Privacy Policy

TutorHut ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using the TutorHut platform at tutorhut.co.uk, you agree to the collection and use of information in accordance with this policy.

1. Data Controller

TutorHut is the data controller for personal data collected through this Platform. If you have any questions about this policy or your personal data, please contact us at privacy@tutorhut.co.uk.

2. Information We Collect

2.1 Students

Data	How collected	Purpose
First name, surname	Registration form	Account creation and communications
Email address	Registration form / Google sign-in	Authentication and notifications
Subjects of interest	Registration form	Matching with suitable tutors
Academic level	Session request form	Tutor matching
Payment records	Stripe (tokenised)	Introduction fee processing
IP address, device info	Automatically on use	Security and fraud prevention

2.2 Tutors

Data	How collected	Purpose
Full name, email, phone	Registration form	Account and communications
Address	Registration form	Identity and DBS checks
Qualifications and subjects	Registration form	Profile creation and verification
Profile photo	Upload	Public tutor profile
Verification documents (DBS certificate, ID, qualifications, right-to-work)	Document upload portal	Admin verification; stored securely in Google Drive
DBS certificate number and Update Service ID (optional)	Registration form	DBS status checks
Hourly rates	Registration form	Displayed on public profile
Bank account details (tokenised)	Stripe Connect onboarding	Payment of introduction fees
IP address, device info	Automatically on use	Security and fraud prevention

3. How We Use Your Information

We use your personal data to:

• Create and manage your account
• Facilitate connections between students and tutors
• Process and record payments via Stripe
• Verify tutor qualifications and identity documents
• Display tutor profiles to students
• Send transactional emails (account registration, application status, payment confirmation)
• Moderate reviews and user content
• Detect and prevent fraud and abuse
• Comply with our legal obligations

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal Basis for Processing

• Contract performance — processing necessary to provide the service you signed up for (account creation, payment, connecting you with a tutor)
• Legitimate interests — fraud prevention, platform security, improving the service
• Legal obligation — where we are required to process data by law
• Consent — where we have obtained your explicit consent (e.g. marketing emails, if any)

5. Data Storage and Security

Your data is stored using the following services, all of which are compliant with UK GDPR:

• Google Firebase — authentication (email and password; Google sign-in)
• Google Sheets — student and tutor records, connection requests, reviews
• Google Drive — tutor verification documents (access restricted to admin team only)
• Stripe — payment processing; card and bank details are never stored by TutorHut directly

Access to all stored data is restricted to authorised TutorHut administrators. We use HTTPS for all data transmission. Passwords are not stored in plaintext; authentication is handled entirely by Google Firebase.

6. Data Sharing

We do not sell, rent, or trade your personal data to third parties. We share data only in the following limited circumstances:

• Stripe — to process payments and pay tutors (subject to Stripe's Privacy Policy)
• Google — Firebase and Drive services (subject to Google's Privacy Policy)
• Between students and tutors — once a student pays the introduction fee, their name and contact details may be shared with the relevant tutor, and the tutor's contact details are disclosed to the student. Both parties consent to this at the point of the connection request.
• Legal requirements — where required by law, court order, or regulatory authority

7. Tutor Verification Documents

Documents uploaded by tutors (DBS certificates, ID, qualifications, right-to-work evidence) are stored in a restricted Google Drive folder accessible only to the TutorHut admin team. These documents are used solely for verification purposes and are not shared with students or any third party, except where required by law.

8. Retention

We retain your personal data for as long as your account is active. If you request deletion of your account:

• Your Firebase authentication account is deleted immediately
• Your profile data in our records is anonymised or deleted within 30 days
• Payment records may be retained for up to 7 years to comply with financial record-keeping requirements
• Tutor verification documents are deleted within 30 days of account deletion

9. Cookies

TutorHut uses minimal cookies:

• Session/authentication cookies — set by Google Firebase to keep you signed in; strictly necessary
• Preference cookies — to remember your theme preference (light/dark); stored in localStorage

We do not use advertising or tracking cookies. No third-party analytics scripts are loaded.

10. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your data (subject to legal retention obligations)
• Restriction — ask us to restrict processing of your data in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at privacy@tutorhut.co.uk. We will respond within 30 days.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Children's Privacy

Students under the age of 16 must have parental or guardian consent before registering. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has registered without consent, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or by a prominent notice on the Platform. The updated policy will show a revised "Last updated" date at the top.

13. Contact

For any privacy-related questions or requests:

• Email: privacy@tutorhut.co.uk
• Via our website: Contact page