Privacy Policy

1.1 TutorClover is a SaaS platform for tutoring centers and learning businesses. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website, create an account, or use our platform.

1.2 The controller within the meaning of Art. 4 No. 7 GDPR for the processing described in this Privacy Policy is:

1.3 Where TutorClover processes personal data on behalf of its customers (see section 6.2), the respective customer acts as the data controller within the meaning of data protection law; TutorClover acts as a data processor within the meaning of Art. 4 No. 8 GDPR.

2.1 When you browse our website without registering and without providing us with any information, your browser automatically transmits the following server log data to our server:

• ›URL of the page visited
• ›Date and time of access
• ›Volume of data transferred
• ›Referring URL (previously visited page)
• ›Browser type and version
• ›Operating system
• ›IP address, to the extent technically necessary; where technically implemented, IP addresses may be truncated or anonymised

2.2 The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and stable technical operation of the website, the protection of IT security, the detection and prevention of attacks, and abuse and fraud prevention.

2.3 Retention period: Server log data is generally stored for up to 7 days and then automatically deleted, unless a specific reason (e.g. an ongoing security incident or an authority request) requires longer retention.

2.4 This website uses SSL/TLS encryption for all data transfers.

3.1 Our website and platform use exclusively technically necessary browser storage (localStorage) and session-related tokens that are required for secure operation, authentication, and maintaining sessions. We currently do not use any tracking, analytics, or marketing cookies.

3.2 Where information is stored on or read from your device in this context, this is done in accordance with applicable electronic communications law, as access is strictly necessary for providing the digital service you have expressly requested. No separate consent is required for this.

3.3 Where personal data is processed in connection with technically necessary storage, the legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring secure and functional operation.

3.4 If we introduce consent-based storage in the future, we will update this Privacy Policy accordingly and obtain the necessary consent.

3.5 Cookie consent tool (CCM19): To obtain, manage, and document any consent-requiring storage and to display the cookie notice, we use the "CCM19" tool by Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany. When the tool loads, your IP address and technical access data are transmitted to and processed on the provider's servers in order to uniquely assign page views and to be able to demonstrate any choice made; for this purpose, a technically necessary session cookie is set with a retention period of no more than 24 hours. Processing takes place exclusively on servers in Germany/the EU; no transfer to a third country occurs. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 25(2) No. 2 TDDDG (legal obligation to be able to demonstrate any consent given). According to the provider, evidence of a consent selection is generally stored for one year (default setting, individually configurable) and then automatically deleted.

4.1 When you contact us, e.g. by e-mail or via the contact form on our website, we process the data you provide (in particular name, e-mail address, message content) in order to handle and respond to your inquiry.

4.2 The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the prompt and proper handling of incoming inquiries and in maintaining traceability of communications, e.g. for documentation purposes. Where your inquiry is directed at entering into or performing a contract, the additional legal basis is Art. 6(1)(b) GDPR.

4.3 Retention period: Your inquiry data is generally stored until the matter is finally resolved and then deleted, unless statutory retention obligations apply or there is a legitimate interest in retaining the documentation (generally up to 3 years after completion of correspondence).

4.4 Business Contact and Outreach

We may process business contact information (e.g. name, business e-mail address, company name, role, website, communication history) to communicate with existing customers, prospective customers, or business partners who have actively contacted us or with whom a business relationship already exists.

The legal basis for this processing is Art. 6(1)(f) GDPR (maintaining existing business relationships and handling incoming inquiries) or Art. 6(1)(b) GDPR, to the extent the communication serves to enter into or perform a contract.

We only send promotional (direct marketing) e-mails to business contacts where a legal basis under German unfair-competition law (§ 7 UWG) exists for doing so — in particular prior explicit consent (§ 7(2)(3) UWG, Art. 6(1)(a) GDPR), or, within the narrow existing-customer exception, where we obtained the e-mail address in connection with the sale of goods or services, the advertised offer relates to similar goods or services of our own, the recipient has not objected, and the recipient was clearly informed of the right to object — free of charge — both at the time the address was collected and with every subsequent use (§ 7(3) UWG). A business relationship or a legitimate interest alone is not sufficient to send unsolicited promotional e-mails.

