Legal
Compliance
What we do to help a center follow US student-privacy rules, and what we don't claim.
- Encrypted with HTTPS
- Access by role
- Nightly backups
- Activity log
- Two-step sign-in
- No ads, no selling data
Last updated: October 31, 2026
Who is responsible for what
The center decides what it collects and why. We are its service provider and handle records on its instructions. The software helps, but the center stays responsible for its own notices, consents and policies. This is not legal advice.
FERPA
FERPA covers schools that receive US Department of Education funds. A private tutoring center is often not covered, but one working for a school or district may be. Where it applies, we act under the center's direct control, use records only to provide the service, and the center can export them or ask us to remove them.
| Who | What FERPA lets them do |
|---|---|
| Parents | See their child's education records, ask for corrections, and decide who else gets them (with some exceptions). |
| Students 18 or older | These rights pass from the parent to the student at 18 or on starting college. |
| The center | Decides how to answer. We help it find, export or correct the records. |
FERPA does not cover every private center. Whether it applies to yours depends on its contracts with schools or districts. We do not say the software makes a center "FERPA compliant", because no such certification exists.
COPPA
For children under 13, the center gets a parent's consent first and we process the child's information only for the center. No ads, no selling children's information, no profiles. There is no field for a date of birth or government ID. Parents ask the center to review, correct or delete.
| Rule | In practice |
|---|---|
| Parent consent first | The center gets a parent's consent before a child under 13 has a sign-in or has personal information collected. |
| No ads | Children's information is never used for advertising. |
| No selling | Children's information is never sold or shared for advertising. |
| No profiles | We do not build profiles of children. |
| Less data | No field for a date of birth, a Social Security number or other government ID. |
| Review and delete | A parent asks the center. We help it carry the request out. |
California (CCPA and CPRA)
We are a service provider: we don't sell personal information, don't share it for cross-context behavioral advertising, and use it only for the service. Rights are explained in the Privacy policy.
State student-privacy laws
Several states have laws made for student data, mostly aimed at schools and the companies they hire. At a high level:
- California SOPIPA: bars targeted ads, profiles and selling of student information by services used for K-12 school purposes, and asks for reasonable security. We do none of the three.
- New York Education Law 2-d: applies to New York schools and districts and the vendors they hire. A district may ask a vendor for written data-protection terms and quick breach reports. If a district asks, we can talk about such terms in writing.
- Other states: Illinois, Colorado and many others have similar laws. Whether one applies to a private center depends on its contracts with schools.
- Built to support, not certified: we do not claim compliance with any of these laws. Ask counsel what applies to your center.
Email and text messages (CAN-SPAM and TCPA)
CAN-SPAM covers commercial email. The TCPA covers texts and calls. The center is the sender of the messages it asks the software to send, so it carries the duty to have consent. The software is built to support that.
| Channel | What the software does | What the center does |
|---|---|---|
| Optional emails, such as reports and notes, go only to parents who agreed. If a parent unsubscribes or reports spam through the email provider, optional emails to that parent stop. Lesson changes and bills still go. | Sends only about its own classes, under its own name, and does not use the software to advertise to people who did not ask. | |
| Text (SMS) | Texts go only to parents with text consent on record. Replying STOP, CANCEL, END, QUIT or UNSUBSCRIBE turns texts off. Texting works once the center connects Twilio. | Gets clear consent before texting, says what the texts are about, and keeps marketing out of them. |
| Consent is recorded with its date. Replying STOP or UNSUBSCRIBE stops the messages. | Sends from its own number and follows WhatsApp's rules. |
Accessibility (ADA and WCAG 2.1 AA)
We want people with disabilities to be able to use this website and the apps. We build toward WCAG 2.1 level AA, the yardstick US courts and agencies often use for the ADA. We have not had an independent accessibility audit, so we do not claim conformance.
- On this website: a skip-to-content link, text alternatives for images, a language set on every page, and a layout that works on a phone.
- The office, parent and tutor apps have not been checked against WCAG yet.
- Found a barrier? Use our contact form with the page and what went wrong. We aim to reply within one business day and work on a fix.
Payments, tax and tutor pay
What the software does about money and tax today, and what it leaves to the center and its accountant.
| Topic | Status | Details |
|---|---|---|
| Tax line | Included | Each center sets one tax rate and label. Payment requests show the tax amount, included in the total by default. |
| Card payments | Included | Parents pay by card on Stripe's own page. MeetMyTutor does not store card details. |
| Tutor pay records | Included | Tutors get pay statements and invoices, and the office sees what is owed. |
| Sales tax by state | Not included | The software does not work out sales tax by state or file returns. The center sets its rate by hand. |
| 1099 and W-9 forms | Not included | No W-9 collection and no 1099 forms. How a center classifies its tutors is its own decision: ask an accountant. |
Security controls in place today
- The server decides what each person sees, not just the screen. Staff without accounts permission don't see money.
- An authenticator app with recovery codes, or an emailed code, for staff, tutors, parents and students.
- Stored as salted scrypt hashes. Failed attempts slow down and sessions end after 12 hours.
- Every change is recorded with who and when. It is append-only, so entries can't be edited or removed.
- All traffic uses HTTPS. Saved credentials use AES-256-GCM with a key outside the database. Off-site backups use the center's passphrase.
- A copy every night, 14 kept. A restore was last tested on October 5, 2026.
- Only authorized office staff connect or disconnect outside services, and saved credentials show only as a mask.
What we do not claim
MeetMyTutor does not currently hold a SOC 2 report, ISO 27001 certification, HITRUST, HIPAA attestation or any other third-party certification, and we do not claim to be "FERPA certified" or "COPPA certified", because no such certification exists. We do not offer a signed data processing agreement or a security questionnaire response unless we agree one with the center in writing.
This page describes how the software works today. It is not a guarantee, and it does not replace the center's own legal advice.
Incidents and contact
If we learn that a center's records were accessed without permission, we tell the center without undue delay so it can meet its own duties to families.
Questions, security reports and requests for our data practices: contact form. More detail is on Trust and data.
Every US state has its own breach-notification law. These usually ask the owner of the records, here the center, to tell affected families and sometimes a state office. Because we hold the records for the center, we tell the center what we know, early and in writing, so it can meet its own deadlines. This is not legal advice.
Questions about these pages?
Write to us and we reply within one business day.