Data Deletion Request

1. How to Request Deletion

You may request the permanent deletion of your personal data from TutorCrumb in one of the following ways:

• Through your center administrator — ask your admin to remove your account from the platform. Admins can also submit a full data-deletion request on your behalf from their settings panel.
• In-app request — center administrators can submit a data deletion request directly from the Settings page in the admin portal.
• Written request — contact TutorCrumb support with your full name, the center you are associated with, and a description of the data you want removed.

We will never ask for your password as part of a deletion request.

2. Identity Verification

To protect against unauthorised deletion, we may verify your identity before processing a request. This may include:

• Confirming the email address associated with the account
• Requesting verification from your center administrator
• Matching the request to an authenticated admin session

If we cannot verify your identity, we may decline the request to safeguard your data.

3. What Gets Deleted

Upon a verified deletion request, the following data will be permanently and irreversibly removed:

• Your user profile and Firebase Authentication credentials
• All lesson, session, and attendance records associated with your account
• Uploaded audio/video recordings and source files
• AI-generated transcripts, summaries, key points, and extracted data
• Reviews, feedback, and sentiment analysis outputs
• Notification history and communication logs
• Parent/student relationship mappings (for parent accounts)

4. Data Retained After Deletion

Certain data may be retained in limited circumstances:

• Anonymised aggregate statistics — e.g., total lesson counts, which cannot be traced back to you
• Multi-party lesson records — your identifiable information will be removed, but the lesson record may persist for other participants (e.g., tutor or other students in a group session)
• Legal obligations — data required by law, regulation, or valid legal process may be retained for the minimum required period
• Backup systems — encrypted backups are purged within 90 days of the deletion date

5. Processing Timeline

• Acknowledgement — within 3 business days of receiving a verified request
• Completion — within 30 calendar days of verification
• Confirmation — you will receive email notification when deletion is complete

Under GDPR, we are legally required to respond within 30 days. If additional time is needed due to the complexity of the request, we will inform you of any extension within the initial 30-day period.

6. Your Rights (GDPR, CCPA & Others)

Depending on your jurisdiction, you may have the following rights:

• Right to erasure (GDPR Art. 17) — request permanent deletion of your personal data
• Right to be forgotten — request removal from all active systems and backups
• Right to data portability (GDPR Art. 20) — receive your data in a machine-readable format before deletion
• Right to deletion (CCPA §1798.105) — California residents may request deletion of personal information
• Right to lodge a complaint — you may contact your local data protection authority if you believe your request has not been handled properly

We honour deletion requests from all users regardless of location.

7. Third-Party Data Removal

When we delete your data, we also take steps to remove it from our third-party processors:

• Firebase / Google Cloud — authentication records and Firestore documents are deleted
• Cloudflare R2 — stored recordings and files are permanently removed
• OpenAI / AssemblyAI — these services do not retain input data after processing; no further action required

If you have concerns about data held by a specific third party, please include this in your deletion request and we will provide confirmation of removal.