1. Introduction

StudyGuru ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We take special care with children's data and comply with the ICO's Age Appropriate Design Code (Children's Code) to ensure young users are protected.

2. What Data We Collect

For Students (via Parent account):

• Name and date of birth
• Academic level and subjects of interest
• Learning needs and preferences
• Session history and progress
• Chat messages and whiteboard content from lessons

For Parents:

• Name, email address, and phone number
• Location (for tutor matching purposes)
• Payment information (processed securely via Stripe - we do not store full card numbers)
• Booking history and communications

For Tutors:

• Name, email address, phone number, and date of birth
• Profile information (bio, photo, subjects, qualifications, experience)
• Identity documents (passport, proof of address)
• Enhanced DBS certificate number and copy
• Bank account details for payouts (processed via Stripe)
• Session history and lesson reports

Automatically Collected:

• IP address and device information
• Browser type and operating system
• Pages visited and time spent on our platform
• Session attendance and participation data

3. How We Use Your Data

We use your personal data for the following purposes:

4. Session Recording and Monitoring

For safeguarding purposes and quality assurance, we record and store:

• Whiteboard content: Drawings, notes, and uploaded materials
• Chat messages: Text communications during lessons
• Session metadata: Start/end times, attendance records

This data is accessible to the Parent, Tutor, and StudyGuru staff (for complaints or safeguarding investigations). Whiteboard content is exported as PDF after each session.

We do not record audio or video of sessions. Video conferencing is provided via a third-party service and is not retained by StudyGuru.

5. Who We Share Your Data With

Between Users:

When a booking is made, basic information is shared between Tutors and Parents/Students:

• First name and last initial
• Profile information (for Tutors: bio, subjects, qualifications)
• Session history and lesson reports

Service Providers (Data Processors):

Legal and Safety Disclosures:

We may share personal data when required by law, to respond to legal process, or to protect the safety of our users. This includes reporting safeguarding concerns to appropriate authorities.

6. International Data Transfers

Your data is primarily stored on servers in the UK/EU (Google Cloud, London region). Some processing may occur outside the UK when using services like Stripe and Daily.co.

Where data is transferred outside the UK, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the ICO
• Adequacy decisions where applicable
• Binding corporate rules of our service providers

7. Data Retention

We retain personal data only as long as necessary for the purposes described. Our retention periods are:

After these periods, data is securely deleted or anonymised.

8. Children's Privacy

We comply with the ICO's Age Appropriate Design Code (Children's Code) and implement the following protections:

• Data minimisation - we only collect what's necessary for tutoring
• High privacy settings by default
• No profiling of children for marketing
• No targeted advertising to children
• Parental access to child's data
• Clear, age-appropriate privacy information

Parents can exercise data rights on behalf of their children at any time by contacting us at privacy@studyguru.co.uk.

9. Your Rights (UK GDPR)

Under UK data protection law, you have the following rights:

To exercise these rights, contact us at privacy@studyguru.co.uk. We will respond within one month. We may need to verify your identity before processing your request.

Note: Some data cannot be deleted where we have a legal obligation to retain it (e.g., financial records) or where it's necessary for safeguarding purposes.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure data storage with access controls
• Password hashing and secure authentication
• Regular security reviews and updates
• Staff training on data protection
• Incident response procedures

While we take security seriously, no method of transmission over the internet is 100% secure. Please keep your account credentials safe and contact us immediately if you suspect unauthorised access.

11. Cookies

We use essential first-party cookies to keep you logged in and remember your preferences. These are strictly necessary for the Platform to function and do not require consent.

We do not use third-party advertising or tracking cookies. We do not track users across other websites or sell data to advertisers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via email or a notice on our platform. The "last updated" date at the top will reflect when changes were made.

We encourage you to review this policy periodically.