Privacy Policy

1. Who we are

The Service is operated by iTutorzz LLC, located at 1001 S. Main St., Ste 600, Kalispell, MT 59901, USA. For the purposes of applicable data-protection laws, iTutorzz LLC is the data controller of the personal information described in this Policy.

You can reach us about any privacy matter at info@itutorzz.com.

2. Information we collect

We collect information in three ways: information you (or a parent/guardian, tutor, or administrator) provide to us, information collected automatically when you use the Service, and information we receive from third parties you connect.

2.1 Information you provide

• Account & profile information — name, email address, password (stored only as a salted hash, never in plain text), phone number, gender, time zone, and an optional profile photo.
• Student information — for student accounts we also process grade/level and the lessons, subjects, and tutors assigned to the student.
• Parent / guardian information — for students under 18, we collect the parent or guardian's name, phone number, and email address so the account can be managed and supervised by an adult (see Section 4).
• Tutor information — for tutor accounts we also process a display/classroom name, a referral code, lesson pricing, and a record of lessons taught and earnings. Payout bank details are handled outside the Service and are not stored in the application.
• Content you create — chat messages exchanged with your tutor or student, files you attach to messages (images and PDFs), lesson notes, attendance records, lesson proposals, and any messages or attachments you submit through our support ticket system.
• Communications — when you contact support or email us, we keep your messages and our responses.

2.2 Information collected automatically

• Device & log data — IP address, browser type and version, device type, operating system, and the approximate date/time of access. We log a portion of this on sign-in attempts to protect accounts against unauthorized access.
• Usage data — pages or screens viewed, features used, and general interaction data, used to operate, secure, and improve the Service.
• Session cookies — a single first-party cookie used to keep you signed in (see Section 8).
• Push notification tokens — if you enable notifications in the mobile app, we store the device push token issued by Apple/Google/Expo so we can deliver alerts.
• Live-classroom technical data — when you join a live class, our video provider (Agora) processes connection and quality data needed to deliver the audio/video session.

2.3 Information from third parties

• Google account (optional) — if you choose to connect Google Calendar, we receive an authorization token that lets us add your lessons to your calendar. We request only calendar-event access and do not read your existing calendar contents.
• Payment confirmations — when a parent/student pays an invoice through PayPal, we receive confirmation that the invoice was paid. We do not receive or store full card or bank-account numbers (see Section 7).

3. How we use information

We use the information we collect to:

• Create and manage accounts and authenticate sign-ins;
• Schedule, deliver, and record lessons, attendance, and makeup credits;
• Provide the live virtual classroom and in-app messaging between matched tutors and students;
• Send transactional notifications (lesson reminders, scheduling changes, new messages, support replies) by email and push;
• Generate invoices and reconcile payments, and calculate tutor earnings;
• Provide customer support and respond to your requests;
• Maintain the security and integrity of the Service, detect and prevent fraud and abuse, and enforce our Terms of Service;
• Analyze and improve the Service using limited, aggregated, or de-identified usage data;
• Comply with legal obligations and exercise or defend legal claims.

We do not sell your personal information, and we do not use it to deliver third-party behavioral advertising — and we never do so for children (see Section 4).

4. Children's privacy (COPPA & Google Play Families)

The Service is used by students who may be under the age of 13. We take children's privacy seriously and comply with the U.S. Children's Online Privacy Protection Act ("COPPA") and Google Play's Families policy.

4.1 Accounts for minors are created and managed by an adult

A student under 18 must have their account created and supervised by a parent, legal guardian, or an authorized administrator acting with parental permission. By creating or approving a student account, that adult represents that they are the parent/guardian (or have obtained parental consent) and provides verifiable consent to our collection and use of the child's information as described in this Policy. Students who are 18 or older may manage their own accounts.

4.2 What we collect from children and why

For a child student we collect only what is reasonably necessary to deliver tutoring: the child's name, the parent/guardian's contact details, grade/level, time zone, an optional profile photo, lesson/attendance records, and the messages and files the child exchanges with their assigned tutor. We do not condition a child's participation on disclosing more information than is necessary.

4.3 What we never do with children's data

• We do not serve behavioral or targeted advertising to children and do not allow third-party ad networks to collect data from children through the Service;
• We do not sell or rent children's personal information;
• We do not use children's data to build advertising profiles, and any analytics applied to child accounts is configured in a privacy-protective (non-advertising) mode;
• We do not enable public profiles or make a child's personal information publicly visible.

4.4 Parental rights

A parent or guardian may at any time: review the personal information we hold about their child; request that we correct or delete it; and refuse to permit further collection or use by closing the account. To exercise these rights, contact us at info@itutorzz.com or use our data-deletion request page. We may ask you to verify your identity and your relationship to the child before acting.

5. Legal bases for processing

Where data-protection laws such as the EU/UK GDPR apply to you, we rely on the following legal bases:

• Performance of a contract — to provide the Service you (or your parent/guardian) signed up for;
• Consent — for optional features such as Google Calendar sync and push notifications, and for the processing of a child's data (given by the parent/guardian);
• Legitimate interests — to secure the Service, prevent abuse, and improve our product, balanced against your rights;
• Legal obligation — to comply with applicable laws.

