1. Who We Are
The Tutor AI is operated by Esja Ventures Ltd (“we”, “us”), a company registered in England and Wales with company number 17354276. Its registered office is 2 Galahad House, Fellowes Rise, Winchester, SO22 5TF. This policy explains what data we collect, how we use it, and your rights under UK GDPR and the UK Data Protection Act 2018. If you have any questions, contact us at support@thetutorai.app.
2. Lawful Basis for Processing
We process your personal data on the following lawful bases:
- Contract — to provide the service you have signed up for
- Legitimate interests — to enforce usage limits, prevent abuse, and improve the service
3. What Data We Collect
- Email address — used to create and manage your account
- First name — used to personalise your experience
- Questions you submit — the text you type and any photo or screenshot of a question you upload, stored to power your learning history
- Your answers to practice steps — each answer you type on a step, whether it was right and, when it was wrong, a short description of the mistake. If you are in a school class, the teachers of that class, the member of staff who leads that subject and your school's admins can see these for work you do after joining it.
- Usage data — how many questions and pictures you have used each day and the size of each AI request, used to apply the limits of your plan and manage cost
- Accessibility preferences — font, contrast, and motion settings stored locally and in our database
- AI-generated images — the picture made for a visual lesson, cached in our storage
- Quiz answers and scores — your answers to quizzes and practice quizzes, and whether each was right
- School details — if you join a school: which school and classes you are in, and whether you are a student, a teacher, a subject lead or an admin
- Plan and payment reference — which plan you are on and the reference Stripe gives us for your payments. We never see or store card details.
- Error records — when something fails for you, a short description of what went wrong, kept with your account so we can put it right
- Settings kept on your device — your light or dark theme, colour overlay, reading voice and whether you have seen the welcome screen are stored in your browser, not sent to us
4. How We Use Your Data
- To provide and improve the service
- To generate AI explanations via the Anthropic API
- To generate the picture for visual lessons via Cloudflare Workers AI (Pro, Ultra and school accounts)
- To enforce fair usage limits
- To personalise your learning experience, including showing you the mistakes you repeat so you can practise them
- To show school staff how their students are getting on (see “If you use The Tutor AI through a school” below)
- To send you service emails (sign-up codes, password resets) and, unless you opt out, product updates
We do not sell your data to third parties. We do not use your data for behavioural advertising or profiling.
5. Third-Party Services
- Supabase — database and authentication (EU servers, in Ireland). Your account data and history are stored here.
- Anthropic — AI model provider. Your questions are sent to their API to generate explanations. Anthropic does not use your inputs to train their models under the API terms.
- Cloudflare (Workers AI) — generates the picture for visual lessons (Pro, Ultra and school accounts). Only a short description of the picture, written by the tutor, is sent. No account data, personal information, or the student's own question text is included. Cloudflare states that it does not use Customer Content to train the AI models made available on Workers AI. Once made, the picture is also sent to Anthropic's Claude, which checks that it is suitable and finds the things in it that the tutor marks.
- Stripe — payment processing for Pro and Ultra subscriptions and question packs. We do not store your card details.
- YouTube — video recommendations in the Video learning style. We send YouTube a search for the topic, never anything about you. The video is embedded in YouTube's privacy-enhanced mode, so YouTube sets no cookies unless you press play.
- Resend — sends our emails (sign-up codes, password resets and, unless you opt out, product updates). Your email address and first name are passed to them for delivery.
- Vercel — hosts the website and runs our server code. Requests to the service pass through their infrastructure.
- Sentry — crash reporting. A report contains technical details of the error and your account ID. What you type or upload, your cookies and your email address are removed before a report is sent.
- Slack — our internal operations workspace, visible only to us. A daily report of the questions asked on the service, each with the email address of the account that asked it, is posted there so we can check the tutor is answering properly, along with alerts when something fails.
6. If You Use The Tutor AI Through a School
When you join a school, staff at that school can see how you are getting on. Who sees what depends on their role:
- A teacher sees the students in the classes they teach
- A subject lead sees the students in every class for the subject they lead
- A school admin sees every student in the school
For those students they can see: first name, how often the tutor is used and on which topics, answers to practice steps and the mistakes named in them, quiz scores, and the results of work the school has set. They see work done after you joined the school or class, not what you did on a personal account before that. They cannot see your email address or password.
7. Where Your Data Goes
Our database is in the EU (Ireland). Several of the services listed above are based in the United States, including Anthropic, Cloudflare, Stripe, Resend, Vercel, Sentry and Slack, so the data sent to them (described for each one above) is processed outside the UK.
8. Children and Young People (UK Children's Code)
The Tutor AI is a service likely to be accessed by children and young people. We comply with the UK Age Appropriate Design Code (Children's Code) and take the following steps to protect younger users:
- We apply high-privacy default settings for all users
- We do not profile users for targeted advertising
- We collect only the minimum data necessary to provide the service
- We do not use nudge techniques or dark patterns
- Geolocation is not collected or used
If you are under 13, please ensure a parent or guardian has reviewed this policy and agrees to your use of the service.
If you believe a child's data has been processed without appropriate consent, please contact us at support@thetutorai.app and we will delete it promptly.
9. Data Retention
Your data is stored for as long as your account is active. You can delete your account from Settings: your questions, uploaded photos, lesson pictures, answers, quiz results, error records and profile are removed from our database straight away, and any subscription is cancelled first.
Teacher, subject lead and school admin accounts are deleted by us on request, within 30 days, so that a class's work is not lost by accident.
Some copies sit outside our database and are not removed at once: Stripe keeps billing records as the law requires, any database backups Supabase holds expire on their own schedule, and reports already sent to Sentry and Slack stay there until they expire or we delete them. Ask us and we will delete those we control.
10. Your Rights (UK GDPR)
You have the right to:
- Access the data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (“right to be forgotten”)
- Object to how we process your data
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time (where processing is based on consent)
To exercise any of these rights, contact us at support@thetutorai.app. We will respond within 30 days. You also have the right to lodge a complaint with the ICO (ico.org.uk).
11. Cookies and Storage on Your Device
We use the following cookies:
- Essential cookies — Supabase session cookies required for authentication. Cannot be disabled without breaking the service.
We do not use advertising, analytics, or tracking cookies, and we do not serve ads. If you play an embedded YouTube video, YouTube may set its own cookies at that point. If you pay, Stripe's checkout page sets its own cookies on Stripe's site.
Your browser also stores a few settings for us on your device: light or dark theme, colour overlay, reading voice and whether you have seen the welcome screen. They stay on your device.
12. Contact
For any privacy concerns: support@thetutorai.app