Privacy Policy

1.Who we are and our role#

Tooition is operated by Vox Samples Pty Ltd (ABN 23 681 928 889 · ACN 681 928 889), Melbourne, Victoria, Australia. We provide software that independent teachers and schools use to run their teaching businesses.

We play two different roles, depending on whose information it is:

• Teacher accounts and tooition.com. For information about teachers and their staff, and about visitors to tooition.com, we decide how it is used. We are the “controller” (GDPR), the “business” (US state privacy laws), and the APP entity responsible for it under the Australian Privacy Act.
• Family data. Information about parents, guardians and students (often children) is collected by each teacher, for the teacher’s business. The teacher is the controller or “business” for that data, and Tooition is their processor or “service provider”. We only use it to provide Tooition to that teacher, under our Teacher Agreement.

If you are a parent, guardian or student, your teacher’s own privacy notice also applies, and your teacher is usually the best first contact for questions about your information. You can also contact us, and we will help.

2.Information we collect#

About teachers and their staff

• Account details: name, email address, password (stored only as a secure hash) and role.
• Business and website details: studio name, location, services, prices, policies, photos and other website content.
• Payments and billing: your plan and billing history, and your Stripe account ID and status. Stripe collects your identity and bank details for payouts; we don’t store full card or bank account numbers.
• If you verify a card to publish your site, the verification happens at Stripe. We keep only the result and Stripe’s reference to it.
• Support messages you send us.

About families (collected by the teacher; we process it for them)

• Parent or guardian details: name, email address and phone number.
• Student details: we ask for as little as possible about children, typically a first name or display name and an age band (under 13, 13 to 17, or adult) rather than a date of birth.
• Bookings, attendance, lesson history, and records of payments (amount, status and Stripe references, but never full card numbers).
• Teaching content: lesson notes, homework, teacher feedback, and practice recordings and files that families or teachers upload.
• Settings and consents, such as whether a parent has turned on the AI assistant for a child.

Collected automatically

• Technical and security data: IP address, browser and device type, pages requested, and timestamps, recorded in server, security and audit logs.
• Records of emails we send for teachers and for Tooition (recipient, type, time and delivery status).
• AI assistant usage counts (how many requests and their size), but not the content of conversations.
• Essential cookies only. See our Cookie Policy. We don’t use third-party analytics or advertising cookies.

3.How we use information#

• to provide Tooition: websites, bookings, payments, records, homework, recordings, family guides and the AI assistant;
• to process subscription and lesson payments with Stripe, and calculate platform fees;
• to send service emails, such as sign-in links, booking confirmations, receipts and reminders;
• to keep Tooition secure: preventing fraud, spam and abuse, reviewing sites, and investigating problems;
• to provide support and respond to requests;
• to understand how Tooition is used, in aggregate, and improve it; and
• to meet our legal obligations, such as tax and record-keeping.

What we don’t do: we don’t sell personal information. We don’t share it for cross-context behavioural advertising, or use it for targeted advertising. We never contact a teacher’s families or students for our own marketing. We don’t list teachers or students in a public directory.

If we send teachers product news, you can opt out at any time by emailing [email protected]. Service emails about your account will still be sent.

4.Legal bases (EU and UK)#

Where the GDPR or UK GDPR applies to information we control, we rely on:

• contract: to provide the service you signed up for;
• legitimate interests: to keep Tooition secure, prevent fraud, and improve it, where those interests aren’t overridden by your rights;
• legal obligation: for tax, accounting and other legal requirements; and
• consent: where we ask for it, such as for optional product emails. You can withdraw consent at any time.

For family data, the teacher is responsible for having a legal basis.

5.Children’s privacy#

Many students are children. Tooition is designed for teachers and parents, not for children to sign up on their own. Children under 13 use Tooition only through a parent or guardian’s account.

Our practices

• We collect the minimum information about children needed to provide lessons: usually a first name and an age band.
• We never sell children’s information and never use it for behavioural or targeted advertising.
• Practice recordings and files are private to the teacher and the linked parents or guardians. They are never made public, and file links are signed and expire.
• Recordings of minors are never used to train AI.
• The AI assistant is off for students under 13 unless a parent or guardian turns it on, and teachers can turn it off entirely.

Parental consent (including US COPPA)

In the United States, the Children’s Online Privacy Protection Act (COPPA) applies to children under 13. We have designed our practices with the amended COPPA Rule in mind, whose compliance date was 22 April 2026.

• Parental consent is given by the parent or guardian through their own guardian account, linked to their child’s record.
• A teacher or school may consent on a parent’s behalf only within the limits the FTC allows for school authorisation: where a school uses Tooition solely for its own educational purposes and for no other commercial purpose. Otherwise, consent must come from the parent or guardian.
• Parents and guardians can review their child’s information, ask for it to be deleted, and withdraw consent to further collection or use at any time. Ask your teacher, or email [email protected]. If consent is withdrawn, the teacher may no longer be able to provide some services through Tooition.

If you believe we hold a child’s information without proper consent, email [email protected] and we will investigate and, where appropriate, delete it.

