Children and Students

DRAFT — to be reviewed by a lawyer before publication. Last updated: 2026-10-24

TutorHabitat is a tool for tutors and schools. Many students are children. This page explains who is responsible for what.

Responsibilities

• The tutor or school (our customer) decides which students to add and is the controller of their data. The GDPR legal basis for ordinary lesson data is usually the contract (where the student is a party) or the tutor's legitimate interest in giving the lessons the parent ordered (Art. 6(1)(f)). This does not replace parental consent where a specific law requires it (see the rules by region below).
• We process that data as the tutor's processor (DPA), provide consent pages in the consenting person's language, and keep a record of each consent. We are also the controller of technical data (IP address, browser, security logs) of every student who opens a link, and we have our own duties where children's privacy laws treat the platform as the operator: for the COPPA notice and consent file in the USA we are the operator and controller (see below).

What needs consent in the service

The service always asks the parent/guardian until the student is 18. Recording a conversation can also require the consent of every participant under the law on confidentiality of communications (e.g. ePrivacy Art. 5(1) and national criminal law such as § 201 German Criminal Code; all-party-consent US states). The service collects the consents above; consent of the other participants (the tutor, other students in group lessons) is the tutor's responsibility. While recording, all participants see a "Recording" sign.

Where the law requires verification that the consent was really given by the holder of parental responsibility (GDPR Art. 8(2), COPPA, LGPD Art. 14 §5), the tutor must confirm the parent's identity through the tutoring relationship (e.g. the consent link is sent only to the parent's contact). The tutor-sent link is not enough where the law requires a specified check: COPPA in the USA (we run that flow — see below), India (from 13 May 2027 — see the table) and South Korea (PIPA Art. 22-2: for a student under 14, the tutor or school, as controller, must verify the legal representative by a method allowed by the Enforcement Decree; a consent click, and the tutor's own knowledge of the family, are not such a method. We do not provide mobile-phone, card or certificate verification, so our consent page alone does not meet Art. 22-2).

Age rules by region

Our model. Students use the service only through their tutor or school and the links they send. Students cannot sign up on their own, and children cannot open customer accounts (Terms §2). Recording and the AI tutor need consent of the parent/guardian until the student is 18, whatever the local age.

Who obtains parental consent. Where local law requires parental consent for processing a child's data (or for an online service used by a child), the tutor or school, as controller, is responsible for obtaining it. We provide the consent pages and keep the records. The exception is the flow we run ourselves: US COPPA (below). For India we will provide a verification method before 13 May 2027 (see the table).

An age in a row is only the age for that row's rule. It does not mean that a student of that age can consent to every kind of processing, and it does not apply where the row gives a split age, no statutory age, or a parent until 18. For recording and the AI tutor the service asks a parent or guardian until the student is 18; a student aged 13 or over may object to recording.

• UK: the service is not directed at the United Kingdom (see Terms §1a). The ICO's Age Appropriate Design Code applies to information society services likely to be accessed by children in the UK (Data Protection Act 2018, s.123). We do not direct the service at the UK and have not assessed it against the Code. The UK GDPR Art. 8 age is 13. If we later direct the service at the UK, we will assess it against the Code and appoint a UK representative.
• Countries the service is not directed at (Terms §1a: the United Kingdom, Switzerland, mainland China, Hong Kong, Macau, Thailand, Peru, Argentina, Uruguay, Nigeria, Turkey, Saudi Arabia, Kenya, Indonesia, Vietnam, Brazil): we do not tailor the service to their rules. Rows above marked "not directed" are for the tutor's information only; local law still applies to a tutor teaching there.

Brazil — ECA Digital (not directed)

The Digital Statute of Children and Adolescents (Law 15.211/2025) has been in force since 17 March 2026. It applies to IT products and services directed at, or likely to be accessed by, children and adolescents in Brazil, and places duties on providers, such as reliable age assurance, parental supervision tools and accounts of under-16s linked to a guardian, and a legal representative in Brazil. The service is not directed at Brazil (Terms §1a). We have not implemented these provider duties, have not appointed a legal representative in Brazil, and do not claim that the service complies with the ECA Digital. Students cannot sign up on their own and join only through their tutor's links; this is not age assurance under the ECA Digital. We have not adopted the ANPD standard contractual clauses for international transfers (see Privacy Policy §5). Safety by default that the service provides everywhere: no public profiles, no advertising, no social features, no advertising profiling.

US students under 13 (COPPA)

For the COPPA notice, the consent file and the parent's requests, we are the operator under COPPA (and the GDPR controller), not the tutor.

• What the tutor does. Teachers who teach students living in the USA (including US territories) switch this on in their account settings (the Terms require it). For each student marked as living in the USA, the teacher either confirms that the student is 13 or older, or enters the parent's e-mail address. We receive that address from the tutor, not from the child, and use it only to send the notice, receive the form and send the confirmation. Tutor-entered administrative data (name, schedule, planned lessons) is not collected from the child and may exist before consent. Before consent the student cannot join lesson rooms or lessons, so we do not collect chat, board input, voice, video or lesson content from the child. If the child opens a link, our server may still write a truncated IP address and browser data to a web server log, and the IP address of the connection may appear in system logs, both kept for 7 days; we do not use it to contact the child, to identify the child or to build a profile, and it expires with the log. The teacher never handles the form and never sees the parent's link; they see only the status.
• Direct notice (16 CFR § 312.4(c)(1)). We send it from our own mailbox, in English or Spanish, with a case number and a personal link. It says: the tutor gave us the parent's e-mail and the child's first name only so we can ask for consent; if the child opens a link before consent, our web server log may store a truncated IP address and browser data and system logs may store the full IP address of the connection, both kept 7 days, not used to identify or contact the child or to build a profile and not searched for the child; apart from that log, we will not collect, use or disclose personal information from the child unless the parent consents; what we collect from the child with consent (chat, board input, voice/video in calls, technical identifiers; recordings and the AI tutor only if ticked on the form, as separate consents); that if the AI tutor is ticked and the tutor enables it for the child, we keep an AI usage log of the child's AI calls (time, function, room, student identifier and credits used; not the question or answer text) for 12 months, then only as monthly totals without student, room and user identifiers, and that on withdrawal these rows are anonymised (kept only as counts without those identifiers); that it is used only for the child's lessons with this tutor and shared only with providers that run the lessons (hosting, calls, the AI provider if chosen); a link to our Privacy Policy, including the parent's rights; how to return the form; and that if we do not receive consent within 90 days we delete the parent's e-mail and the request.
• Consent (16 CFR § 312.5(b)(2)(i)). The parent prints and signs the form and returns it directly to us — by uploading a photo or scan on the personal link, or by replying to our e-mail with the scan attached. An upload is marked "under review" and we are notified. Consent is on file only after we check that the file is our form, signed, with the parent's name, the child's first name and the date, and the matching case number. If it passes, the parent gets a confirmation e-mail with the withdrawal link; if not, the parent gets the reason and a request to send it again, and the student stays blocked. We file a scan received by e-mail only if it came in the parent's reply to our mailbox.
• Review, refusal and deletion (16 CFR § 312.6). On the personal link the parent can choose "Withdraw consent and delete all my child's information". This deletes the form and the personal information collected from the child: in every room the child belongs to, the child's chat messages, the child's questions to the AI tutor (with the answers to them), materials the child uploaded, and all recordings and transcripts of that room; in one-to-one rooms, also all student board entries and handwriting readings; in group rooms, the child's entries on boards assigned to the child. Entries on shared boards in group rooms are not attributed to individual students and are not deleted automatically CHECK: deletion of the child's entries on shared group boards. The child's rows in the AI usage log are kept only as anonymous counts without the child's identifier. Web server logs hold only truncated IP addresses; system logs may hold full IP addresses (for example of network connections to our servers). Both expire within 7 days and are not searched for the child. The student is disconnected and blocked; the deletion counts are logged in the customer's change history; we ask our providers (the AI provider, the mailbox provider) to delete their copies. The parent can also write to PRIVACY_EMAIL to review the child's information: we, not the tutor, describe and export it, delete it and stop further use.
• No answer. If the parent does not consent within 90 days, we delete their e-mail address and the request.
• Our mailbox. Copies of COPPA notices and parents' replies are deleted on the same schedule as the case file (90 days without consent; on withdrawal; when the student record is deleted). They are not kept in the general support queue, and the mailbox provider may only transmit and store them for us.
• Actual knowledge. We do not ask anyone else for a student's country or age. If we learn from a parent, a student or the content that a student is under 13 and in the USA, whether or not the teacher switched the setting on, we immediately stop collecting and using that child's personal information, block the student and delete the personal information already collected from the child (as on withdrawal, above); if no parent e-mail is on file we request it from the tutor and send the notice. We keep only the parent's e-mail and the request, for up to 90 days; if consent is not on file by then, we delete them.

Before we accept students under 13 in the United States, we will adopt a written information-security programme and a written retention policy for personal information collected from them, as the 2025 amendments to the COPPA Rule require. BEFORE LAUNCH: adopt both documents

Design choices that protect students

• Students join lessons through private links; no public profiles, no advertising, no social features.
• No tracking cookies, no analytics.
• Voice recordings are deleted right after transcription.
• The chameleon mascot never appears inside the lesson board, so students can focus.