Data subjects may object to the processing of their data for direct marketing purposes and to receiving further promotional e-mails at any time, free of charge, e.g. by e-mailing info@tutorclover.com or via the unsubscribe link included in each e-mail.

5.1 You can create a user account on our platform. Registration is carried out either by providing an e-mail address and password, or via Google Sign-In as a Single Sign-On option (see section 8).

5.2 During registration and onboarding, we process in particular the following data:

• ›E-mail address (required)
• ›Password in cryptographically secured form (hashing) — only for e-mail/password registration
• ›Organisation / company name (required)
• ›Country and time zone
• ›Initial account configuration details, e.g. chosen subscription plan

5.3 Mandatory information and consequences of non-provision: The fields marked as mandatory (e-mail address and password or SSO login, and organisation name) are contractually required for the creation and use of the user account. Without this data it is technically impossible to create an account and no usage agreement can be concluded.

5.4 The legal basis for processing is Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures).

5.5 Retention period: Account data is retained until the end of the contractual relationship and then for up to 3 years thereafter (statutory limitation period). Tax- and commercial-law-relevant documents are retained for 6, 8, or 10 years depending on the document category (§ 257 German Commercial Code, § 147 German Tax Code; e.g. invoices and other accounting vouchers: up to 8 years; business correspondence: up to 6 years; books, records, and annual financial statements: up to 10 years).

5.6 Administrators can manage their account and organisation-related data within the platform functions provided.

5.7 Marketing communications (voluntary, consent-based)

During registration you have the option to optionally consent to receiving marketing e-mails from TutorClover — for example product news, practical tips, and special offers. This consent is entirely voluntary and is not a prerequisite for using the platform.

5.7.1 Legal basis: Art. 6(1)(a) GDPR (consent). Consent may be withdrawn at any time with effect for the future, without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

5.7.2 Withdrawal: You can withdraw consent at any time by e-mailing info@tutorclover.com. Every marketing e-mail we send also contains a link for straightforward unsubscribing (opt-out) directly in the e-mail.

5.7.3 Double opt-in procedure: Consent to marketing communications is collected via a double opt-in process: after registration you receive a confirmation e-mail and must actively confirm your consent before any marketing e-mails are sent. This ensures no third party can register on your behalf and serves as evidence of consent under German advertising law (§ 7(2)(3) UWG).

5.7.4 Proof of consent: The date and time of consent and double opt-in confirmation are stored as evidence in accordance with Art. 7(1) GDPR. This proof data is retained for up to 3 years after withdrawal of consent.

6.1 Processing of own contract and administrator data

In connection with providing the platform, we process as controller in particular data of registered administrators and other contact persons of our customers:

• ›Master data and contact details (name, e-mail address)
• ›Organisation and account data
• ›Contract, subscription, and billing data
• ›Log data on administrative actions within the platform (e.g. actions within the internal administration area, actions taken by the AI assistant), to the extent captured by the platform's respective logging functions
• ›Evidence of acceptance of legally required documents (e.g. DPA) with timestamps

The legal bases are Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligations). For the storage of security and evidence data, Art. 6(1)(f) GDPR applies additionally; our legitimate interest lies in the demonstrability of legal declarations, IT security, and defence against legal claims.

6.2 Processing of platform data on behalf of the customer

Our platform enables customers to process personal data of their teachers, students, guardians, and other contacts (e.g. names, contact details, progress records, appointment histories). In this context the respective customer acts as the data controller; TutorClover acts as a data processor pursuant to Art. 28 GDPR.

Such data is processed exclusively for the purpose of providing the contractually agreed platform services, on the basis of the Data Processing Agreement concluded with the customer (see section 11). TutorClover does not process this data for its own purposes.

The customer is responsible for the lawfulness of the processing it initiates, in particular for selecting an appropriate legal basis and fulfilling information obligations towards data subjects (e.g. teachers and students).

