Privacy Policy

Tutor Volt Ltd | Last updated: 15 February 2026 | Effective: 17 March 2026

1. Introduction

This Privacy Policy explains how Tutor Volt Ltd ("we", "us", "our", "Tutor Volt") collects, uses, stores, and protects your personal data when you use the Tutor Volt platform at tutorvolt.ai and tutorvolt.co.uk (the "Platform").

We are committed to protecting your privacy and processing your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you are under 16, please also read our Children's Privacy Policy, which explains our data practices in simpler language.

2. Data Controller

The data controller is:

Tutor Volt Ltd (Company No. 17046624) Registered in England and Wales ICO Registration: C1882206 (verify at ico.org.uk)

For general enquiries: [email protected] Data Protection Officer: [email protected] Security disclosure: see /.well-known/security.txt

Where the Platform is used by a school, the school is the data controller for student data and Tutor Volt acts as a data processor. Please refer to your school's own privacy notice and our Data Processing Agreement for details.

3. What Data We Collect

3.1 Data You Provide

| Category | Examples | |---|---| | Account information | Full name, email address, password (hashed), role (student/teacher/parent/admin) | | Profile information | School name, year group, subjects, profile photograph | | Educational content | Lesson materials uploaded by teachers, student submissions | | Communications | Messages sent through the Platform, support requests, feedback |

3.2 Data Generated Through Use

| Category | Examples | |---|---| | Learning data | Lesson progress, time spent on tasks, completion rates | | Quiz and assessment data | Quiz scores, answers, grade predictions, adaptive learning metrics | | Chat transcripts | All conversations with the AI tutor (Live Wire) | | Voice recordings | Speech-to-text input during voice interaction sessions | | Gamification data | XP points, levels, streaks, achievements, leaderboard positions |

3.3 Data Collected Automatically

| Category | Examples | |---|---| | Device and browser information | IP address, browser type, operating system, screen resolution | | Usage data | Pages visited, features used, session duration, click patterns | | Error data | Application errors, crash reports (via Sentry) |

4. Lawful Bases for Processing

We process your personal data on the following lawful bases under Article 6 of UK GDPR:

| Purpose | Lawful Basis | |---|---| | Providing the Platform and its features | Performance of a contract (Art. 6(1)(b)) | | Processing subscription payments | Performance of a contract (Art. 6(1)(b)) | | Safeguarding and child protection | Legal obligation (Art. 6(1)(c)) and vital interests (Art. 6(1)(d)) | | Improving the Platform and fixing bugs | Legitimate interest (Art. 6(1)(f)) | | Sending marketing communications | Consent (Art. 6(1)(a)) | | Generating grade predictions and adaptive learning | Legitimate interest (Art. 6(1)(f)) with right to object | | Complying with legal and regulatory obligations | Legal obligation (Art. 6(1)(c)) |

4.1 Children's Data

Where we process data of children under 13, we rely on parental consent as the lawful basis (Art. 8 UK GDPR). For children aged 13 to 15, we may also rely on parental consent depending on the processing activity. Schools providing the Platform to students may provide institutional consent for educational use in accordance with ICO guidance.

4.2 Special Category Data

We do not intentionally collect special category data (such as health data, ethnicity, or religious beliefs). If such data is inadvertently disclosed by a user during AI chat sessions, it is flagged by our content monitoring system and handled in accordance with our Safeguarding Policy.

5. How We Use Your Data

We use your personal data to:

• Create and manage your account
• Deliver AI-generated educational content personalised to your year group and subject
• Provide the AI tutor chat (Live Wire) and process your questions
• Generate quizzes, flashcards, and mind maps adapted to your learning progress
• Track and display learning progress to students, their teachers, and their parents
• Generate grade predictions using adaptive learning algorithms
• Process subscription payments via Stripe
• Monitor student interactions for safeguarding purposes
• Send you service-related notifications (e.g. lesson updates, quiz reminders)
• Send marketing communications (only with your explicit consent)
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations, including safeguarding reporting

6. AI Processing and Automated Decision-Making

6.1 AI-Powered Features

Tutor Volt uses artificial intelligence (Claude by Anthropic) to power several Platform features. When you interact with these features, your data is processed by AI systems:

• AI Tutor Chat: Your questions are sent to Anthropic's AI model to generate responses. We send the question text and relevant lesson context -- not your name or personal identifiers.
• Content Generation: Lesson topics and curriculum specifications are sent to the AI to generate educational content.
• Adaptive Learning: Your quiz scores and learning progress are analysed by AI to adjust difficulty and recommend content.
• Grade Predictions: Historical performance data is used to generate predictive grades.
• Safeguarding Detection: All student chat messages are analysed by AI for safeguarding concerns.

