Privacy Policy

Last updated: 15 November 2026

TutorLedger is operated by an individual sole proprietor based in Kolkata, West Bengal, India ("TutorLedger", "we", "us"). This policy explains what personal data we handle in the TutorLedger app, why, and your rights. TutorLedger stores as little as it can: students never log in, and we keep only a student's first name.

1. Two kinds of data, two roles

1. Data about you, the tutor (your account): we decide how it is used, so we are the controller.
2. Data about the families you teach (student first names, parent email addresses, lessons, fees, notes): we only use it to run TutorLedger on your instructions, so we are your processor, and you are the controller. Our Data Processing Agreement covers this.

2. What we collect

About tutors

1. Account data: your name, email address, password (stored only as a secure one-way hash, never in readable form), time zone and settings, including your reminder rules.
2. Subscription data: your plan status and renewal dates. Lemon Squeezy handles your card and billing details. We never see or store your full card number.
3. Security data: failed log-in attempts (kept for 15 minutes) and a session cookie that keeps you logged in.

About families, entered by the tutor

1. The student's first name only.
2. One parent or guardian's email address, their language, time zone and currency.
3. Lesson times, fees charged, fees paid and prepaid lesson packages.
4. Lesson notes the tutor writes.
5. A count of failed emails to that parent, so we can stop sending if the address isn't working.

Fee statements and receipts are made on screen from these records when the tutor opens them. We do not store a separate copy.

Cookies: TutorLedger uses one essential cookie to keep tutors logged in. It is required for the app to work, so no consent banner is needed for it. We use no tracking or advertising cookies.

3. Why we use it, and on what legal basis

For family data, the tutor decides the legal basis and is responsible for getting the parent's agreement before adding a student.

We do not sell personal data, share it for advertising, or use it to train AI models. We do not make automated decisions with legal effects about anyone.

4. Children

1. TutorLedger is not for use by children. Children do not have accounts and are never emailed.
2. We ask tutors to enter only a student's first name, and never sensitive information about a child.
3. Tutors must have a parent's or guardian's agreement before adding a student.
4. A parent can ask the tutor, or us, to see, correct or delete their child's details at any time.

5. Lesson notes

A lesson note is shown on a private link that is emailed to the parent. Anyone who has the link can read that note, so it should not be forwarded or shared publicly. Tutors should write notes as if a parent might share them.

6. Who helps us (sub-processors)

Some of these providers process data outside your country, including in the United States. Where the law requires it, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses offered by these providers. We will update this list before adding a new provider that handles family data.

7. How long we keep data

1. Tutor account data and family data: for as long as the account exists, or until the tutor deletes it.
2. Removing a student stops all emails to that family and hides the student, but keeps past payment records for the tutor's accounts. Deleting a student permanently (Students page), or deleting the whole account (Settings), removes the data from the live database immediately. Backup copies kept by our hosting provider are overwritten within 30 days.
3. Billing and tax records: for as long as tax law requires (in India, generally up to 8 years). These are held mainly by Lemon Squeezy.

8. Your rights

Depending on where you live, you may have the right to:

1. Access the personal data we hold about you and get a copy.
2. Correct inaccurate data.
3. Delete your data. Tutors can delete their account in Settings.
4. Object to or restrict certain processing.
5. Data portability (receive your data in a machine-readable format).
6. For California residents (CCPA/CPRA): know what we collect, delete it, correct it, and not be discriminated against for using these rights. We do not sell or share personal information.
7. For users in India (DPDP Act, 2023): access, correction, erasure, grievance redressal and nominating another person to exercise your rights.
8. Complain to your local data protection authority.

If you are a parent and received an email through TutorLedger, the tutor who sent it controls your family's data. Please contact them first. We will help them respond, and you can also write to us.

We reply to requests within 30 days.

9. Security

We use encrypted connections (HTTPS) everywhere, store passwords only as salted hashes, keep each tutor's data separate, limit log-in attempts, and give access only to what is needed to run the service. No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authorities as the law requires.

10. Changes

We will update the date at the top when this policy changes, and email tutors about important changes before they take effect.

11. Contact and grievance officer

For privacy questions, requests or complaints (including as our grievance contact under India's DPDP Act), write to [email protected].