Privacy Policy

Effective date: 5 October 2026

Service: TutorAI

Data Controller: AKSA Corp OÜ, Juhkentali 8, Tallinn 10132, Estonia

1. Data Controller

The data controller responsible for your personal data is:

AKSA Corp OÜ

Registry code: 12610057

Address: Juhkentali 8, Tallinn 10132, Estonia

Contact: support@gettutor.app

If you have any questions about how your data is handled, please contact us at the address above.

2. Data We Collect

We collect only the data that is necessary to provide and improve the Service.

2.1 Account Data

2.2 User Settings

We store the preferences you configure in your account settings:

• Interface language — the language used for the TutorAI interface
• Explanation language — the language in which AI explanations are delivered
• Education level (and school grade, where applicable) — used to tailor explanations to your academic level
• Country — used to align explanations with your curriculum

2.3 Usage Data

We track usage metrics necessary for operating the Service fairly:

• Number of explanations requested per day and per month
• Date of last usage reset
• Subscription status (free or Pro)

This data is used solely to enforce the daily free usage limit and the fair usage policy, and to determine Pro subscription access.

2.4 Technical Data

When you use the Service, we may automatically collect:

• IP address (used for rate limiting on account registration; not stored long-term)
• Browser type and version (for compatibility purposes)
• Device type

We do not build advertising profiles or track your behaviour across other websites.

2.5 Study Sessions and Messages

When you use Study — our interactive tutoring mode — we store the Study history you create, namely:

• the subject, topic and learning goal of each session;
• the full text of the messages you send;
• the assistant's replies to you;
• timestamps and the session status (for example, active or completed).

These conversations are retained as your Study history so you can review and resume them, and are deleted when you delete the session or clear your Study history.

2.6 Study Memory

To provide continuity in your learning, TutorAI may derive and store a concise educational summary from your Study conversations. This may include a short session summary, the concepts covered, areas where further practice may be useful, observed strengths, and suggested next steps. It is used only to support future tutoring within Study; it is not a psychological, medical or mental-health assessment. It is removed together with the Study session it relates to.

3. Uploaded Content

When you upload an image or submit a text question:

• Your content is transmitted securely to our AI provider for processing.
• The AI-generated explanation is returned and displayed to you.
• Uploaded images are not stored on our servers after the explanation is generated.
• Your explanation history stores a preview of your typed question (up to 100 characters), any question you attach to an uploaded image, and the full AI-generated explanation (summary, steps and related content), so you can identify and review past sessions.

You may delete individual entries or clear your whole Solve explanation history at any time from your account dashboard. Deleting history does not refund or restore any usage allowance.

Voice input. Study optionally accepts microphone audio. The recording is sent to TutorAI's transcription endpoint and then to our AI provider to produce text, which is placed into an editable Study message draft for you to review and send. Raw audio is processed transiently and is not persisted by TutorAI in our database, filesystem, object storage or browser storage. The transcript is not stored automatically; it becomes stored Study content only if you send it as a Study message.

Learning materials (Pro). In Study, Pro users can optionally attach learning materials — images (JPEG, PNG, WEBP) or PDF documents — to a session. Unlike Solve images, these materials are stored, so they remain associated with your session and can be reused across your ongoing conversation without re-uploading. Each file is uploaded directly from your browser to our private object-storage provider (Cloudflare R2) using a short-lived, single-purpose authorization link that our server issues only after verifying your Pro access and that you own the session. The file is stored as a private object referenced by an opaque server-side key that is never public and is never returned to your browser in normal Study data; no permanently public URL is created, and no storage credentials ever reach your browser. When you send a message, the relevant materials are transmitted securely to OpenAI so the tutor can consider them alongside your text. Only safe metadata (file type, size and the display name you provided) is kept in your session to show the removable chips. You can remove a material at any time, which deletes both its metadata and its stored object; deleting the session, clearing Study history, or deleting your account also removes them. If your Pro access later expires, existing materials are retained (your history is preserved), but new materials can only be uploaded while you have Pro access.

4. Purpose of Processing

We process your personal data for the following purposes:

• Providing the Service — to operate your account, authenticate you, and deliver AI explanations.
• Usage management — to apply daily free usage limits and the fair usage policy.
• Subscription management — to manage Pro plan access and billing via Stripe.
• Service improvement — to monitor system performance and usage patterns at an aggregate level.
• Communication — to send important service-related notifications (not marketing emails without your consent).
• Legal compliance — to fulfil our obligations under applicable laws.

5. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Contract performance (Article 6(1)(b)) — processing your email address, name, and settings is necessary to provide the Service you have agreed to use.
• Legitimate interests (Article 6(1)(f)) — processing usage and technical data to protect the integrity and fair operation of the Service.
• Consent (Article 6(1)(a)) — where you have explicitly agreed to specific processing (e.g. accepting these terms during registration).
• Legal obligation (Article 6(1)(c)) — where processing is required to comply with applicable law.

