预览期间，法律文件均为草稿（仅提供英文版）。
Privacy Policy
DRAFT — to be reviewed by a lawyer before publication. Last updated: 2026-10-24
This policy explains how SPÓŁKA GŁÓWNA ("we") handles personal data in TutorHabitat — an online board, lesson diary and business tool for private tutors. We collect only what the service needs and ask for consent only where the law requires it.
1. Who is responsible
- We are the controller of: customers' accounts (tutors, schools, their staff), billing records, website visitors, questions to the help assistant, and the technical data (IP address, browser, security logs) of everyone who opens the service — including students and parents who open a lesson or consent link. Controller: SPÓŁKA GŁÓWNA, OPERATOR_ADDRESS, OPERATOR_REGISTRATION. Contact: PRIVACY_EMAIL.
- The tutor or school is the controller of the data it enters about its students and their parents (names, contacts, lessons, boards, materials, recordings, transcripts). We are its processor and handle this data only on its instructions under our Data Processing Addendum. Students and parents can contact their tutor, or us — we pass the request on and help the tutor answer.
- The payment provider (PAYMENT_PROVIDER) is the seller of record and a separate controller for checkout and payment data.
- Our representative in the EU (GDPR Art. 27 and DSA Art. 13): EU_REPRESENTATIVE, EU_REPRESENTATIVE_ADDRESS, EU_REPRESENTATIVE_EMAIL, EU_REPRESENTATIVE_PHONE — the operator's Polish sp. z o.o., mandated in writing, unpaid. It may be addressed in addition to us. The service is provided by SPÓŁKA GŁÓWNA, not by the representative.
- The service is not directed at people in the United Kingdom. We have not appointed a UK representative. If you use it from the UK anyway, hosting remains in the EU. The service is also not directed at some other countries, and is not offered in sanctioned territories or to sanctioned persons (see Terms §1a and §1c). We do not ask your country at sign-up, and we do not check it against your IP address or an identity document. Two exceptions: if you teach students who live in the USA, the Terms require you to tell us and to mark those students so that we can run COPPA (section 3); and when you buy a paid plan, the seller sends us your billing country with the transaction (section 2). We do not use either to screen sanctions or to block a country. If we learn with certainty that sanctions or a restriction in the Terms applies, we act on that information.
2. What we process as controller, and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: name, e-mail, password (stored as a salted hash), language, role — we ask for nothing more at sign-up (no country, age, phone or address) | providing the account and the service | contract — Art. 6(1)(b) for individual customers; legitimate interest — Art. 6(1)(f) for staff of school customers |
| Plan, credits, and the transaction data the seller sends us for each purchase (amount, currency, billing country, transaction number) — data received from the seller, not from you | billing; matching purchases to your account | contract — Art. 6(1)(b) |
| Settlement and accounting records (the transaction data above and the seller's payouts to us) | our own tax and accounting duties | legitimate interest — Art. 6(1)(f); legal obligation — Art. 6(1)(c) only where an EU or Member State law imposes the duty on us. Customer tax invoices are issued by the seller (PAYMENT_PROVIDER), not by us |
| Usage and credit counters per customer account (aggregated, without student identifiers) | showing usage, fair limits, alarms against runaway costs and abuse | legitimate interest — Art. 6(1)(f) |
| Your own AI key, if you connect one (stored encrypted; only the last four characters are shown) | sending your workspace's AI requests to your provider | contract — Art. 6(1)(b) |
| Invitation records during the private preview: the link, its creation and expiry dates and our note on whom it was sent to | opening accounts by invitation only | legitimate interest — Art. 6(1)(f) |
| Technical data: IP address, browser, security logs (all users, incl. students opening a link) | security and troubleshooting | legitimate interest — Art. 6(1)(f) |
| Questions to the help assistant | answering questions about the service | contract (customers) — Art. 6(1)(b); legitimate interest (visitors) — Art. 6(1)(f); a question is sent to the US provider only after your one-time consent (section 5) |
| Sanctions decisions: information we receive showing that sanctions may apply to a user (for example, the payment provider telling us it refused a payment on sanctions grounds, or information from the user or a third party), and our decision. We do not ask for your country and do not screen accounts ourselves; payments are screened by the payment provider | complying with sanctions law; suspending or refusing accounts and payments we may not accept | legal obligation — Art. 6(1)(c) where EU or Member State sanctions law applies; otherwise legitimate interest — Art. 6(1)(f) |
| Messages to support | answering you | contract — Art. 6(1)(b), or legitimate interest — Art. 6(1)(f) for non-customers |
We do not process card numbers. Checkout, card and payment details are handled by PAYMENT_PROVIDER under its own privacy notice.
Required data: name, e-mail and password are needed to open an account; billing details are needed to buy a paid plan. Without them we cannot provide the service. Everything else is optional.
