TutorPortalBack to Home

Privacy Policy

Last Updated: October 2026

TutorPortal ("the Platform", "we", "us", or "our") is committed to protecting and respecting your data privacy in strict accordance with the Protection of Personal Information Act, No. 4 of 2013 ("POPIA") of South Africa. This Privacy Policy explains how we collect, process, use, and protect personal information belonging to independent tutors, agencies, parents, and learners.

1. Information We Collect

To provide our scheduling and administrative software tracking utility, we process the following categories of personal information:

  • Tutor & Agency Data: Full name, email address, cell phone number, internal platform roles, and banking configuration details.
  • Student/Learner Data: Full name, academic grade, registered subjects or topics covered, and cell phone number (utilized for individual onboarding and schedule coordination).
  • Parent Data: Full name and cell phone number (utilized strictly for transaction distribution).
  • Financial & Transaction Data: Session logs, duration hours, unbilled balances, calculated base costs, billing statuses, and payment totals processed.

2. Google Workspace Data & Limited Use Policy

TutorPortal integrates with Google APIs to automate scheduling and administrative workflows. If you choose to authorize Google OAuth access, we access, use, and store data subject to the following strict limitations:

  • Google Calendar (`calendar.events`): We request read/write access to your calendar to automatically block out scheduled tutoring sessions and generate Google Meet conference links. We only manipulate events created by TutorPortal and do not extract or read your personal calendar events.
  • Google Drive (`drive.file`): We request restricted Drive access to automatically create isolated educational resource folders for your enrolled students. Our application can only view, modify, or access the specific folders it has explicitly created. We cannot access, read, or manipulate your broader personal Google Drive files.

TutorPortal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace data to develop, improve, or train generalized AI and/or machine learning models.

3. Purpose of Processing Data & Administrative Access

We collect and process personal data exclusively to fulfill our operational function as an administrative software utility. This includes:

  • Facilitating lesson scheduling, logging hours, and tracking unpaid accounts.
  • Generating explicit, customized transaction and onboarding itemization strings for distribution via WhatsApp directly to parents and students.
  • Client Portals / Parent Views: Generating secure, read-only, non-sequential unguessable URLs (UUIDs) that allow parents/guardians to review localized calendar views and session logs specifically tied to their child's student record.
  • Administrative Oversight: Authorized platform administrators have secure access to a master database directory to provide direct technical support, execute password reset protocols, and manage systemic data integrity.
  • Routing secure credit card payment compilation requests directly from invoice links and client portal instances to our payment gateway infrastructure provider.

We do not use your data for marketing profiling, and we will never sell, rent, or trade personal data to third-party marketing firms.

4. Third-Party Infrastructure Operators & Data Isolation

To host and run our scalable digital infrastructure securely, data is safely passed to and processed by our verified third-party technology providers:

  • Supabase (Data Storage): Personal records and transaction indices are housed within a cryptographically isolated cloud hosting environment utilizing strict Row-Level Security (RLS) policies. Read-only permissions for Client Portals are heavily constrained via strict database filtering schemas to ensure parents can only query data matching their exact, encrypted link token.
  • Paystack (Payment Processing): Payment flows are handled directly by Paystack's secure, PCI-compliant infrastructure. TutorPortal does not store or see credit card credentials.
  • Vercel (Application Hosting): The user interface and encrypted transmission routes run over forced HTTPS connections.

5. Client View Link Security Advisory

Because Client Portals rely on a secure token contained within the unique link string rather than a standard email password prompt, the user (parent/guardian) acknowledges that the confidentiality of the link rests entirely in their custody. If a link is forwarded or shared with a third party, that third party will be able to view the associated read-only student logs. You may request your tutor to reset or re-issue your profile identifiers if a leak is suspected.

6. Your Rights Under POPIA & Cascading Data Deletion

In terms of Section 24 of POPIA, all users possess the "Right to be Forgotten" and may request the absolute deletion or correction of their personal data assets. Due to our strict database architecture, requesting the deletion of a primary account (such as a Tutor or Agency profile) triggers a permanent, cascading automated purge. This means all linked student profiles, historical session logs, and financial records associated with that account are irreversibly wiped from our active servers. Requests for complete workspace deactivation can be directed to our system administrators or initiated by canceling your account.