Privacy Policy

This policy explains how Package HQ Limited (“we”) handles personal data in TutorRoom. We are the data controller for account and billing data. For the student, parent, and attendance data an academy enters, the academy is the controller and we act as its processor.

What we collect

• Account: name, email, role, and password (stored hashed by our auth provider).
• Academy data: students, parents, classes, belts, assessments, attendance, and payment records you enter.
• Billing: plan, subscription status, and payment metadata. Card details are handled by our payment providers, not stored by us.
• Usage: basic logs needed to run and secure the service.

How and why we use it

To provide and secure the service (performance of our contract with you), to take payments, to send service emails such as invites and reminders, and to improve the product (legitimate interests).

Who we share it with

We use trusted providers to run TutorRoom, each acting on our instructions:

• Supabase (database and authentication)
• Microsoft Azure (hosting)
• Cloudflare (DNS, security, custom domains)
• Stripe (payments)
• Resend (transactional email)

We don't sell personal data.

International transfers

Some providers process data outside the UK. Where they do, we rely on appropriate safeguards such as standard contractual clauses.

How long we keep it

We keep data while your academy is active and for a reasonable period afterwards, then delete or anonymise it, unless we must keep it for legal or accounting reasons.

Your rights

Under UK GDPR you can request access, correction, deletion, or a copy of your data, and object to certain processing. Contact us to exercise these. If a request concerns an academy's student or parent data, we'll direct it to that academy as the controller.

Cookies

We use only the cookies needed to keep you signed in and run the service. We don't use advertising cookies.

Children

TutorRoom is used by academies, and the records an academy keeps often include under-18 students. For that student data the academy is the controller and decides what to collect, so the academy is responsible for obtaining any parental consent the law requires. We act only as its processor and hold the data to provide the service.

We do not collect data directly from children. Accounts are held by academy staff and by parents or adult students, and we apply the same security to student records as to all other data. We encourage academies to enter only the information they genuinely need.

Contact and complaints

Email privacy@packagehq.co.uk.Package HQ Limited, company no. 17267416, registered office 82a James Carter Roadhall, Mildenhall IP28 7DE, United Kingdom. You can also complain to the UK Information Commissioner's Office (ico.org.uk).