6.The AI assistant#

• The assistant runs on Cloudflare Workers AI. Cloudflare does not use customer data to train its AI models.
• To answer helpfully, the assistant receives your question, the last few turns of the conversation, and relevant details from your account (for example, upcoming lessons, or a child’s first name and age band for a parent).
• We don’t store the content of conversations. Your history stays in your browser tab and is cleared when you close it. We store only usage counts and sizes.
• Messages from families are screened by a safety model before the assistant answers.
• AI output can be wrong. Don’t rely on it for medical, legal or financial advice.

7.Who we share information with#

• The teacher you deal with. Family data is available to the teacher (and the staff they authorise) who collected it. Teachers can’t see other teachers’ families.
• Our service providers (sub-processors), who run parts of Tooition for us under contract. See the Sub-processors list: AWS, Neon, Cloudflare and Stripe.
• Stripe, which processes payments and is also a controller of the payment information it collects, under Stripe’s privacy policy.
• Authorities, when the law requires it, or when we reasonably believe it’s needed to protect someone’s safety (especially a child’s), to prevent fraud or to enforce our terms.
• A buyer or successor if our business is sold or restructured, under the same protections as this policy, and we’ll tell teachers.
• Anyone else you ask us to, with your permission.

We use the Frankfurter service for currency exchange rates, but no personal information is sent to it.

8.Where information is stored, and overseas transfers#

Tooition’s data is stored in the United States, in AWS’s us-east-1 region (Northern Virginia), with files in Cloudflare R2. Cloudflare’s global network may also handle web traffic and AI requests at locations near the user.

Australia (APP 8). Using Tooition means personal information is disclosed to, and stored by, recipients in the United States (our sub-processors listed above), and may pass through other countries on Cloudflare’s network. Before disclosing it, we take reasonable steps to ensure these recipients handle it consistently with the Australian Privacy Principles, including through contracts that require them to protect it.

EU and UK. When we transfer personal information from the EU, EEA or UK to the United States, we rely on the European Commission’s Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, with our own providers and with teachers as set out in the Teacher Agreement.

9.How long we keep information#

We may keep information longer if the law requires it, or if it’s needed for an ongoing legal claim or investigation. Families can ask their teacher, or us, to delete their information.

10.How we protect information#

We use practical safeguards, including:

• encryption in transit (HTTPS/TLS) and encryption at rest by our hosting and storage providers;
• Cloudflare’s firewall and bot protection in front of our servers, which are not exposed directly to the internet;
• passwords and sign-in tokens stored only as secure hashes, and separate sign-in sessions for the teacher dashboard and each family portal;
• secrets and keys kept in AWS Secrets Manager, not in our code;
• checks in the application that keep each teacher’s data separate from other teachers’ data;
• private files served only through signed, expiring links; and
• access to production systems limited to the people who need it, with audit logs.

No system is perfectly secure, and we can’t guarantee security. Tooition does not currently hold third-party security certifications (such as SOC 2 or ISO 27001), and it isn’t designed for health records or other HIPAA-regulated information. Please don’t store that kind of information in Tooition.

Data breaches

If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and give notices required by US state breach laws, the GDPR and other laws that apply. Where family data is affected, we will tell the teacher without undue delay so they can meet their own obligations, and help them notify families.

11.Your rights and choices#

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, to object to or restrict some uses, and to withdraw consent. To make a request, email [email protected]. We’ll respond within 30 days (or sooner if the law requires), and we may need to verify your identity first. You won’t be treated differently for using your rights.

If your request is about family data a teacher holds, we’ll usually pass it to the teacher, or help them respond, because they control that data.

Australia

Under the Privacy Act 1988 and the Australian Privacy Principles, you can ask to access and correct your information. If you’re unhappy with how we handled your information, please complain to us first at [email protected]. We’ll respond within 30 days. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

United States

Residents of California and other states with consumer privacy laws can ask to know, access, correct or delete their personal information, and can use an authorised agent. If we decline your request, you can appeal by replying to our decision, and you may contact your state attorney general if you disagree with the outcome.

EU and UK

You also have the right to data portability and to lodge a complaint with your local data protection authority, or in the UK, the Information Commissioner’s Office.

12.Do Not Sell or Share (US)#

We don’t sell or share personal information, as “sell” and “share” are defined by the California Consumer Privacy Act (as amended by the CPRA) and similar state laws, and we haven’t done so in the past 12 months. We don’t knowingly sell or share the information of anyone under 16. Because there is nothing to opt out of, there is no “Do Not Sell or Share” setting to change.

In the past 12 months, we collected these categories of personal information for the purposes in this policy: identifiers (such as names and emails), customer records, commercial information (bookings, plans and payment records), internet activity (security and usage logs), audio and visual information (practice recordings and photos), and account login details (used only to sign you in). We disclose them only to the recipients described in Who we share information with.

13.Changes to this policy#

We’ll update this policy as Tooition changes and show the date at the top. If a change materially affects how we use personal information, we’ll email teachers before it takes effect, and where the law requires (for example, under COPPA), we’ll seek fresh consent.

14.Contact us#

Privacy questions, requests or complaints: [email protected]. Vox Samples Pty Ltd, Melbourne, Victoria, Australia. ABN 23 681 928 889 · ACN 681 928 889.