Privacy Policy

1. Who is responsible

TutorDesk is run by naStipe.dev, Finland. You can reach us at support@nastipe.dev.

Our role depends on the data:

• Tutor account data (your sign-in details and profile): we are the controller.
• Student and guardian data that a tutor enters (names, contacts, notes, lessons, homework, payments): the tutor is the controller and we process it on the tutor's behalf. If you are a student or guardian and want access to or deletion of this data, please ask your tutor first. We will help the tutor respond.

2. What data we handle

• Account: email address and a password (stored as a hash by our authentication provider). If you choose Google sign-in, we receive your name and email from Google.
• Tutor profile: name, time zone, language, currency, payment instructions and optional contact email and phone.
• Tutor-entered records: student and guardian names, email, phone and messenger handles, notes, subjects and rates, lessons and their status, lesson packages, payment status, and homework text with feedback.
• Portal accounts: if a tutor invites a student or guardian, we create a sign-in for them and link it to that student's records.
• Technical data: a session cookie, server logs kept by our hosting providers (for example IP address and request time), and anonymous page performance measurements.

TutorDesk records payments but does not process them. We never see card or bank details.

3. Why we use it and on what basis

• To provide the service you signed up for: accounts, scheduling, homework, payment records and the student portal (contract, GDPR Art. 6(1)(b)).
• To send service emails such as sign-up confirmation and password reset, and, where a tutor has switched them on, lesson and payment reminders (contract and our legitimate interest in a working service, Art. 6(1)(b) and (f)).
• To keep the service secure, prevent abuse and measure performance (legitimate interest, Art. 6(1)(f)).
• To meet legal obligations that apply to us (Art. 6(1)(c)).

We do not sell personal data and we do not use it for advertising.

4. Cookies and local storage

We use only what the service needs: a sign-in session cookie, and a small local-storage entry that remembers your light or dark theme. Our performance measurement does not use cookies. We use no advertising or cross-site tracking cookies, so there is no cookie banner.

5. Who we share data with

We use these providers to run TutorDesk:

• Supabase: database and authentication. Our database is hosted in the EU (Frankfurt, Germany).
• Vercel: web hosting and anonymous performance measurement.
• Resend: sending email.
• Google: only if you choose Google sign-in.

Some of these providers may process data outside the EU or EEA. Where they do, we rely on an EU adequacy decision or Standard Contractual Clauses. We may also disclose data when the law requires it.

6. How long we keep it

We keep account and tutor-entered data while the account is active. You can delete your account yourself in Settings, under “Delete account”, or ask us at support@nastipe.dev. We then delete your account and the records you entered, including uploaded homework files, except where the law requires us to keep something. Students and guardians who use the portal keep their own sign-in, but lose access to your data. Backups and logs expire on the schedule of the provider that holds them.

7. Security

Data is encrypted in transit. Every tutor's records are separated at the database level, so one tutor cannot read another tutor's students. No system is perfectly secure. If a breach affects you, we will notify you and the authorities as the law requires.

8. Children

Some students are minors. TutorDesk is built for tutors, not for children, and children are not meant to create their own accounts without a parent or guardian. Tutors are responsible for having the right to store a student's data and for involving the guardian where the law requires it.

9. Your rights

Under the GDPR you can ask to access, correct, delete, restrict or export your personal data, and object to processing based on legitimate interest. Email support@nastipe.dev and we will answer within one month. You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the authority in your own country.

10. Changes

We may update this policy. When the change is significant, we will tell signed-in users by email or in the app. The date at the top shows the latest version.

11. Contact

Questions about privacy: support@nastipe.dev. naStipe.dev, Finland.