Privacy Policy

This policy applies to two groups: tutors who hold a TutorPin account, and students who interact with a tutor's public page (by submitting a lead, booking, or payment proof). For the data students submit through a tutor's page, the tutor is the controller and TutorPin acts as a processor on the tutor's behalf.

Account data: your name, email, login credentials, page handle, and subscription status.

Profile content: everything you choose to publish — bio, photo, languages, credentials, offers, prices, availability, and links.

Student-submitted data: names, contact details, messages, booking requests, and payment proof that students send through your page.

Usage data: anonymous page-view counts and conversion events we use to power your analytics (Views → Leads → Bookings → Paid). This is aggregate and not used to track individuals across the web.

To provide and secure the service, render your public page, deliver student leads to you, send transactional email (welcome, trial reminders, booking and lead notifications), process your subscription, show your analytics, and meet legal obligations. We rely on your consent, our contract with you, and our legitimate interest in running a safe service.

We share data only with the vendors that make the product work, under data-processing terms:

• Supabase — database, authentication, and file storage. • Stripe — your subscription billing (we never see full card numbers). • Resend — transactional email delivery. • Vercel — hosting and content delivery. Where you connect optional integrations (for example, Google Calendar), data is shared with that provider only at your direction.

Importantly, lesson payments you collect from students go directly to your own payment provider. TutorPin does not receive, process, or store those payment card details.

If you choose Google sign-in, Google shares your name, email address, and profile picture with our authentication provider, Supabase. We use your name and email to identify your account and prefill your tutor profile. Google sign-in does not grant Calendar access.

If you connect the optional Google Calendar integration, we receive your Google account email, authorization tokens, calendar ID, and busy time intervals. We use your email to identify the connected account in your schedule settings and calendar availability to check for scheduling conflicts.

We create, update, or cancel your TutorPin lesson events and request Google Meet links when available. To create a lesson event, we send Google its title, timing, student name, and student email. Google may send calendar invitations to that student. Students receive their lesson details and meeting link; they do not receive your authorization tokens or unrelated calendar event details.

We store authorization tokens on our server to maintain the connection, and store your connected email, connection status, and calendar ID. We save the Google event ID and meeting link with the related booking. Tokens are accessible only to our server-side integration, not through public pages or browser database access. Busy time intervals are used to check availability, not copied into your TutorPin booking records. Our infrastructure processors listed above support this integration.

Calendar access is optional. Disconnect Google Calendar in your schedule settings to delete the saved connection and tokens; we also ask Google to revoke the authorization. You can also revoke access through your Google Account. Calendar syncing requires valid authorization; reconnect if you want to restore it after revoking access. Disconnecting does not cancel existing TutorPin lessons or automatically delete events already created in Google Calendar. Event IDs and meeting links remain with the related booking under the retention policy below.

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. We use this data to provide the calendar features described here. We do not sell it, use it for advertising, or use it to train AI models. For access or deletion requests, use the privacy contact below.

We use HTTPS to encrypt data in transit between your browser and our service, and between our server-side Calendar integration and Google. This protects Google account information, authorization tokens, and Calendar data while they are transmitted.

Calendar authorization tokens are stored in a server-side database table. Database permissions and row-level security block public and signed-in browser clients from reading or changing that table; our server-side integration uses a privileged service credential to access it. The separate connection record, including your connected Google email and calendar ID, is readable from the dashboard only by its account owner.

Connecting or disconnecting Calendar requires a validated TutorPin sign-in. We sign connection requests with a server-side secret and give them a ten-minute expiry to protect against tampering and connecting a Google account to the wrong TutorPin account. You can disconnect Calendar or revoke Google access as described above.

We use essential cookies to keep you logged in and to make the app function. We do not run third-party advertising trackers. Analytics are first-party and privacy-respecting.

We keep account and profile data while your account is active. If you delete your account, we remove or anonymize your personal data within a reasonable period, except where we must retain limited records for legal, tax, or fraud-prevention reasons. You control the student data on your page and can delete leads at any time from your dashboard.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can do most of this directly in your dashboard, or by emailing us. We will respond within the time the law requires.

TutorPin accounts are for adults. If a tutor teaches minors, the tutor is responsible for obtaining any parental consent required to collect a child's information through their page.

We will update this policy as the product evolves and revise the date above. For any privacy question or request, contact our privacy team.