We do not sell personal data, do not use it for advertising and do not build marketing profiles. We do not use lesson content to train AI models, and we will not enable an AI provider for lesson data unless its terms prohibit training on that data. CHECK: confirm each provider's API terms/DPA before launch
3. Optional features that need consent
Two features process more sensitive lesson data and work only after the required person consents on the consent page provided in the service (in the person's language):
- Lesson recording and transcription — voice is recorded, turned into text, and the audio is deleted right after transcription. A student aged 13 or over may object, which switches recording off. Recording also needs the consent required by the law on recording conversations in the participants' countries.
- AI tutor — the question, relevant parts of the board, the student's first name and school year and, if recording consent was also given, lesson transcripts go to an AI provider in the USA (see Sub-processors).
Consent can be withdrawn at any time on the same page; withdrawal does not affect earlier processing. Without consent, lessons work normally, including lesson materials — files uploaded to a room reach the AI tutor only after someone clicks “Load into AI”, and student materials only with AI consent.
AI usage log (as processor). For each AI call we record the time, the function used, the room, the student and the person who asked, the number of tokens and the credits used — not the text of the question or answer. This identifiable log is processed on the tutor's or school's instructions, so they can see usage, set room budgets and export it (CSV). For our own alarms against runaway costs we use aggregated counts per customer account (legitimate interest), not student identifiers.
US students under 13 (COPPA) (as operator and controller). For the COPPA notice and consent file we are the operator under COPPA and the controller, not the tutor. Legal basis: our legitimate interest in complying with COPPA and limiting collection from children (Art. 6(1)(f)); Art. 6(1)(c) does not apply, because COPPA is not an obligation laid down by EU or Member State law (Art. 6(3)). For a student marked as living in the USA and under 13, the tutor gives us the parent's e-mail address (not collected from the child) so that we can send the parent the COPPA notice and consent form. We keep the parent's e-mail, the chosen language, the case number, when and by whom the request was sent, and — once the parent returns it — the scan of the signed consent form (child's first name, parent's name, signature, date) with the time it was received, the channel (the parent's personal link, or our filing of the parent's e-mail reply) and our check of it. With consent we collect from the child: chat, board input, voice/video in calls and technical identifiers; recordings and the AI tutor only if ticked on the form. It is used only for the child's lessons with that tutor and shared only with providers that run the lessons (hosting, calls, the AI provider if chosen). Parent's rights (16 CFR § 312.6): the parent can review the child's information, refuse further collection and use, and have it deleted — on the personal link ("Withdraw consent and delete all my child's information") or by writing to PRIVACY_EMAIL. We, not the tutor, describe and export the personal information collected from the child, delete it and stop further use. Details: Children and Students.
Live calls in lessons are relayed through our own servers in the EU (Jitsi, TURN); IP addresses are processed to connect participants; calls are not recorded unless recording is switched on with consent. Google Calendar (optional): a tutor can paste the secret iCal address of their calendar; it is stored in their account and our server fetches only busy times from Google.
4. Who receives data
The providers listed in Sub-processors, and authorities where the law requires.
- Your own AI key: if your administrator connects one, AI requests of your workspace go to that provider under your own agreement with it (see AI Policy).
- Our support staff open a customer's workspace only to provide support the customer asked for, to keep the service secure, or where the law requires. Each such access is recorded in the customer's change history with its time and as access by the service operator (the entry does not record the content viewed). Access ends when the task ends. Staff access customer data only from the EEA.
- Dictionary links: the service links to publishers' dictionaries (e.g. Oxford, Cambridge, Duden). Our server sends them nothing; the word you look up reaches that website only when you click a link, and its own privacy policy applies. Our servers are in the European Union (France). Processors act only on our instructions under written terms; the list shows the status of each agreement.
5. International transfers
Hosting is in the EU (France). Data leaves the EU in these cases only:
- AI tutor — lesson data is sent to a US AI provider only after AI consent and only once that provider is bound by a signed transfer tool (its EU–US Data Privacy Framework certification or SCCs), as shown per provider in Sub-processors. Until then the AI tutor is not enabled for EEA users. We do not rely on the data subject's consent under Art. 49(1)(a) for routine AI transfers. The provider may keep requests for up to 30 days for abuse monitoring.