6. Third-Party Services

We share data with the following third-party providers only to the extent necessary to operate the Service.

6.1 OpenAI

Your Solve questions and uploaded images, your Study conversations and context, the Study learning materials you attach (images and PDFs), the material used to generate your Study memory, and Study voice recordings (for transcription) are sent to OpenAI Ireland Ltd (Ireland) for AI processing. OpenAI processes this data as a data processor on our behalf.

• OpenAI's privacy practices are governed by their own Privacy Policy: https://openai.com/privacy
• OpenAI states that data sent through its API is not used to train or improve its models by default, unless the customer explicitly opts in; we have not opted in to such training.
• OpenAI may retain abuse-monitoring logs for its chat/completions API for up to 30 days by default, subject to its own policies and exceptions. For its audio transcription endpoint, OpenAI's current documentation lists no retention of the submitted audio or transcript beyond processing.
• These are OpenAI's provider-side retention terms and are separate from what TutorAI itself stores (see the Data Retention section below).
• Data transferred to OpenAI may be processed outside the European Economic Area (EEA). Such transfers are covered by appropriate safeguards as required by GDPR.

6.2 Stripe

Subscription payments are processed by Stripe, LLC. (USA). When you subscribe to TutorAI Pro, your payment information is handled directly by Stripe — we do not store your card details.

• Stripe's Privacy Policy: https://stripe.com/privacy
• Stripe may process data outside the EEA under appropriate transfer mechanisms.

6.3 Neon

Your account data, explanation history, Study sessions, messages and Study memory are stored in a PostgreSQL database hosted on Neon, our database infrastructure provider.

6.4 Resend

Transactional emails (such as password-reset and service notifications) are delivered using Resend, an email-delivery service. We share only the data necessary to deliver the relevant message.

6.5 Google Analytics

With your consent (see the Cookies section), we use Google Analytics to understand how the Service is visited and used in aggregate. Analytics is optional and loads only after you accept it. Google's own privacy practices apply: https://policies.google.com/privacy. Google may process data outside the EEA under appropriate transfer mechanisms.

6.6 Cloudflare R2

The Study learning materials you attach are stored as private objects in Cloudflare R2 object storage (Cloudflare, Inc.), our storage infrastructure provider. Files are uploaded directly from your browser using a short-lived, single-purpose authorization link that our server issues only after verifying your Pro access and your ownership of the session. Each object is reachable only through an opaque server-side key, is never publicly listed, and is deleted when you remove the material, delete the session, clear your Study history or delete your account. Cloudflare processes this data as a data processor on our behalf; its own privacy practices apply: https://www.cloudflare.com/privacypolicy/. Data stored with Cloudflare may be processed outside the EEA under appropriate transfer mechanisms. No storage credentials are ever exposed to your browser.

We do not sell or rent your personal data to any third party.

7. Cookies

TutorAI uses necessary (functional) cookies and local storage that the Service needs to operate correctly, and — only with your consent — optional Google Analytics cookies. We do not use advertising cookies.

Necessary / functional

Optional analytics (only after you accept)

Google Analytics loads only after you give consent; if you reject it, TutorAI remains fully functional and we set no analytics cookies. Your choice is remembered and can be changed at any time through Cookie preferences (available in the footer and your settings). Analytics measures your visits to TutorAI only — we do not build advertising profiles or track your behaviour across other websites.

You can clear cookies and local storage at any time through your browser settings. Doing so will log you out, reset your language preference, and reset your consent choice.

8. Data Retention

We retain your personal data only for as long as necessary:

TutorAI does not provide a self-service account-deletion button. To delete your account and the associated personal data, contact us at support@gettutor.app; requests are handled manually and processed within the period required by applicable law, except where retention is required by law. Deleting your history or your account does not refund or restore usage allowances.

9. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can request correction of inaccurate or incomplete data.
• Right to erasure — you can request deletion of your personal data ("right to be forgotten").
• Right to restriction — you can request that we limit processing of your data in certain circumstances.
• Right to data portability — you can request your data in a structured, machine-readable format.
• Right to object — you can object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at support@gettutor.app. We will respond within 30 days.

You also have the right to lodge a complaint with your national data protection authority. In Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): https://www.aki.ee

10. Children and Parental Involvement

TutorAI is also designed for students aged below 18. We take the privacy of younger users seriously.

• We do not knowingly collect personal data from children under 18 without parental consent.
• Users under 18 must use the Service under parental or guardian supervision, in accordance with our Terms of Use.
• Parents and guardians may contact us at support@gettutor.app to request access to, correction of, or deletion of their child's account data.
• If we become aware that a child under 18 has created an account without parental consent, we will delete the account and associated data promptly.

We encourage parents to speak with their children about safe and responsible use of online services.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of significant changes by posting a notice in the Service or by email.

The date at the top of this page indicates when the Policy was last updated. Continued use of the Service after changes are published constitutes acceptance of the updated Policy.

For questions about this Privacy Policy, contact us at support@gettutor.app.