6.3 Retention period

Security-relevant log data and evidence of legal declarations are retained at least until the end of the respective contractual relationship and thereafter for up to 3 years. Tax-relevant documents are subject to a retention period of 6, 8, or 10 years depending on the document category (§ 257 German Commercial Code, § 147 German Tax Code; e.g. invoices: up to 8 years; business correspondence: up to 6 years).

6.4 Children's and Student Data

TutorClover is intended for use by tutoring centers, learning centers, and other business customers. TutorClover is not directed to children. Where a customer offers its students access to the free Student Portal, access for students under 18 is operated by a parent or legal guardian using their own account and email address; students aged 18 or older may have their own account. This is a TutorClover product rule, not a statement that a specific law prescribes this age, and it does not remove the customer's and our obligations when a minor's data is processed.

Student Portal accounts of minors that were created before this rule may still exist as an exception. They stay in place until the tutoring center moves them to parent or guardian access; nothing is moved, disabled or deleted automatically, and messages of the existing account are not handed to the parent or guardian. A parent or guardian account does not become a student account when the student turns 18.

Where a customer enters or uploads student data, including data relating to minors, the customer is responsible for obtaining any required consents and providing any required notices to students, parents, or legal guardians. TutorClover processes such student data only to provide the platform services requested by the customer and does not use student data for advertising or marketing purposes.

7.1 For processing paid subscriptions we use the payment service provider Stripe Payments Europe, Ltd., c/o A&L Goodbody, IFSC, Dublin, Ireland (EU entity; parent company: Stripe, LLC, formerly Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA).

7.2 Categories of data processed: Depending on the payment method, the following data is processed in particular during payment:

• ›Name of the payer
• ›E-mail address
• ›Billing address
• ›Payment instrument information (e.g. credit card: card type, last 4 digits, expiry date — full card details are processed exclusively by Stripe and are not stored by TutorClover)
• ›Transaction amount, currency, timestamp
• ›Subscription and invoice ID

7.3 Full payment instrument details (e.g. full credit card numbers or bank account details) are not stored by TutorClover. These are processed exclusively by Stripe on its infrastructure.

7.4 The legal basis for processing is Art. 6(1)(b) GDPR (performance of a contract). Stripe processes the data as an independent controller in respect of its payment service; Stripe's own privacy notices apply in this regard.

7.5 International data transfer: Since Stripe's parent company is located in the USA, data may be transferred to the United States. Stripe is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and additionally uses EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. For further information see: stripe.com/privacy

8.1 In addition to registration via e-mail address and password, we optionally offer sign-in via Google Sign-In (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Use of this feature is voluntary; registration by e-mail is always available as an alternative.

8.2 If you actively choose Google Sign-In, the following data is transmitted to us from your Google account:

• ›Name (first and last name)
• ›E-mail address (Google account e-mail)
• ›Unique user identifier (Google Subject ID / Sub)
• ›Profile picture URL (where applicable)

8.3 We use this data for the purpose of authentication and the creation and management of the user account. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract).

8.4 International data transfer: Since Google's parent company Google LLC is located in the USA, data may be transferred to the United States. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and additionally uses EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

8.5 In addition, Google processes its own data during authentication in accordance with its privacy notices. We recommend reading these before using this feature: policies.google.com/privacy

9.1 Our website and platform are operated on the infrastructure of external hosting and cloud service providers. All data generated during use of our website and platform may be processed on this infrastructure, in particular:

• ›Server log data (IP address, timestamps, URLs, HTTP status codes)
• ›Account and platform data (database content, configuration data)
• ›Communication and usage data
• ›Backup data

9.2 Processing by infrastructure service providers is carried out on the basis of Art. 6(1)(f) GDPR and Art. 6(1)(b) GDPR. Our legitimate interest lies in the secure, stable, and performant technical provision of our website and platform.

