Privacy Policy

Last updated: September 14, 2026

Tuton ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our tutoring platform.

1. Information We Collect

1.1 Information You Provide

• Account Information: When you create an account, we collect your name, email address, and profile information.
• Payment Information: If you subscribe to our services, we collect payment details through our secure payment processor (Stripe). We do not store your full credit card information.
• Student Data: Tutors may input student information including names, learning goals, progress notes, and vocabulary lists.
• Communications: Messages exchanged between tutors and students through our platform.

1.2 Information Collected Automatically

• Usage Data: Information about how you interact with our platform, including pages visited, features used, and time spent.
• Device Information: Browser type, operating system, device model, and device identifiers.
• Log Data: IP addresses, access times, and referring URLs.
• Security Signals: The IP address used at signup and a hashed fingerprint derived from general device and browser characteristics (such as language, platform, and screen size). We use these to detect duplicate accounts and prevent fraud and misuse of the Service, on the basis of our legitimate interest in platform security. The fingerprint is a one-way hash and cannot be used to identify you outside of Tuton.

1.3 Mobile App Data

When you use the Tuton mobile app, we may additionally collect:

• Push Notification Tokens: Device tokens to send you lesson reminders, messages, and booking notifications. You can disable notifications in your device settings at any time.
• Photos: If you choose to upload a profile photo, we access your photo library only when you initiate the upload. We do not access your photos in the background.
• Secure Storage: Authentication tokens are stored securely on your device using platform-provided secure storage (Keychain on iOS) to keep you signed in.
• Mobile Analytics: We collect anonymous usage analytics (screen views, feature interactions) to improve the app experience. No personally identifiable information is included in analytics events.

1.4 Third-Party Integrations

When you connect third-party services (such as Google Calendar), we access only the information necessary to provide the integration:

• Google Calendar: Calendar event details (title, time, description) to sync your schedule. We request read access to view your calendars and write access to create a "Tuton Lessons" calendar for exporting your lessons.
• Google Sign-In: We use Google OAuth for authentication on both web and mobile. We receive your name, email, and profile photo from Google. We do not access any other Google account data.

1.5 AI Features and Lesson Recordings

Several parts of Tuton use AI. These are the categories of information that are sent to an AI provider when you use them:

• Lesson audio: when a lesson is recorded, each participant is recorded on their own audio track. Those tracks are sent for transcription.
• Transcripts: used to write the lesson report, the student brief, and the in-lesson analysis a tutor sees.
• Homework and written work: a student answer or essay is sent when a tutor asks for feedback on it, or when the platform scores a placement test.
• Assistant conversations: what a tutor types into the in-app assistant, and the student context it needs to answer.
• Course and lesson content: material a tutor or a school writes, or asks the platform to draft.

We have never trained an AI model on your content, and we do not permit our providers to do so. Every request we send is marked so that it can only be handled by providers that do not retain the content of the request. A small number of features cannot be routed that way because only one provider offers the capability at all; those features send lesson material that a tutor or the platform wrote, never a student answer, a transcript, or lesson audio.

Lesson audio recordings are deleted 30 days after the lesson. What is derived from them — the transcript, the lesson report, vocabulary and progress data — is kept with the account, and is deleted when the account is deleted. Files uploaded to a course by a tutor or a school are stored until they are deleted, either individually or with the account.

2. How We Use Your Information

We use collected information to:

• Provide and maintain our tutoring platform
• Process payments and manage subscriptions
• Enable video conferencing and real-time collaboration
• Send transactional and service emails (see Section 2.1 below)
• Sync calendar data to prevent scheduling conflicts
• Improve our services through usage analytics
• Detect and prevent fraud, duplicate accounts, and misuse of free trials or promotional offers (legitimate interest in platform security)
• Respond to support requests
• Comply with legal obligations

2.1 Email Communications

We send transactional emails to your registered email address. We do not send marketing emails on behalf of third parties and we do not sell, rent, or share your email address with marketers.

• Account-required: signup verification, password resets, security alerts, billing receipts. These cannot be disabled while your account is active because they are necessary to operate the Service.
• Service notifications: lesson reminders, booking confirmations, messages from your tutor or students, document collaboration alerts. You can configure these from your account settings.
• Onboarding and product updates: a short series of welcome emails to help you get started, plus occasional product updates. You can opt out at any time using the unsubscribe link in any such email or from your account settings.

