tutors and other users able to enter into the applicable agreement, not for children to create directly. A tutor may enter limited information about a minor student only with appropriate authority and safeguards. If you believe a child created an account or data was entered unlawfully, contact us for review and deletion.

10. Security

We use encrypted network transport, private file storage, row-level access controls, least-privilege database functions, signed subscription webhooks, restricted administrative access, and scheduled data minimization. No system is completely secure; please protect your credentials and report suspected unauthorized access promptly.

11. Changes to This Notice

We may update this notice when the service, providers, or law changes. We will publish the new effective date and provide an appropriate in-app or other notice before a material change takes effect where required.

12. Contact

Aleksei Petrov, operating TutorPlan
Vienna, Austria
Email: tutorplanappteam@gmail.com