9.3 We use in particular the following types of infrastructure service providers:

• ›Hosting, cloud infrastructure, DNS & database connectivity (Hyperdrive) for the website, platform frontends, and API server: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA
• ›Database operation (PostgreSQL): Neon, LLC (a Databricks, Inc. company); the database is operated in the EU region Frankfurt am Main (AWS eu-central-1)
• ›Transactional e-mail delivery (system notifications, password reset, billing receipts): Resend (a brand of Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, USA
• ›Cookie and consent management (obtaining, managing, and documenting consent): Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany

9.4 All infrastructure service providers are engaged as data processors pursuant to Art. 28 GDPR. Where required, appropriate data processing terms are concluded with service providers. Where providers are located in third countries or data is transferred there, this only occurs on the basis of appropriate safeguards (adequacy decision or EU Standard Contractual Clauses pursuant to Art. 46 GDPR).

9.5 Retention period (backups): After deletion from the active systems, data may remain in protected backup copies until the backup and recovery cycle configured with the database provider expires. These copies are used exclusively for restoration purposes and are subsequently automatically overwritten or deleted.

10.1 Service used and function: Where the AI assistant is activated and used within the platform, inputs by the user and platform-side contextual data are processed directly via the API of OpenAI (contracting entity for users in the EU/EEA and Switzerland: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; parent company: OpenAI OpCo, LLC, 1455 3rd Street, San Francisco, CA 94158, USA). TutorClover maintains a direct contractual relationship with OpenAI and does not use any intermediary third-party AI proxy service.

10.2 Categories of data transmitted: The following data may in particular be transmitted to the AI service provider:

• ›Queries and text entered by the user (prompts)
• ›Platform-side contextual data required to generate a relevant response (e.g. structured platform information, to the extent released by the user)
• ›Session-related metadata (e.g. model configuration, timestamps)

10.3 Storage and model training: We use OpenAI's Chat Completions API without enabling the optional "store" feature; TutorClover therefore does not cause any additional persistent storage of conversations on the OpenAI platform (e.g. for later reuse or evaluation). Under OpenAI's current API usage policies, data processed via the API (inputs and outputs) is not used by default to train or improve AI models unless we explicitly opt in. Regardless of the "store" setting, OpenAI states that it retains API inputs and outputs for a limited period of up to 30 days for abuse-monitoring purposes, unless a longer statutory retention obligation applies. We configure the AI service in a data-minimising manner where possible.

10.4 Purpose and legal basis: Processing is carried out to provide the AI functionality actively used by the customer or user. Where TutorClover acts as controller, the legal basis is Art. 6(1)(b) GDPR (performance of a contract). Where TutorClover acts on behalf of a customer, processing is carried out within the framework of the data processing relationship.

10.5 Role allocation: OpenAI Ireland Limited is engaged by TutorClover as a data processor pursuant to Art. 28 GDPR. Processing is carried out exclusively on behalf of and under the instruction of TutorClover, based on the data processing agreement concluded with OpenAI (OpenAI Data Processing Addendum).

10.6 International data transfer: Since the parent company OpenAI OpCo, LLC is located in the USA, data may be transferred to the United States as part of intra-group processing. This transfer is carried out on the basis of EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, which form part of the data processing agreement concluded with OpenAI.

10.7 Data minimisation note: Users are asked to enter via the AI assistant only such personal data as is actually necessary for the respective purpose. Special categories of personal data (Art. 9 GDPR) should not be entered unless explicitly envisaged for a particular use case.

11.1 Since our customers process personal data of third parties (teachers, students, guardians) via the platform, we conclude a Data Processing Agreement (DPA) with our customers pursuant to Art. 28 GDPR. This is based on TutorClover's role as data processor described in section 6.2.

11.2 The DPA is provided for digital acceptance during the onboarding process. Acceptance is documented with a timestamp, IP address, and further evidence data. The evidence data is retained for the duration of the contractual relationship and generally for up to three years thereafter. Longer retention only occurs where necessary due to specific legal claims, ongoing legal disputes, or statutory retention obligations.

