Last updated: April 11, 2026 · Effective immediately
Information you provide directly: name, email address, phone number, organisation details, and any content you voluntarily submit (notes, feedback, messages).
Information generated through use: lesson schedules, attendance records, session recordings and transcripts (when uploaded by tutors), AI-generated summaries, homework assignments, and platform activity logs.
Technical information: browser type, IP address, device identifiers, and general location data derived from your IP address. We collect this solely to maintain security and improve the service.
We do not sell, rent, or share your personal data with third parties for their own marketing purposes.
We process your data based on one or more of the following grounds:
Your data is stored securely in Google Cloud Firestore with encryption at rest (AES-256) and in transit (TLS 1.2+). Uploaded recordings are stored in Cloudflare R2 with signed-URL access controls and are only accessible to authorised users within your center.
We use Firebase Authentication for identity management with industry-standard password hashing. Access to production systems is restricted, audited, and protected by multi-factor authentication.
While no system is 100%% secure, we implement commercially reasonable technical and organisational safeguards to protect your data from unauthorised access, alteration, disclosure, or destruction.
We rely on reputable third-party services to process data on your behalf. Each is bound by its own privacy commitments:
We do not pass your data to any service not listed here without prior notification.
Your data may be transferred to and processed in countries outside your jurisdiction (including the United States) where our third-party providers maintain infrastructure. Where required, we ensure appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms are in place.
Your data is retained for as long as your account is active or as needed to provide services. Upon account deletion:
You may request deletion at any time through your center administrator or our data deletion page.
Depending on your jurisdiction, you may have the following rights regarding your personal data:
For EU/EEA residents, these rights are guaranteed under the General Data Protection Regulation (GDPR). For California residents, additional rights may apply under the CCPA.
To exercise any right, contact your center administrator or submit a request through our data deletion page.
TutorCrumb is designed for use by tutoring centers, which may serve minors. Student accounts for minors are created by center administrators with parental knowledge and consent. We do not knowingly collect personal data from children under 13 (or the applicable age in your jurisdiction) without parental consent facilitated through the center.
If you believe a child’s data has been collected without proper consent, please contact us immediately and we will delete it.
We may update this Privacy Policy from time to time. Material changes will be communicated via an in-app notification to center administrators at least 14 days before taking effect. The “Last updated” date at the top will always reflect the most recent revision.
For privacy inquiries, data requests, or concerns, contact your center administrator. Center administrators can reach us through the data deletion request feature in their admin settings panel.