Privacy Policy

Last updated: 25 July 2026

TutorPax is operated by [legal entity name], [registered address], Belgium ("TutorPax", "we", "us"). This policy explains what personal data we process, why, and what rights you have under the GDPR. Contact for anything privacy-related: hello@tutorpax.com.

Two roles: our data and your site's data

For tutors' accounts, billing, and our waitlist, TutorPax is the data controller. For personal data that a tutor's own website collects from its visitors and students — contact messages, newsletter signups, reviews, course enrollments — the tutor is the controller and TutorPax is a processor hosting that data on the tutor's behalf. Students should direct privacy requests about a tutor's site to that tutor first; we support tutors in fulfilling them.

What we process, and why

Tutor accounts: your Google account name, email, and identifier, used to sign you in and run your dashboard (legal basis: contract). Sites and content: the pages, images, and course videos you upload, hosted to provide the service (contract). Billing: your subscription plan and status, and Stripe customer/subscription references — card details go directly to Stripe and never touch our servers (contract, legal obligation for bookkeeping). Student accounts: Google sign-in data and course enrollments so purchased content stays accessible (contract, on the tutor's behalf). Waitlist: the email address you give us, used only to tell you about TutorPax's launch (consent — withdraw any time by emailing us). Security logs: request metadata we need to keep the platform safe, such as rate-limit counters (legitimate interest).

Cookies

TutorPax sets only strictly necessary cookies: the session cookies that keep you signed in (shared across tutorpax.com subdomains so students stay signed in on tutor sites). We set no advertising or cross-site tracking cookies and run no third-party analytics scripts, which is why you see no cookie banner. If we ever introduce non-essential cookies, we will ask for consent first.

Who processes data for us

We use a small set of processors, each bound by data-processing agreements: Supabase (database and authentication, hosted in the EU — Stockholm), Stripe (payments), Cloudflare (media storage and delivery), Vercel (application hosting), and Google (sign-in). Where a processor handles data outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. We do not sell personal data.

Retention

Account and site data is kept while your account is active and deleted when you delete your site or account (backups purge on a rolling schedule). Billing records are kept as long as Belgian tax and accounting law requires. Waitlist emails are deleted once the waitlist ends or when you ask us to remove you.

Your rights

Under the GDPR you can request access to, correction of, deletion of, or a portable copy of your personal data, object to or restrict certain processing, and withdraw consent at any time. Email hello@tutorpax.com and we will respond within 30 days. You can also lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).

Children

Tutor accounts are for adults (18+). Tutors' students may be minors; tutors are responsible for ensuring they may lawfully offer their services to minors and for obtaining any parental consent their situation requires.

Changes

If this policy changes materially, we will announce it by email or in your dashboard before the change takes effect.