Privacy Policy
Last updated: 8 August 2026
Company details
TutorStack is operated by TutorStack Ltd, a company registered in England and Wales under company number 17360160.
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
Contact: hamish@tutorstack.co.uk.
Who controls your personal data
TutorStack Ltd is the data controller when you visit our marketing website, request a demo, communicate with us about TutorStack, or when we use account, security, support, and service-administration data for our own purposes.
When a tutoring business uses a TutorStack workspace to manage its parents, students, tutors, applicants, lessons, payments, and communications, that tutoring business will normally be the data controller. TutorStack Ltd acts as its data processor when it hosts and processes that information on the business's instructions. The tutoring business's own privacy notice should explain how it uses that information.
Personal data we collect
- Your email address and anything you include when requesting a demo or contacting us.
- Business and account details supplied while configuring or using TutorStack.
- Support messages, product feedback, and records of our relationship with you.
- Technical, security, and usage information, including device, browser, IP address, authentication, audit, and error information.
- Analytics information about how the website or product is used, but only where consent is required and you have given it.
Client workspaces may contain personal data about administrators, tutors, parents, students, and applicants. The relevant tutoring business decides what information is collected in its workspace and why.
Business and account information marked as required is needed to create or administer an account or perform a customer contract. If it is not provided, we may be unable to provide the relevant account, feature, or service.
Why we use personal data
| Purpose | Lawful basis |
|---|---|
| Respond to demo requests and pre-contract questions | Steps requested before entering a contract and our legitimate interests |
| Provide, configure, secure, and support TutorStack | Contract and our legitimate interests in operating a secure service |
| Manage accounts, billing, records, and legal obligations | Contract and legal obligation |
| Improve the service using product feedback and necessary operational data | Our legitimate interests |
| Optional website or product analytics | Consent |
Where we rely on legitimate interests, those interests are running, securing, supporting, and improving TutorStack without overriding your data-protection rights.
Service providers and subprocessors
We use the following providers to operate TutorStack. They act as subprocessors where they process customer workspace data on our instructions. Depending on the service and processing activity, a provider may instead act as our processor or as an independent controller under its own privacy notice.
| Provider | Purpose | Information involved |
|---|---|---|
| Supabase | Database, authentication, and file storage | Workspace data, account data, files, and technical logs |
| Vercel | Application hosting, delivery, and infrastructure | Application requests, account and workspace data, and technical logs |
| Resend | Email delivery | Recipient details, message content, and delivery metadata |
| Stripe | Payments and connected-account services | Identity and payment metadata. Payment credentials are collected and held by Stripe. |
| PostHog | Consented analytics and operational monitoring | Usage, device, and event data |
| Sentry | Error and performance monitoring | Error reports, technical context, and limited identifiers |
| Google Gemini | AI drafting, summarisation, and scheduling assistance | User-selected prompts, generated content, attachments, and scheduling context |
| Google Calendar | Optional calendar integration | Calendar event and authorisation data |
We may also disclose information to professional advisers, regulators, courts, or public authorities where required.
We do not sell personal data.
International transfers
Some providers may process information outside the United Kingdom. Where required, we use an adequacy decision or approved contractual safeguards for those transfers. Contact us if you would like more information about the safeguards that apply.
How long we keep personal data
We keep controller information only for as long as needed for the purpose for which it was collected, including handling enquiries, maintaining security and audit records, resolving disputes, and meeting accounting or legal obligations. We set periods by considering the relationship, the sensitivity of the information, security needs, and applicable limitation, tax, accounting, and regulatory requirements.
Unless a written customer agreement says otherwise, a tutoring business has 30 days after its workspace ends to request an export. We then delete its personal data from active processor-held systems, except where law requires us to retain it. Copies in protected backups remain beyond ordinary use until they expire through the normal backup cycle. Separate records that TutorStack controls, such as billing or security records, follow their own limited retention periods.
Restricted information
TutorStack is not intended for deliberate storage of health or disability information that reveals special educational needs, safeguarding case files or allegations, or DBS, criminal-offence, or criminal-conviction data. Customers must not intentionally submit that information unless TutorStack has expressly agreed suitable processing terms and safeguards in writing.
If restricted information is disclosed incidentally, we limit access, notify the relevant customer where appropriate, and delete, return, or otherwise handle it securely under the customer's instructions and applicable law.
Your rights
Depending on the circumstances, you may have rights to access, correct, erase, restrict, or receive a copy of your personal data, and to object to certain processing. Where we rely on consent, you may withdraw it at any time.
Your right to object: you may object at any time to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds to continue or need the information for legal claims.
Contact hamish@tutorstack.co.ukto exercise a right relating to data controlled by TutorStack Ltd. If your request concerns data held in a tutoring business's workspace, contact that business first. We will assist it as required.
You can complain to the UK Information Commissioner's Office at ico.org.uk.
Automated decisions and children
TutorStack features may draft content, rank information, recommend actions, or carry out configured administrative actions. Depending on the feature and a customer's configuration, an output or action may be reviewed, approved, or automated. Customers remain responsible for choosing appropriate settings, checking outputs where appropriate, and providing suitable privacy information where their workspaces contain children's data.
TutorStack Ltd does not use solely automated processing to make legal or similarly significant decisions about individuals. A customer must not configure TutorStack to make such a decision unless it has a lawful basis and provides the safeguards required by data protection law, including human intervention where required.
Changes and contact
We may update this policy as TutorStack develops. Material changes will be highlighted on this page or communicated directly where appropriate.
Questions about this policy can be sent to hamish@tutorstack.co.uk.