Privacy Policy

1. Introduction

Tutorlearna (Private) Limited("Tutorlearna", "we", "our", or "us") operates the Tutorlearna platform — an e-learning and tutor marketplace — and related applications ("the Platform").

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights regarding that information. It applies to all users of the Platform, including students, parents/guardians, tutors, teachers, and school administrators.

We comply with the Zimbabwe Data Protection Act, Chapter 11:12 (2021)("ZDPA") and, where applicable, international data protection best practices. By using our Platform, you consent to the practices described in this Policy.

2. Data Controller

The data controller responsible for your personal information is:

3. Information We Collect

3.1 Account and Identity Information

• Full name and email address
• Password (stored in hashed form — never plain text)
• Phone number (optional)
• Account type (student, tutor/teacher, parent, school admin)
• Profile picture (optional)
• Google account details, if you use Google Sign-In

3.2 Tutor-Specific Information

• Biography, qualifications, subjects taught, and experience
• Hourly rate and earnings/wallet data
• Location (latitude, longitude, address) — for in-person tutor discovery
• Identity and background check verification documents
• Availability calendar and lesson slot schedules
• Ratings and reviews received from students and parents

3.3 Booking and Lesson Data

• Lesson booking details: date, time, duration, location type, subject
• Meeting hub selections for face-to-face lessons
• Online meeting links (Google Meet)
• Lesson records: attendance, summaries, homework assigned
• Cancellation reasons

3.4 Payment Information

• Payment amounts, references, and transaction status — processed via Paynow (Visa, EcoCash, OneMoney)
• We do not store card numbers or mobile money PINs on our servers
• Tutor wallet balance and earnings transaction history

3.5 Communications

• Messages exchanged through the Platform's in-app messaging system
• Guardian invite communications between parents and students
• Misconduct reports submitted about other users

3.6 Usage and Technical Data

• IP address, browser type, device type, and operating system
• Pages visited, features used, and session duration — collected via Vercel Analytics (privacy-first, no personal cookies)
• Authentication tokens stored in your browser's local storage
• Learning progress, quiz scores, and performance analytics

3.7 Children's Data

Tutorlearna serves students of all ages, including minors. Where a student is under 18, we require parental or guardian consent through our guardian invite and linking system. We collect only the minimum data necessary for minors and do not use their data for advertising or commercial profiling.

4. Legal Basis for Processing

• Contractual necessity: To provide the services you sign up for (account creation, lesson bookings, payment processing).
• Consent: For optional features such as location sharing, profile pictures, and marketing communications.
• Legitimate interests: To improve our platform, prevent fraud, investigate misconduct, and ensure platform safety.
• Legal obligation: To comply with applicable Zimbabwean laws, tax obligations, and court orders.

5. How We Use Your Information

• Creating and managing your account
• Connecting students with tutors based on subject, location, and availability
• Facilitating lesson bookings and Google Meet sessions
• Processing payments and managing tutor earnings
• Enabling parents to monitor their child's learning progress
• Verifying tutor identities and background checks
• Providing analytics and progress tracking dashboards
• Investigating and resolving misconduct reports
• Sending transactional emails (booking confirmations, password resets, guardian invites)
• Improving the Platform through aggregated, anonymised usage analysis
• Complying with legal and regulatory requirements

6. Sharing Your Information

We do not sell your personal data. We share it only in the following circumstances:

6.1 Between Platform Users

Tutor profiles (name, bio, subjects, rating, location) are visible to logged-in users. Student names are shared with tutors they book. Parent accounts can view their linked child's progress. Direct personal contact details are never shared between users — all communication is managed through the Platform.

6.2 Third-Party Service Providers

• Paynow (Econet): Our payment processor. Your payment data is subject to Paynow's own Privacy Policy.
• Google: For Google SSO authentication and Google Meet lesson links. Subject to Google's Privacy Policy.
• Vercel: Our hosting and analytics provider. Collects anonymised page-view data only.

6.3 Legal Disclosures

We may disclose your data if required by law, regulation, or court order, or to protect the rights, property, or safety of Tutorlearna, our users, or the public.

6.4 Business Transfers

If Tutorlearna is involved in a merger, acquisition, or asset sale, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. When you close your account, we will delete or anonymise your personal data within 90 days, except where required to retain it for legal, regulatory, or tax purposes (typically up to 7 years for financial records under Zimbabwean law).

Lesson records, booking history, and payment transactions may be retained for dispute resolution and auditing.

8. Data Security

• Passwords are hashed using strong cryptographic algorithms and never stored in plain text
• Authentication uses JWT tokens with short expiry and refresh token rotation
• All data is transmitted over HTTPS/TLS encryption
• Payment processing is delegated entirely to PCI-DSS-compliant providers (Paynow)
• User-to-user communication is managed within the Platform to protect personal contact details
• Access to production data is strictly limited to authorised personnel

If you suspect your account has been compromised, contact us immediately at privacy@tutorlearna.com.

9. Cookies and Local Storage

We use your browser's local storage (not traditional cookies) to store authentication tokens that keep you logged in. These are cleared when you log out.

Vercel Analytics does not use cookies or personal identifiers — it uses privacy-preserving, aggregated analytics only.

Third-party services (Google, Paynow) may set their own cookies when you interact with them. Please refer to their respective privacy policies.

10. Your Rights

Under the Zimbabwe Data Protection Act 2021, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to object: Object to processing of your data for certain purposes.
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email privacy@tutorlearna.com. We will respond within 30 days and may need to verify your identity.

11. Children's Privacy

Tutorlearna serves students of all ages. We take the privacy of minors seriously. If a student is under 18, a parent or guardian must create or approve their account through our guardian linking system.

Parents/guardians can access, correct, or request deletion of their child's data by contacting us. We do not use minors' data for commercial profiling or advertising.

If you believe a minor has registered without parental consent, please contact us immediately at privacy@tutorlearna.com and we will promptly remove the account.

12. International Users

Tutorlearna is primarily operated from Zimbabwe. If you access the Platform from outside Zimbabwe, your data may be transferred to and stored in Zimbabwe. By using the Platform, you consent to this transfer. We take appropriate safeguards to ensure your data receives an adequate level of protection wherever it is processed.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or by a prominent notice on the Platform. The "Last updated" date at the top of this page will reflect the most recent revision. Continued use of the Platform after changes constitutes acceptance of the updated Policy.

14. Contact Us

For questions, concerns, or data rights requests, please contact our Data Protection Officer: