Skip to content

Draft — under legal review. This text is a placeholder and may change before launch.

Privacy policy

Last updated

What we collect, why, where it's kept and how to delete it. We never sell your data or your families' details.

1. Who we are

TutorFlow is run by [PLACEHOLDER: legal entity name and ABN]. This policy explains what personal information we collect, why, where it's stored, and how you can see, correct or delete it.

2. What we store

About tutors (our customers): your name, email address, password (stored scrambled, never readable), business details you add (business name, ABN, logo, bank details for invoices, timezone, meeting link), and your subscription history. Card details are held by Stripe, not by us.

About students and parents (added by tutors):

  • student names, and parents' names and email addresses;
  • lesson times, rates, lesson notes and whether lessons are online;
  • invoices, amounts and payment status (card payments are processed by Stripe; we never see full card numbers);
  • homework instructions and files uploaded by tutors and parents;
  • a record of the emails sent to parents and whether they were delivered.

Technical information: basic logs (such as IP addresses and browser type) used to keep the service secure and working. We don't use advertising trackers.

3. How we use it

  • to provide TutorFlow: scheduling, reminders, invoices, homework and payments;
  • to send emails on a tutor's behalf to their families (reminders, invoices, homework links);
  • to bill tutors for their subscription and send account emails (receipts, trial reminders);
  • to keep the service secure, prevent abuse (for example, repeat free trials) and fix problems;
  • to answer messages sent through our contact form.

4. The Australian Privacy Act

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Tutors decide what information about their students and families goes into TutorFlow, and we handle it on their behalf. Tutors are responsible for telling families that they use TutorFlow and for having a lawful reason to collect their information. [PLACEHOLDER: confirm controller/processor wording and children's information]

5. Where data is stored

We use trusted service providers to run TutorFlow:

  • Supabase — our database and logins, hosted in [PLACEHOLDER: region, e.g. Sydney, Australia].
  • Cloudflare — hosts the website and stores homework files (Cloudflare R2), [PLACEHOLDER: storage location].
  • Stripe — processes subscription and card payments.
  • Resend — sends our emails, from the United States.

Some of these providers may store or process information outside Australia. Where they do, we take reasonable steps to make sure it's protected to the standard of the APPs. [PLACEHOLDER: list of overseas countries (APP 8)]

6. Who we share it with

Only the service providers above, to run TutorFlow — and authorities if the law requires it. We never sell personal information, and never use families' details for marketing.

7. How we keep it safe

  • All connections are encrypted (HTTPS).
  • Every record is locked to the tutor who owns it at the database level, so no tutor can see another tutor's data.
  • Links sent to parents are long, random, expire, and only work for one invoice or homework. We store only a hash of each link, not the link itself.
  • Homework files are private and only ever shared through short-lived signed links.

8. How long we keep it

  • Homework files are deleted 2 months after the tutor marks the homework reviewed.
  • Account data is kept while your account is open, and for [PLACEHOLDER: period] after it closes, unless you ask us to delete it sooner.
  • Billing records may be kept for [PLACEHOLDER: e.g. 5 years] to meet Australian tax law.

9. Access, correction and deletion

Tutors can see and correct their information in TutorFlow at any time, and download it from Settings. To delete your account and data, email hello@tutorflow.au from the email address on your account. We'll confirm and delete it within 30 days, except records we must keep by law.

Parents and students can ask their tutor to correct or delete their information, or contact us directly and we'll work with the tutor to do it.

10. Complaints

If you're worried about how we handle your information, please contact us first and we'll respond within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

11. Changes to this policy

We'll update the date at the top when this policy changes, and email tutors about significant changes.