You may withdraw consent at any time; this does not affect processing already carried out.

6. How we share information

We share personal information only as described below. We do not sell personal information.

• Between matched users — a tutor and their assigned student (and, for minors, the supervising parent/guardian) can see each other's name, profile photo, scheduled lessons, and the messages they exchange. Administrators may view account records and conversations for support, safety, and quality purposes.
• Service providers (processors) — vendors who process data on our behalf under contract and only on our instructions (see Section 7);
• Payment facilitation — PayPal, to issue and collect invoices;
• Legal & safety — when we believe disclosure is reasonably necessary to comply with law or legal process, enforce our Terms, or protect the rights, safety, or property of users or the public;
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy continuing to govern your information;
• With your direction or consent — for example, when you connect Google Calendar.

7. Third-party services

We rely on the following third-party providers. Each processes only the data needed for its function; we encourage you to review their privacy policies.

Provider	Purpose	Data involved
Agora	Live virtual classroom (audio/video)	Session connection & quality data, in-class identifiers
Google (Firebase Cloud Messaging) & Expo	Push notifications to mobile devices	Device push token, notification content
Google (OAuth / Calendar)	Optional calendar sync you enable	Calendar-event authorization token
Google Tag Manager / analytics	Limited, privacy-protective usage analytics on the website	De-identified/aggregated usage data (not used for advertising; not applied to children)
PayPal	Invoicing and payment collection	Billing name/email and payment status (we do not receive full card/bank numbers)
Email / SMTP provider	Transactional email delivery	Recipient email address and message content
Hosting provider (Hostinger)	Application hosting & database storage	All Service data, stored securely on our behalf

8. Cookies & similar technologies

We use a single essential first-party cookie to keep you signed in and to maintain your session. This cookie is strictly necessary for the Service to function and cannot be disabled while you are logged in. On the website we also use Google Tag Manager to load limited, privacy-protective analytics; we do not use advertising or cross-site tracking cookies, and we do not apply analytics to identified children's accounts. You can clear cookies through your browser settings, but doing so will sign you out.

9. Data retention

We retain personal information for as long as your account is active and as needed to provide the Service. After an account is closed or a deletion request is honored, we delete or de-identify personal information within a commercially reasonable period (generally within 30 days), except where we must retain certain records to comply with legal, tax, accounting, or security obligations, or to resolve disputes and enforce our agreements. Aggregated or de-identified data that can no longer be linked to you may be retained.

10. Data security

We use technical and organizational measures designed to protect personal information, including encryption of data in transit (HTTPS/TLS), hashing of passwords with a strong one-way algorithm (bcrypt), access controls, and storage of user-uploaded files outside the public application directory. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

11. International data transfers

iTutorzz is based in the United States and our users and providers may be located in the United States, Pakistan, and other countries. Your information may therefore be transferred to, stored in, and processed in countries whose data-protection laws differ from those of your country. Where required, we use appropriate safeguards for such transfers. By using the Service, you understand that your information may be processed in these locations.

12. Your privacy rights

Depending on where you live, you may have some or all of the following rights regarding your personal information: to access it; to correct inaccuracies; to delete it; to obtain a portable copy; to restrict or object to certain processing; and to withdraw consent. We will not discriminate against you for exercising these rights.

12.1 U.S. residents (including California & Montana)

If you are a California resident (CCPA/CPRA) or Montana resident (Montana Consumer Data Privacy Act), you may request access to, correction of, or deletion of your personal information, and you may opt out of any "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell or share personal information in this manner, and we do not do so for consumers we know to be under 16. You may exercise these rights using the contact details in Section 16; you may use an authorized agent where the law permits.

12.2 EU/UK and other regions

If you are in a region with comparable laws (such as the GDPR), you may exercise the rights listed above and lodge a complaint with your local supervisory authority.

12.3 How to exercise your rights

Email info@itutorzz.com or use the data-deletion request page. To protect your account, we will take reasonable steps to verify your identity (and, for a child's data, your status as the parent/guardian) before responding. We aim to respond within the timeframe required by applicable law.

13. Account & data deletion

You can request deletion of your account and associated personal information at any time through our dedicated data-deletion request page, or by emailing info@itutorzz.com. Parents/guardians may request deletion of a child's account the same way. Once verified, we will delete or de-identify the associated personal information within a commercially reasonable period (generally within 30 days), subject to the legal-retention exceptions described in Section 9. Some content shared with another user (for example, messages already delivered) may remain visible to that user unless and until it is also removed.

14. Push notifications & email

With your permission, the mobile app sends push notifications (for example, new messages, lesson reminders, and scheduling changes). You can turn these off at any time in your device settings. We also send transactional emails necessary to operate the Service; because these are service-related rather than marketing, they are not subject to an unsubscribe option, though you can close your account to stop receiving them.

15. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide a more prominent notice (such as an in-app message). Your continued use of the Service after an update means you accept the revised Policy.

16. Contact us

If you have questions, requests, or complaints about this Policy or your personal information, contact us at:

iTutorzz LLC
1001 S. Main St., Ste 600, Kalispell, MT 59901, USA
Email: info@itutorzz.com