Privacy Policy
How TutoringHQ records, uses and protects personal data
1. Who we are and what this covers
1.1 TutoringHQ is a product of Eyad Elhawary for Programming and Artificial Intelligence Solutions, a limited liability company registered in Egypt under Commercial Register No. 307454, with its registered office in 6th of October City, Giza, Egypt ("we", "us").
1.2 This policy covers the websites tutoringhq.app and app.tutoringhq.app, the TutoringHQ app, our AI assistant Tarek, the pages and links we send to parents and students, and our referral and affiliate programs. It applies to:
- visitors to our websites, and people who join our waitlist or ask to be contacted;
- center owners, private teachers and their staff who use the app (account holders);
- parents, guardians and students whose records a center or teacher keeps in the app;
- members of our referral and affiliate programs.
1.3 We process personal data under Law No. 151 of 2020 on the Protection of Personal Data and its executive regulations (the "PDPL").
2. Our two roles
2.1 For students and parents, your center or teacher is in control. The center or teacher decides what to record about you and why. They are the controller of that data, and we process it only on their instructions, as their processor. If you are a student or a parent and want to see, correct or delete your data, please ask your center or teacher first. If they have closed or cannot help, you can contact us directly (section 12).
2.2 For everything else, we are in control. We are the controller for data about our website visitors, account holders, and program members, and for the security and billing records we keep ourselves.
3. What we record
3.1 Website visitors and waitlist
- If you join the waitlist or ask us to contact you: your name, phone number, whether you are a center or a teacher, your center's name, and your answers about your size, budget, goals and current tools, and any referral code you used.
- Technical data: your IP address, browser and device type, the pages you visit and how you use them (section 3.6 and the Cookie Policy).
- A check on some forms that confirms the visitor is a person, not a bot.
3.2 Account holders
- Your name, mobile number, role and staff permissions.
- Your PIN, which is stored only in scrambled (hashed) form by our login provider, never in readable form. One-time codes are also stored only in hashed form. Login codes expire after 10 minutes, and codes that verify a data rights request after 30 minutes.
- Your center's or practice's details, including the InstaPay details you choose to show parents on invoices.
- Your subscription, invoices and payment records with us.
- Your conversations with the AI assistant, and records of voice calls with Tarek (section 6).
- Records of actions taken in your account, for security and to resolve disputes.
3.3 Students and parents (entered by the center or teacher, or by the family through a join link)
- The student's name, the student's phone number (if given), the parent's phone number, the student's grade and subjects, the student's number at the center, and whether the student is an adult (18 or over).
- Groups, schedules, attendance, fees, invoices, balances and payment status.
- Receipt images that a parent uploads. A receipt can show the payer's name and bank details.
- Consent records: when and how the parent agreed, and, if the family joined through a link, the name and relationship of the guardian who agreed; an adult student's own answer; and any notice sent to a parent and the parent's reply.
- Message preferences, sibling links and waitlist position.
3.4 Payments to us
When a center or teacher pays us by InstaPay, we receive the transfer proof they upload, which can show the sender's name and account details, and we check it against our own account. When card payment is offered and used, our payment processor receives the payer's name and phone number. We never see or store card numbers.
3.5 Program members
National ID number, tax registration number, InstaPay payout details, the invoices affiliates send us, and records of rewards and payouts.
3.6 Screen recordings
Our analytics provider records screens on our websites, in the app and on the pages parents open from our links, so we can find and fix problems. A recording shows what appears on the screen, which can include the names of students and parents shown on a page. Everything typed into a form is hidden. Recordings are kept for 30 days.
3.7 What we do not record
We do not record card numbers, dates of birth, health information, biometric data, religion or political views. We do not buy personal data from other sources.
4. How we use personal data, and why we are allowed to
| Purpose | Data used | Legal basis |
|---|---|---|
| To provide the service to centers and teachers | Account and student/parent data | Our contract with the center or teacher; for student and parent data, the center's own basis, including parent consent |
| To send messages the center or teacher chooses to send | Names, phone numbers, fees, attendance | The center's instructions, based on parent consent |
| To bill for our service and keep tax records | Account, invoice and payment data | Our contract, and our legal duties under tax law |
| To run the AI assistant | Masked questions, account data | Our contract with the center or teacher |
| To train and improve the AI assistant, and to develop our own AI models | Tarek call recordings, masked chat records, and data with every personal detail removed | Our legitimate interest in a better service; chat records can be switched off (section 6) |
| To keep the service secure, prevent fraud and fix errors | Technical data, activity records, error reports | Our legal duty to protect data, and our legitimate interest in a working service |
| To prevent abuse of trials, referrals and unpaid invoices | The phone numbers of account owners and staff, the InstaPay details saved on accounts, and parents' phone numbers held in the service, which may be compared across accounts | Our legitimate interest in preventing fraud and recovering amounts owed. The result is used only to refuse or end a trial, to refuse or stop another account until an amount owed is paid, or to place a referral under review, and never reveals one customer's students or parents to another customer |
| To understand how our websites and app are used, and to find problems | Analytics and screen recordings | Our legitimate interest in a working, usable service |
| To measure our advertising | Advertising measurement tools on our public pages, and a signup notice our server sends to the social network when a center or teacher creates an account (IP address, browser type and the ad click id; never a phone number, a name or any student data) | Our legitimate interest in knowing whether our advertising works |
| To contact waitlist members about the launch | Waitlist data | Your consent, which you can withdraw at any time |
| To run the referral and affiliate programs | Program member data | Our contract with the member, and tax law |
5. Children and guardian consent
5.1 Most students on TutoringHQ are children, meaning they are under 18. We treat all data about children as sensitive data, with the extra protection the PDPL requires.