6.2 Automated Decision-Making

Under Article 22 of UK GDPR, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

Our AI systems make the following automated assessments:

• Grade predictions -- These are advisory only and do not determine any outcome with legal effect. Teachers may use them as one input among many. You or your parent may object to grade predictions at any time.
• Adaptive learning adjustments -- Content difficulty is automatically adjusted based on performance. This does not have legal or similarly significant effects.
• Safeguarding flagging -- Automated content monitoring may trigger alerts, but all safeguarding decisions are reviewed by a human Designated Safeguarding Lead before action is taken.

You have the right to request human review of any automated decision. Contact us at [email protected].

7. Who We Share Your Data With

We share your data with the following categories of recipients:

7.1 Service Providers (Sub-Processors)

| Provider | Purpose | Location | Safeguard | |---|---|---|---| | Anthropic | AI content generation and chat | United States | Standard Contractual Clauses (SCCs) | | Deepgram | Speech-to-text processing | United States | Standard Contractual Clauses | | ElevenLabs | Text-to-speech audio generation | United States | Standard Contractual Clauses | | Supabase | Database hosting, authentication | EU / United States | Standard Contractual Clauses | | Stripe | Payment processing | United States | Standard Contractual Clauses; PCI DSS compliant | | Vercel | Application hosting | Global (edge) | Standard Contractual Clauses | | Sentry | Error tracking and monitoring | United States | Standard Contractual Clauses |

7.2 Schools and Institutions

If you access the Platform through a school, your school may access your learning data, progress reports, and assessment results in their capacity as data controller.

7.3 Parents and Guardians

Parents linked to a student account may view their child's learning progress, quiz scores, and activity summaries.

7.4 Law Enforcement and Regulators

We may disclose your data where required by law, court order, or regulatory request, or where necessary to protect the safety of a child.

8. International Data Transfers

Some of our service providers are located outside the United Kingdom. When we transfer personal data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): We have executed the UK International Data Transfer Addendum to the EU SCCs with all US-based processors.
• Adequacy Decisions: Where the UK Government has made an adequacy decision for a country, we rely on that decision.
• Data Minimisation: We minimise the personal data sent to international processors. AI chat requests are anonymised before transmission to Anthropic.

You may request a copy of the relevant transfer safeguards by contacting [email protected].

9. Data Retention

We retain your data for only as long as necessary for the purposes described in this policy:

| Data Type | Retention Period | |---|---| | User profiles and account data | Until account deletion + 30 days | | AI chat transcripts | 2 years from creation | | Quiz scores and assessment data | 7 years (aligned with educational record-keeping) | | Safeguarding records | Until the data subject reaches age 25 | | Voice recordings | 30 days from creation | | Audit and security logs | 7 years | | Payment records | 7 years (HMRC requirement) | | Marketing consent records | Duration of consent + 2 years |

When data reaches the end of its retention period, it is securely deleted or anonymised.

10. Your Rights

Under UK GDPR, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17): Request deletion of your data where there is no compelling reason for its continued processing (subject to legal retention requirements).
• Right to Restrict Processing (Art. 18): Request that we limit how we use your data.
• Right to Data Portability (Art. 20): Request your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interest, including grade predictions and adaptive learning profiling.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Rights Related to Automated Decision-Making (Art. 22): Request human review of automated decisions.

10.1 Exercising Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month. If your request is complex, we may extend this by a further two months, and we will inform you of any extension within the first month.

10.2 Children's Rights

Parents or legal guardians may exercise data rights on behalf of children under 13. Children aged 13 and over may exercise their own rights, though we may contact a parent for verification.

11. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Row-Level Security (RLS): Database access is restricted so users can only access data they are authorised to see.
• Multi-Factor Authentication (MFA): Available for all account types; required for administrator accounts.
• Audit Logging: All data access and modifications are logged for security review.
• Access Controls: Staff access to personal data is limited to those who need it for their role and is subject to confidentiality obligations.
• Incident Response: We maintain a data breach response plan and will notify affected individuals and the ICO within 72 hours of becoming aware of a qualifying breach.

12. Cookies

We use a limited number of cookies, primarily for essential Platform functionality. We do not use advertising or tracking cookies. For full details, see our Cookie Policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Platform at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

14. Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Website: https://ico.org.uk Telephone: 0303 123 1113

We would appreciate the opportunity to address your concerns before you contact the ICO. Please contact our DPO at [email protected] in the first instance.

15. Contact Us

• General Privacy Enquiries: [email protected]
• Data Protection Officer: [email protected]
• Data Subject Access Requests: [email protected]
• Postal Address: Tutor Volt Ltd, [Registered Address], England

This Privacy Policy is effective from 17 March 2026. Previous versions are available on request.