- Help assistant — your questions (no lesson data) to the AI provider in the USA. Before your first question, every user is asked for a one-time explicit consent: the consent screen says that the question (no lesson or student data) is sent to the AI provider in the United States named for the help assistant in Sub-processors, to answer help questions; that the provider may keep requests for up to 30 days for abuse monitoring; that we do not store the questions; and that you can refuse by not using the help assistant, while the rest of the service keeps working. Without that consent no question is sent; opening the assistant or typing a question is not consent. Your browser remembers the consent; you can withdraw it at any time with "Withdraw consent" in the assistant window (no further questions are then sent). We do not keep a server-side record of it, because the assistant is also available to visitors without an account. For EEA users the help assistant is in addition enabled only once a signed transfer tool for this flow is in place (see Sub-processors); we do not rely on that consent under Art. 49(1)(a) for EEA users. For Japan the consent is the APPI Art. 28(1) ground and for South Korea the PIPA Art. 28-8(1) separate consent. BEFORE LAUNCH: sign the transfer tool for the help assistant
- Your own AI key — if your administrator connects one, lesson data is transmitted to the provider you chose, under your agreement with it (see AI Policy).
- Our company — SPÓŁKA GŁÓWNA is established in the USA. Data stays hosted in the EU, but legally it is made available to a US company, so we use the EU Standard Contractual Clauses (Module 2), included in our DPA, with a documented transfer impact assessment.
- E-mail and payment providers — as shown in Sub-processors.
If you are outside the EEA. When you use the service from outside the EEA, your data is transferred to the EU (France) for hosting and is handled by our US company, whose staff access it only from the EEA (see above). If the AI tutor is used, lesson data go to a US AI provider only after AI consent and only where the transfer tool for that flow is already signed (EEA: the tool in the AI-tutor bullet; Japan: the Art. 28 contract in the Japan row — none is signed yet). Help-assistant questions are separate and are sent only after the one-time help-assistant consent above. The recipients are listed in Sub-processors. Depending on your country, the basis is: the transfer being necessary to provide the service you asked for; consent; or contractual safeguards with the recipient. Where your law requires a specific tool (for example standard clauses or a contract with the recipient), we will use it; the table below says which tools are in place and which we will use where required. We do not describe a tool as in place until it is signed.
| Where you are | Basis for transfer to the EU and the USA |
|---|---|
| Colombia, Chile, Ecuador, Mexico | Where local law requires model clauses for a transfer abroad, we will use clauses recognised by the local authority (Colombia: the RIPD clauses or another contract the SIC recognises; we do not rely on a US adequacy decision). Where we act as processor for the tutor or school, our DPA is the processing agreement (Mexico "remisión", Colombia "transmisión"); account data we control ourselves are covered by this policy. Chile: Law 19.628 applies until Law 21.719 takes effect (statutory date 1 December 2026). CHECK: per country |
| United Arab Emirates | We rely on a statutory exception under the PDPL (performance of the contract or consent). We do not claim an adequacy decision. CHECK: executive regulations |
| Qatar | Transfers outside Qatar are made only where Law 13/2016 allows them (adequate protection at the recipient, consent, or another case stated in the law). CHECK: which condition applies to EU hosting and US AI |
| India | Permitted except to countries restricted by Government notification (none at present) |
| Singapore | Where required we will bind the recipients by legally enforceable obligations giving comparable protection (PDPA s.26): for processors through our DPA, and for the US AI providers through their agreements (status shown in Sub-processors) |
| Japan | APPI Art. 28. We are a US company. Your data are hosted in the EU, which Japan recognises as having an equivalent system, and our staff access them only from the EEA. US AI providers: lesson data are not sent to a US AI provider until that provider is bound by a signed contract to take equivalent measures (Art. 28); no such contract is signed yet (status in Sub-processors), so there are no such measures to describe yet; once a contract is signed we will describe them on request. We do not rely on consent for lesson data. Help assistant: your question (no lesson data) is sent to the US provider only with your consent under Art. 28(1), given on the one-time consent screen described above, which names the United States and the provider and links to this information; you can withdraw it with "Withdraw consent" in the assistant window. Information on the US system: there is no comprehensive federal privacy law; sector-specific and state laws apply. CHECK: APPI Art. 28(2) information shown on the help-assistant consent screen |
| South Korea | PIPA Art. 28-8. France (hosting of your account): the transfer is necessary to provide the service you contracted for. Items: the data listed in sections 2–3. Recipients: OVH SAS (hosting, France) and our own company as operator (see above). Timing and method: continuously, over encrypted connections. Retention: section 6. To refuse, do not open an account. USA (AI tutor): not necessary for the contract. Items: the data listed for the AI tutor in section 3. Recipients: the US AI providers listed in Sub-processors. Purpose: answering AI requests. Timing and method: at each AI request, over encrypted connections, only after AI consent. Retention: section 6; the providers may keep requests for up to 30 days for abuse monitoring. To refuse, do not give AI consent, or withdraw it; the rest of the service stays available. AI consent covers this notice only where, before the parent or student agrees, the consent screen shows the recipient, the country, the purpose, the 30-day retention and how to refuse CHECK: consent screen text shows each of these items. USA (help assistant): not necessary for the contract. Items: the question you type (no lesson data). Recipient: the US AI provider named for the help assistant in Sub-processors. Purpose: answering questions about how to use the service. Timing and method: at each question, over encrypted connections. Retention: we do not keep it; the provider may keep the API request for up to 30 days. Basis: your separate consent (Art. 28-8(1)), given on the one-time consent screen before your first question, which shows the recipient, the country, the purpose, the up-to-30-day retention and how to refuse; without it the question is not sent. Opening the assistant or typing a question is not that consent. To refuse, do not give that consent (or withdraw it with "Withdraw consent" in the assistant window) and do not use the help assistant; the rest of the service stays available. Contact: PRIVACY_EMAIL. |
| Malaysia, Philippines, South Africa, Australia, New Zealand, Canada | As set out for each in Regional Addenda |
| Countries the service is not directed at (Terms §1a), including Switzerland, Brazil, Argentina, Uruguay, Turkey, Saudi Arabia, Indonesia and mainland China | No country-specific transfer tool, registration or local standard clauses are in place (for example, we have not adopted the ANPD standard contractual clauses for Brazil, SDAIA clauses for Saudi Arabia, Turkish standard contracts or PIPL mechanisms). Data are hosted in the EU and handled as described above. Switzerland: EU hosting is on the Swiss adequacy list; for a US recipient we will use Swiss–US Data Privacy Framework certification or SCCs with the Swiss adaptations where required. |
6. How long we keep data
- Account and lesson data: while the account is active; after closure you can export for 30 days, then the data is deleted.
- Voice recordings: deleted automatically right after transcription. Transcripts: per the tutor's setting, or until consent is withdrawn.
- AI tutor conversations: kept with the lesson room while the account exists; content taken from transcripts is deleted together with the transcripts; everything is deleted without undue delay when AI consent is withdrawn.
- Help-assistant questions: not stored by us; the AI provider may keep the API requests for up to 30 days for abuse monitoring.
- Settlement and accounting records (including the billing country received from the seller): as long as the tax and accounting law that applies to us requires. Customer invoices are kept by the seller under its own terms.
- Web server and system logs: 7 days; system logs may contain full IP addresses; in web server logs the IP address is truncated when written (IPv4: last byte removed; IPv6: only the first three groups kept). Other security logs: up to 30 days.
- AI usage log: the last 12 months (rolling); older entries are reduced to monthly totals per function (number of calls, cost, and how many rooms were active) with student, room and user identifiers removed. Those totals remain linked to the customer account and are deleted with it. The customer can export the log (CSV) at any time.
- COPPA consent requests (US students under 13): the parent's e-mail and the request are deleted after 90 days if no consent arrives. Signed consent forms: while the student's record exists; deleted immediately when the parent withdraws consent or the student record is deleted. On withdrawal we also delete the personal information collected from the child, as listed in Children and Students (the child's chat messages, questions to the AI tutor and uploaded materials, the recordings and transcripts of the child's rooms, and the child's board entries and handwriting readings where they can be attributed to the child), we keep the child's rows in the AI usage log only as anonymous counts without the child's identifier, and we ask the AI provider and the mailbox provider to delete their copies. Web server logs hold only truncated IP addresses; system logs may hold full IP addresses (for example of network connections to our servers). Both expire within 7 days and are not searched for the child. Copies in our mailbox (notices and parents' replies) follow the same schedule and are not kept in the general support queue.
- Your own AI key: until you disconnect it or close the account; deleted immediately on disconnect.
- Sanctions decisions (what we learned, the decision and its date): 5 years after the decision, then deleted.
- Invitation records: up to 90 days from creation. An unused invitation, including our note on whom it was sent to, is then deleted. A used invitation is replaced by the account record.
7. Cookies
Only cookies needed to keep you logged in, to open your own workspace, for an operator staff session (not set for customers), for administrator test mode, and to remember the language you chose — no analytics, no advertising. Details: Cookie Policy. BEFORE LAUNCH: fonts and scripts served from our own servers — then: "No third-party fonts, scripts or other resources are loaded, so no cookie banner is needed."
8. Your rights
Access, correction, deletion, restriction, portability, and objection to processing based on legitimate interest — write to PRIVACY_EMAIL. For data your tutor entered, we forward the request to the tutor and help them answer. Requests of parents of US children under 13 under COPPA we handle ourselves (see section 3). You can complain to a data protection authority — in the EU in particular in the country where you live or work, or where the infringement occurred; in the UK, the ICO. Region-specific rights: Regional Addenda.
9. Children
Students, including children, use the service through their tutor. The tutor needs a legal basis for their data; we provide consent tools, and we have our own duties for the technical data we collect as controller and where children's privacy laws treat us as the operator. See Children and Students.
10. Changes
We will announce material changes by e-mail or in the service at least 30 days before they take effect.