Privacy policy

Who this covers

Your tutoring center (the center) runs its own MeetMyTutor account and decides what it collects and why. MeetMyTutor provides the software and handles the records for the center, as its service provider. If you are a parent, student, tutor or coordinator, your center is the first place to ask about your records.

This page also covers people who visit meetmytutor.com or write to us. It does not cover a center's own website, its own forms or its own policies.

What is collected

Parents: name, email address, phone or WhatsApp number, your choices about email and WhatsApp messages (with the date), your children, messages, bills and payments.

Students, including children: first and last name, grade, an email address if the center or parent adds one, classes, attendance, tutor notes, homework, progress and messages. MeetMyTutor has no field for a date of birth, a Social Security number or other government ID.

Tutors: name, contact details, the classes they run, registers, pay statements and invoices.

Coordinators and office staff: name, email, role and permissions, and what they change in the system.

Sign-in security: a salted hash of your password (never the password itself), and, if you switch on the authenticator app, its secret, recovery codes and the devices you chose to remember.

Website visitors: if you fill in a form on this site we keep what you type (name, email, center name, number of students, locations, website) to reply to you. Please do not include any child's details. Our hosting provider and Google Fonts also see your IP address and browser details when a page loads.

Why it is used

To run the center's classes, registers, messages, billing and reports.

To sign people in and keep accounts safe.

To send the messages the center asks the software to send.

To keep backups, find and fix faults, and answer support questions.

We do not sell personal information, we do not share it for advertising across other sites, and we do not use children's records for advertising or to build profiles.

Children under 13 (COPPA)

Records about children are created by the center or by a parent. The center is the operator under the Children's Online Privacy Protection Act (COPPA) and is responsible for getting a parent's consent before a child under 13 has a student sign-in or has personal information collected. We process a child's information only for the center and only to provide the service.

A parent can ask the center to show what it holds about their child, correct it, delete it, or stop further collection. If a parent writes to us instead, we pass the request to the center and help it carry the request out.

If you believe a child's information was added without a parent's consent, use our contact form and we will work with the center to remove it.

Who else receives data

In plain words: we do not sell or share personal data, and every provider below acts only for the center.

Our commitments

• Providers use data only to provide the service to the center. Not for their own ads, profiling or resale. This is the limit the CCPA and CPRA put on a service provider, and California's SOPIPA asks the same.
• The center stays in control of its records. Where FERPA applies, MeetMyTutor acts like a school-official-style service provider, under the center's direction.
• No child's information is disclosed for advertising (COPPA). No sale, no sharing, no cross-context behavioral advertising.
• Our policy is to use only providers that commit in writing to confidentiality and security.
• The center sees which providers it has switched on, in Settings, and can turn each one off.
• We email the center before a new provider receives its data.
• The hosting provider and the server's location are confirmed to the center in writing before it signs. Data stays where that confirmed location is. A center that connects a service outside the US decides that transfer.
• We disclose information to authorities only as far as the law requires, as narrowly as we can, and we tell the center first where the law allows. Nothing here is sold.

How long it is kept

Records stay while the center's account is active. A student who leaves is archived, not deleted, so balances and history still add up. The center decides what to keep and what to remove.

A copy of the database is saved every night, and the 14 most recent copies are kept. Sign-in sessions end after 12 hours. A remembered device for the authenticator app lasts up to 90 days unless it is removed sooner.

When a center's agreement ends, we return its records and delete them from our systems as the agreement says. Enquiries from website visitors are kept for as long as we need them to reply and to keep a record of the conversation.

A center can set a retention period of 6 years or more. When its daily retention run is switched on, messages and ended subscriptions older than that are pseudonymised: their text and recipient name are replaced, while dates and totals stay so history still adds up.

Export and deletion

Staff with the export permission can download the center's records from Settings at any time, as Excel, CSV or PDF.

To have a family's data removed, ask your center's office. The center decides what it must keep, for example financial records, and we carry out the removal with it. There is no self-service delete button in the app yet.

Security

Access is decided by role and enforced on the server. Sign-in can use an authenticator app. Every change goes to an activity log that cannot be edited. Traffic is encrypted with HTTPS, and saved credentials and off-site backups are encrypted. Details, and what we do not claim, are on the Compliance page.

If we learn that records were accessed without permission, we tell the center without undue delay, so it can meet the breach-notification law of its state. More on the Compliance page.

Your rights, including in California

Depending on where you live, you may have the right to know what personal information is held about you, to get a copy, to correct it, to delete it, and to opt out of its sale or sharing. California residents have these rights under the CCPA as amended by the CPRA, and you will not be treated worse for using them. MeetMyTutor does not sell or share personal information as those laws define the terms.

For records held by a center, make the request to the center. It decides how to respond, and we help it. For information we hold ourselves, such as a website enquiry, use our contact form. We may need to confirm who you are, and we reply within 45 days. An authorized agent may write on your behalf.

Your rights under US state privacy laws

California and a growing number of other states, for example Virginia, Colorado, Connecticut and Texas, give residents privacy rights. Details differ by state. This is the plain version.

Global Privacy Control: our website sets no advertising or tracking cookies, so a Global Privacy Control signal from your browser has nothing to switch off. We treat the signal as an opt-out request anyway.

How to make a data request

State student-privacy laws

Several states have laws made for student data, mostly aimed at schools and the companies they hire. At a high level:

• California SOPIPA: bars targeted ads, profiles and selling of student information by services used for K-12 school purposes, and asks for reasonable security. We do none of the three.
• New York Education Law 2-d: applies to New York schools and districts and the vendors they hire. A district may ask a vendor for written data-protection terms and quick breach reports. If a district asks, we can talk about such terms in writing.
• Other states: Illinois, Colorado and many others have similar laws. Whether one applies to a private center depends on its contracts with schools.
• Built to support, not certified: we do not claim compliance with any of these laws. Ask counsel what applies to your center.

Email and text messages (CAN-SPAM and TCPA)

CAN-SPAM covers commercial email. The TCPA covers texts and calls. The center is the sender of the messages it asks the software to send, so it carries the duty to have consent. The software is built to support that.

Changes and contact

If we change this page we change the date at the top, and for a significant change we tell centers by email.

MeetMyTutor. Contact: contact form.