5.2 A center or teacher must obtain a parent's consent before entering a child's data. The app records that consent in one of these ways: the center or teacher confirms it has the parent's consent; the parent answers a consent request we send to the parent's phone; or, when a family joins through a link, the parent or legal guardian confirms it, gives their name and relationship, and ticks the box agreeing to receive messages. A parent's yes to a consent request covers each of their children registered with that number at the same center or teacher. When a private teacher adds a student through the AI assistant, we may also send the parent a notice naming the teacher, which the parent can answer to object.
5.3 Students do not have their own login. Messages go to the parent's phone. The app sends messages to a student's own phone only when the student is marked as an adult and has agreed on their own phone; when an adult student pays their own fees, in which case billing messages reach them without waiting for their agreement and other messages wait for it; or when a child has been made the payer of their own fees with the parent's consent, in which case only billing messages go to that child's phone. If an adult student refuses, no message about them is sent to anyone, except billing messages to a parent who pays their fees.
5.4 We never use children's data for advertising or marketing, we never sell it, and advertising measurement tools never load inside the app or on any page a parent or student opens.
5.5 A parent may withdraw consent at any time by telling the center, or by using the request form in section 12. The center must then stop using the data for any purpose that depends on that consent.
6. The AI assistant and automated processing
6.1 Our AI assistant, Tarek (also shown as THQ AI), answers account holders' questions by text and voice. Before a question leaves our systems, student names and student numbers are replaced with codes, and anything that looks like a phone number is removed. The masked text is sent to our AI provider to write an answer, and may be sent to a second AI service that only recognizes the type of question. Photos, PDF files and voice notes sent to the assistant go to our AI provider as they are, because their content cannot be masked, and the app says so before they are sent. We do not store voice notes.
6.2 Voice conversations with Tarek run through our voice AI provider, which converts speech and uses AI models to respond. Calls are recorded and transcribed, and callers are told this at the start of each call. Our voice AI provider keeps the recordings and transcripts, and we use them to train and improve Tarek. You can ask us to delete the recording of your call at any time (section 12). For account holders, we also keep a masked summary and a masked transcript for 90 days.
6.3 We keep copies of chats with the assistant, with names and phone numbers removed, to improve it. A center or teacher can switch this off in its AI settings. We may also use data from which every personal detail has been removed, such as the patterns of questions and answers, to develop and train our own AI models. That data does not identify any person.
6.4 The assistant never changes a record without an account holder's confirmation, and it does not make decisions about anyone that have legal or similarly significant effects.
6.5 If receipt reading is switched on, an AI model from our AI provider reads the amount and reference on an uploaded receipt so the center can compare it with the invoice. The center still decides whether the payment arrived.
7. Who else receives personal data
7.1 Service providers. We use service providers of the kinds listed below to run the service. Each receives only what it needs, under a contract that requires it to protect the data. You can ask us for their names.
| Service | What it does | Where |
|---|---|---|
| Database and hosting | Stores the database, logins and files | United Kingdom |
| Website and app servers | Runs our websites and app | United States |
| File storage and backups | Stores uploaded files and nightly backups | Western Europe |
| Weekly backups | Stores weekly backup copies, with children's and parents' names and numbers replaced | United States and other locations |
| Bot checks | Checks that a form is sent by a person | Global network |
| AI services | Writes assistant answers, transcribes voice notes and reads receipts | United States, China and other locations |
| Question classification | Recognizes the type of a masked question | United States |
| Voice AI | Runs voice calls with the assistant, and keeps recordings and transcripts | United States |
| Support quality review | Reads chats and calls with our assistant to find mistakes and suggest fixes | United States |
| Text messages | Sends text messages and one-time codes | Egypt |
| Backup code delivery | Delivers one-time login codes if the main route fails | United States |
| Rate limiting | Limits repeated attempts to protect logins and forms | Ireland |
| Card payments | Processes card payments to us | Egypt |
| Analytics | Product analytics and screen recordings | United States |
| Error reports | Error reports, with personal data removed before sending | Germany |
| Advertising measurement | Measures our advertising on our public marketing pages, and receives a signup notice from our server when an account is created | United States |
7.2 Centers and teachers. A parent's and student's data is visible to the center or teacher that holds it, and to the staff that center or teacher allows.
7.3 Authorities. We disclose data when Egyptian law or a competent court or authority requires it.
7.4 A change of ownership. If the company or the service is sold or merged, the data may pass to the new owner, who must keep this policy.
7.5 We do not sell personal data.
8. Where data is stored and sent
8.1 Our main database is in the United Kingdom. Some providers in section 7 process data in the European Union, the United States and China.
8.2 We transfer personal data outside Egypt only as the PDPL allows, including with any license or permit the Personal Data Protection Center requires, and only to providers bound by contract to protect it. We reduce what leaves our systems, for example by masking names before AI processing and removing personal data from error reports.
9. How long we keep data
| Data | How long |
|---|---|
| Student and parent records | While the center's or teacher's account is open, until the center deletes them, or until a verified erasure request |
| Account holder data | While the account is open, then as in the last row |
| AI assistant chats | While the account is open |
| Masked AI records, tool records and unanswered questions | 90 days |
| Tarek call summaries and masked transcripts kept by us | 90 days |
| Tarek call recordings and transcripts kept by our voice AI provider | Kept to train and improve Tarek, until deleted on request |
| One-time codes | Login codes expire after 10 minutes and data request codes after 30 minutes; phone call codes are deleted after 1 day |
| Receipt images | While the related invoice is kept |
| Invoices and payment records | Five years after the end of the financial year, as tax law requires |
| Program member papers and payout records | Five years after the last payout, as tax law requires |
| Waitlist and contact requests | Until launch plus 12 months, or until you ask us to delete them |
| Screen recordings | 30 days |
| Analytics events | Up to 7 years |
| Error reports | Up to 90 days |
| Backups | Up to 12 months, then deleted in rotation |
| Closed accounts, and trials that end without payment | Six months from the last activity, then deleted or anonymized, except invoice and tax records |
| Transfer proofs for payments to us | With the invoice they pay |
| Do-not-contact list | The phone number only, kept after an erasure of the other data |
We keep the business contact details of tutoring centers and teachers we have contacted, so we never contact the same business twice and can honor any request not to be contacted.
10. How we protect data
- All connections to our services are encrypted, and stored data is encrypted by our hosting providers.
- PINs, one-time codes and the tokens in parent links are stored only in hashed form.
- Each center's data is separated from every other center's, and staff see only what the center allows.
- Names and phone numbers in typed text are masked before AI processing, and personal data is removed from error reports.
- In our weekly backups, children's and parents' names and phone numbers are replaced with made-up values.
- Parent links expire: invoice upload links after 48 hours and weekly parent links after 30 days. Erasure cancels them at once.
- Our team is bound by confidentiality, and access to sensitive data such as national IDs is limited to the people who need it.
If a breach puts personal data at risk, we notify the Personal Data Protection Center within 72 hours and the affected people as the PDPL requires. Where we act as a processor, we notify the center or teacher so they can do the same.
11. Your rights
11.1 Under the PDPL you have the right to:
- know what personal data about you is held, and get access to it and a copy of it;
- have inaccurate or incomplete data corrected or completed;
- have your data deleted;
- have its use restricted;
- object to its use;
- withdraw consent at any time, without affecting what was done before;
- be told about a breach that affects your data.
11.2 We act on a verified request within 30 days, free of charge. If a request is complex, we may need up to 30 more days, and we tell you why within the first 30. To verify you, we send a one-time code to the phone number on the record. We never ask for your PIN.
11.3 Some data may be kept after a deletion request where the law requires it, for example invoices for tax purposes, or to defend a legal claim. Payment, attendance and invoice records linked to a deleted student are kept in a form that no longer identifies anyone. Backup copies are removed when their rotation ends. If a family's phone number is on our do-not-contact list, it stays there after their data is erased, and that number receives no marketing message and no consent request.
11.4 We may refuse a request, fully or in part, when:
- we cannot confirm who you are;
- the request is about a student and does not come from their parent, or from the student once they are an adult;
- for a request to delete, the law requires us to keep the data;
- for a request to delete, we need the data to defend a legal claim;
- the same request is repeated without a new reason.
If we refuse, we tell you why, and you can complain to the Personal Data Protection Center.
11.5 If you are not satisfied with our answer, you may complain to the Personal Data Protection Center.
12. How to make a request
Students and parents: please ask your center or teacher first. If they have closed or cannot help, or if you are an account holder, website visitor or program member, use the data rights request form at tutoringhq.app/legal or email support@tutoringhq.app with the subject "Data protection".
13. Marketing
13.1 We do not send marketing messages to parents or students.
13.2 We send marketing messages to account holders and waitlist members only with their consent. Each message says it is from TutoringHQ and explains how to stop further messages, and you can opt out at any time.
13.3 People who declined our messages, people who are not centers or teachers, children, and anyone who asked us to stop may be placed on our do-not-contact list, and a number on it receives no marketing message and no consent request. Messages about an account, and login codes, are not affected.
14. Changes to this policy
We may update this policy at any time and will publish each change with a new version number and date. A change applies when we publish it, and we tell account holders in the app when it is material.
15. Contact and data protection officer
Data Protection Officer, Eyad Elhawary for Programming and Artificial Intelligence Solutions (LLC), 6th of October City, Giza, Egypt. Email: support@tutoringhq.app (subject: "Data protection").