Email addresses that hard-bounce or that have marked our email as spam are automatically added to a suppression list — we will not continue sending email to suppressed addresses.

3. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

• Service Providers: Third parties that help us operate our platform (hosting, payment processing, email delivery, video conferencing).
• Legal Requirements: When required by law, court order, or government request.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.

3.1 Email Service Providers

We use third-party email infrastructure providers to deliver transactional email on our behalf. These providers act as data processors and only receive the recipient email address and the email content needed to deliver each message. They do not use your data for any other purpose.

• Resend (resend.com) — currently used for some transactional email; built on Amazon Web Services Simple Email Service.
• Amazon Web Services Simple Email Service (AWS SES) — we are migrating to AWS SES directly to consolidate infrastructure.

Email delivery events (sent, delivered, bounced, complained about) are recorded in our systems for deliverability monitoring and to maintain the suppression list described in Section 2.1.

3.2 Sub-processors

These are the third parties that process personal data on our behalf, what each one is used for, and where the processing happens. Each acts as a data processor under our instructions.

4. Data Security

We implement industry-standard security measures including encryption in transit (TLS) and at rest, secure authentication, and regular security assessments. However, no method of transmission over the Internet is 100% secure.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide services. You can request deletion of your account and associated data at any time.

• Lesson audio recordings: deleted 30 days after the lesson. This is enforced by the storage itself, not by a manual clean-up.
• Course files: material uploaded to a course by a tutor or a school is stored until it is deleted, either individually or with the account.

6. Data Deletion Requests

You have the right to request deletion of your personal data held by Tuton. We support two types of deletion requests:

6.1 Full Account Deletion

Deleting your account permanently removes all of the following data associated with your profile:

• Account credentials and profile information (name, email, photo)
• Student records, lesson history, and progress notes
• Vocabulary lists and flashcard activity
• Messages and conversation history
• Uploaded materials and documents
• Scheduling data and availability settings
• Notification preferences and push tokens

To delete your account, go to Settings → Account → Delete Account in the Tuton app or web dashboard. Deletion is permanent and cannot be undone.

6.2 Partial Data Deletion

If you wish to delete specific data without closing your account (for example, removing a student record or clearing your message history), you can do so directly within the app. If you need assistance or want to request deletion of data you cannot remove yourself, email us at with the subject line “Data Deletion Request” and describe what data you would like removed.

6.3 Retained Data

After account deletion, we may retain the following data for the periods noted:

• Billing records: Payment transaction records are retained for up to 7 years to comply with financial regulations.
• Anonymised analytics: Aggregated, non-identifiable usage statistics that cannot be linked back to you.
• Legal holds: Data subject to an active legal dispute or regulatory requirement will be retained until the matter is resolved.
• Fraud-prevention records: A minimal record of the deleted account (email address, hashed device fingerprint, and free trial history) is retained to prevent fraud and misuse, such as repeat free trials or the circumvention of an account suspension. This is processed on the basis of our legitimate interest in platform security and is not used for any other purpose.

When you request account deletion, your account is locked immediately — you can no longer sign in. Your data then enters a 90-day retention window, during which you can restore your account by contacting support, and we may review the account for fraud and abuse prevention. After this window your data is permanently erased, except for the categories listed above.

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing
• Data portability
• Withdraw consent

To exercise these rights, contact us at .

8. Children's Privacy

Tuton is designed for use by adult tutors. Tutors are responsible for obtaining appropriate consent before inputting information about minor students. We do not knowingly collect personal information directly from children under 13.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers.

10. Cookies and Tracking

We use essential cookies for authentication and session management. We may use analytics cookies to understand how our platform is used. You can manage cookie preferences through your browser settings.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

12. Data Controller

The data controller responsible for your personal data is Tuton Ltd, a company registered in England and Wales under company number 15835011, with its registered office at 20 Wenlock Road, London, England, N1 7GU.

13. Contact Us

If you have questions about this Privacy Policy, please contact us at:

• Email:
• Support: