Your information, explained clearly

Who is responsible

Michael Print, trading as CompSciTutoring.co.uk, is the controller for personal information used to provide this tutoring service. Contact michael@compscitutoring.co.uk.

For postal correspondence and legal notices, see the service address in the terms of tuition.

Information used

Account and contact details, the student age band, student and parent links, lesson requests and notes, availability and lesson records, payment status and Stripe customer references, referral codes, claim and credit-ledger records, lesson joining details, security records, customer reviews, and account messages. A free-workshop registration uses the account holder's name and verified email and may include an optional requested topic and campaign code. It also records confirmation, attendance, moderated questions and any workshop concern. A review record includes private account and tutoring-relationship evidence, the reviewer's account first name, rating, wording, broad public label, publication consent, status and moderation history. Referral records use account IDs and an opaque code rather than a friend's name or contact details. Messaging records include content, sender and time, read state, automated contact-detail flags, redactions and administrator access records. A safety report records its reporter, category, description, relevant message, review history and outcome. Card numbers are entered into Stripe and are not stored by this website.

Why it is used

• To create accounts, arrange and deliver lessons, take payment and respond to requests: necessary to take steps before and perform a contract.
• To administer an accepted referral claim, calculate credit and prevent self-referral or linked-family misuse: performing the scheme terms and legitimate interests in operating the offer fairly.
• To verify, moderate and administer genuine customer reviews: legitimate interests in providing trustworthy customer information and complying with consumer-protection duties. The customer expressly agrees to publication of their account first name, chosen rating, wording and broad label and can withdraw the review at any time.
• To keep financial, safeguarding and dispute records: legal obligations and legitimate interests in operating a safe, accountable service.
• To secure accounts, prevent abuse and investigate incidents: legitimate interests in protecting students and the service.
• Optional marketing or non-essential cookies will only be used with appropriate consent.

Public customer reviews

A published review shows the reviewer's account first name, rating, customer wording, chosen broad relationship description, publication month and a verified direct-customer label. Surnames, email addresses, student names and lesson records remain private. The customer reviews policy explains eligibility, moderation, editing, withdrawal and complaints.

Optional learning emails

Marketing emails are separate from accounts and lesson messages. The initial list is adult-only: a person must actively attest that they are 18 or over and confirm the request by email within 48 hours. The service records the email address, broad declared interest, exact consent version and events needed to prove, change or withdraw the choice. Unsubscribe, complaint and permanent-delivery-failure suppression is checked again before every send. Email opens and individual link clicks are not tracked in the initial system.

Students and family links

The service uses the minimum information needed for tuition. A parent may create a student profile. Under-13 profiles remain parent-managed, do not require a student email and cannot activate a separate login. A student aged 13–17 may activate their own login, at which point the parent link pauses until the student accepts it. An adult profile created by a parent is not linked until the adult activates the account and accepts. Existing student accounts must also approve new family links. A linked parent can manage tuition and participate in the shared conversation for that student. Children can exercise their own data-protection rights where they have sufficient understanding; a parent does not automatically own a child's personal information.

Students can read the shorter privacy explanation for students.

Service providers

Information may be processed by the hosting and PostgreSQL database providers, Neon Auth, Stripe and Resend. If you choose social sign-in, Google or Microsoft processes the authentication information needed for that choice. Resend sends service emails and alerts, but platform-message emails do not contain the message itself. New bookings use the private lesson space, where LiveKit, Liveblocks, Cloudflare R2 and E2B may process video-session metadata, collaborative lesson content, private resources or isolated code-execution data. Free workshops also use LiveKit for receive-only attendee access; registration and moderated questions remain in the application database. Providers are only used for the relevant service and may process information outside the UK under their contractual transfer safeguards.

Retention

Information is kept only for a documented business, legal, tax, safeguarding or dispute purpose. Core contract, payment, referral-credit and relevant communication records may be retained for up to six years after the relationship ends. An unused referral credit expires after 12 months; its ledger entry remains with the related financial record so issue, use, release or reversal can be audited. A published review remains public until it is withdrawn or removed under the review policy. A withdrawn review disappears from public display immediately; the private review and moderation record is retained only for the applicable authenticity, customer-service, complaint or legal period. Redacting a message hides it from the ordinary conversation but preserves the original and audit reason where needed for safeguarding, security or disputes. Short-lived verification and reset links expire after one hour; newsletter confirmation links expire after 48 hours. Identifiable workshop registrations, topic requests, questions and attendance are ordinarily deleted 90 days after the event. A workshop may create a private seven-day recording of the host's published camera, microphone and clean whiteboard/code presenter feed; attendee cameras and microphones remain disabled, browser screen sharing is not required for those teaching tools, and only clips deliberately exported by the tutor enter the separate Content Studio retention process. Tutor-student lesson-space whiteboards, chat, code and private files are scheduled for deletion 180 days after the latest scheduled lesson. A narrowly recorded safeguarding or legal-dispute hold pauses deletion; clearing the hold restores the ordinary schedule. Safety reports and their decision history are retained only for the safeguarding, compliance or dispute period that applies to the report. You may ask for the retention period applying to a particular record or request deletion, subject to any legal, safeguarding or dispute-preservation requirement.

Your rights and complaints

You may ask for access, correction, erasure, restriction, portability or object to certain uses. Rights depend on the purpose and lawful basis, and some records must be retained. To exercise a right or make a data-protection complaint, email michael@compscitutoring.co.uk. A complaint will be acknowledged within 30 days, investigated and answered with the outcome. You may also complain to the Information Commissioner's Office at ico.org.uk.

Security incidents

Suspected loss, disclosure or misuse of personal information should be reported promptly by email. Incidents are assessed, contained and recorded, with affected people and the ICO notified where the legal risk threshold is met.