11.3 The current version of the DPA is accessible at any time for authorised administrators within the platform under the "Legal" section.

12.1 Personal data is only shared to the extent necessary for providing our website and platform, performing the contract, processing payments, providing support, or fulfilling legal obligations.

12.2 Recipient categories and named service providers:

12.3 International data transfers at a glance:

• ›Cloudflare, Inc. (USA): transfer on the basis of EU-US Data Privacy Framework (adequacy decision) + EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR
• ›Neon, LLC / Databricks, Inc. (USA): the database itself is operated in the EU (Frankfurt am Main, aws-eu-central-1); to the extent support or maintenance access nonetheless occurs from a third country, this is carried out on the basis of EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR
• ›Stripe, LLC, formerly Stripe, Inc. (USA): transfer on the basis of EU-US Data Privacy Framework (adequacy decision) + EU Standard Contractual Clauses
• ›Google LLC (USA): transfer on the basis of EU-US Data Privacy Framework (adequacy decision) + EU Standard Contractual Clauses
• ›OpenAI OpCo, LLC (USA): direct contractual relationship via OpenAI Ireland Limited (Dublin, Ireland); transfer to the US parent company on the basis of EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR (OpenAI Data Processing Addendum)
• ›Plus Five Five, Inc. / Resend (USA): transfer on the basis of EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and, where applicable, the EU-US Data Privacy Framework (Resend DPA)

A copy of the applicable safeguards or further information can be requested from us at info@tutorclover.com.

We retain personal data only for as long as is necessary for the respective purposes or as required by law. The following overview summarises the main retention periods:

• Server log data:up to 7 days after creation, unless a security incident requires longer retention
• Contact inquiries / support communications:up to 3 years after final resolution (limitation period)
• Account and contract data:until end of the contractual relationship, then up to 3 years (limitation period); commercial- and tax-law-relevant documents 6, 8, or 10 years depending on document category (§ 257 German Commercial Code, § 147 German Tax Code)
• Payment and invoice data:6, 8, or 10 years depending on document category (§ 257 German Commercial Code, § 147 German Tax Code; e.g. invoices: up to 8 years)
• Data from unconverted trial accounts:There is currently no automated process that deletes trial account data after a fixed period. Administrators can delete their account, including all organisational data, themselves at any time, which takes immediate effect on the active production systems. Statutorily required documents (e.g. invoices) and copies in backups are unaffected and are retained or deleted according to the periods that respectively apply to them (see below).
• Security and evidence data (e.g. DPA acceptance):up to 3 years after contract end; longer only in the case of specific legal claims, ongoing legal disputes, or statutory retention obligations
• Backup data:remains in protected backup copies after deletion from the active systems until the backup and recovery cycle configured with the database provider expires, and is then automatically overwritten or deleted

Subject to the statutory requirements, you have the following rights:

To exercise your rights or for data protection enquiries, please contact us at: info@tutorclover.com

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data violates data protection law (Art. 77 GDPR). The competent supervisory authority for us is:

You may also contact the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.

16.1 TutorClover does not carry out automated decision-making including profiling within the meaning of Art. 22(1) and (4) GDPR. We do not make decisions based solely on automated processing that would legally or similarly significantly affect data subjects.

16.2 The AI assistant (where activated) generates outputs based on user inputs. These outputs always require independent human review and do not result in automated decisions with legal or similarly significant effects on data subjects.

At this stage, TutorClover does not sell personal information and does not share personal information for cross-context behavioral advertising.

If California privacy laws apply to our processing of your personal information, California residents may have rights to request access, deletion, correction, portability, and information about how their personal information is used and disclosed. To exercise privacy rights, contact us at info@tutorclover.com.

We do not knowingly sell or share personal information of consumers under 16 years of age.

This Privacy Policy is dated 30 September 2026 and is currently valid.

As our platform develops, as new services are deployed, or due to changes in legal or regulatory requirements, it may become necessary to update this Privacy Policy. The current version is available on this page at all times. For material changes, we will inform registered users where possible through appropriate means.