TeacherWave

Privacy Policy

Last updated: September 2026

1. Introduction

TeacherWave provides TutorTool, a teaching workspace for independent tutors and for academies ("the Platform"). This Privacy Policy explains what personal data the Platform collects, why, who can see it, how long it is kept and what you can do about it. It applies to tutors, to academy admins, to students and the parents or guardians who hold an account for a child, and to visitors to our website.

2. How the Platform Works

A few facts about the Platform shape everything else in this policy:

  • Tutors bring their own students. A tutor (or an academy) invites students with a personal invite link. There is no directory, no search and no marketplace: nobody can browse tutors, and a student can only ever reach the tutors who invited them.
  • Students pay their tutor directly, never us. We take no part in it and record nothing about it — no price, no amount and no payment record of any kind. Students give us no payment details at all.
  • The only payment on the Platform is a tutor's or an academy's own subscription to us. It is handled by Stripe, and we never see or store a card number.
  • Signing up. A tutor creates an account and can explore the Platform straight away. We email them a link to verify their email address. Until they open it, they cannot add or invite students and their free month has not started; verifying unlocks both. No card is asked for.

3. Who We Are (Data Controller)

The data controller responsible for your personal data is:

  • Data controller: Dale Daniel Earnshaw trading as TeacherWave
  • Address: Ioannina, Epirus 45500, Greece
  • Contact email: [email protected]

For any data-protection question or to exercise your rights, contact us at the email above.

4. Personal Data We Collect

Your account.

  • name, email address, password (stored only as a secure hash), timezone and language;
  • whether your email address has been verified;
  • where you sign in with Google: the name and email address of your Google account, which Google gives us when you sign in;
  • a profile photo, where you upload one;
  • for a tutor: a phone number, the country they live in, a headline and what they teach — the headline and subjects are shown to anyone who opens their invite link;
  • for a tutor or an academy: subscription status and billing identifiers, never a card number;
  • for a tutor offered a regional price (section 4 of the Tutor Agreement): the country their connection came from when they subscribed, which our network provider works out from their IP address, and the billing country they gave Stripe.

Students, and accounts held for a child.

  • a student's date of birth, which we ask for when they accept their tutor's invitation;
  • where a parent or guardian holds the account for a child: the fact that they do, the guardian's own name, and the guardian's date of birth;
  • which tutors a student is linked to, and through which invite link they joined.

We use the date of birth for one purpose: to work out whether that student is under 18, so the tutor teaching them knows. Where a parent or guardian is setting the account up for a child, we also ask for the guardian's name and date of birth — the name so the tutor has an adult to contact, and the date of birth so we can check that the person taking responsibility for the account is at least 18. None of it is ever used for advertising, profiling or decision-making, none of it is ever sent to an advertising platform — no advertising technology runs on a student's screens at all — and we ask nothing further about a child beyond what any student gives us.

Teaching records.

  • a tutor's weekly availability and time off;
  • lesson requests, bookings, group classes and their history;
  • group membership — which of a tutor's groups a student is in;
  • assessments, results, learning plans (checklists) and report cards;
  • the level a tutor records about their own student, and the private notes a tutor keeps beside that level and on a lesson's attendance;
  • attendance a tutor records, and classroom attendance logs;
  • messages, including group chat, and any files attached to them;
  • recordings of lessons held in the classroom, which include the audio, video and any screen sharing of everyone present.

Academies.

  • where a tutor is employed by an academy: the academy's name, which of its tutors and admins each account belongs to, the academy's own subscription status and billing identifiers, and the name and email address on each invitation it sends to a tutor or an admin, until that invitation is accepted, revoked or expires;
  • which academy a student belongs to, and when they joined it — a student belongs to an academy from the moment they open one of its tutors' links, and stays listed with that academy until it removes them, even if the tutor who brought them leaves;
  • an email address an academy gives us for somebody who has no account yet, so that we can send them one invitation carrying one of its tutors' join links. We keep it only as that invitation record, we use it for nothing else, and the academy can withdraw it at any time. If the person registers, it becomes the email address on their own account and the invitation is marked as taken up; if they never do, the record stays with the academy until the academy withdraws it or the academy is closed.

Referrals between tutors.

  • a tutor's own referral link, for inviting other tutors to the Platform;
  • where a tutor joins through another tutor's referral link: which tutor referred them, and how far the referral has got — when they joined, when their free month started, when they first paid for their subscription and Stripe's reference for that payment, when the referring tutor's free month was added or kept for them, and, where we decide a referral does not count, when and why. The code from the link reaches us from the new tutor's browser when they create their account; our Cookie Policy describes how the browser keeps it until then.

Everything else.

  • where you connect your Google Calendar: the credentials Google issues so we can write to it (stored encrypted), the identifier of the calendar we create there, and — only for a tutor who chooses two-way sync — the start and end times of the events in their own Google calendar, and nothing else about those events;
  • where a tutor switches on their own PayPal button: that tutor's PayPal account and plan identifiers, and the code they pasted to give us those — nothing about any student;
  • support requests and suggestions you send us;
  • the email address a visitor leaves on our landing page to ask for personal setup help, and anything else you have asked us to contact you about;
  • IP address and the country it comes from, device and browser information;
  • cookies and analytics data, as our Cookie Policy describes.

Finn, our AI add-on, sends a tutor's request to an AI model provider. A tutor or academy that has bought Finn can ask it to build a test or a learning plan. We then send an AI model provider what the tutor typed into Finn's form — what it should cover, a name, a level, how many questions and which kinds, how many weeks — together with the names of the tutor's own sections, the platform's own instructions, and a random reference for the account that is not the tutor's name or email address. Only where the tutor asks Finn to reuse questions from their question bank do we also send the text of those bank questions. We send nothing about any student, and a tutor must not type a student's or anyone else's personal information into Finn. The provider we use today processes requests in the People's Republic of China; our AI providers page names every provider, where it processes requests and a link to its own privacy notice, and we update that page before any provider changes. We keep a record of each request — when it was made, for which task, how long it was and what it cost us — but not the text itself, except a short excerpt of a request our automatic check refused, which we keep to look into misuse.

Using your own AI assistant sends us nothing. A tutor can instead download a brief and take it to an AI assistant of their own, then upload the reply. The brief carries the tutor's own section names and levels and nothing about any student, the uploaded file is read and discarded, not stored, and we send nothing to that assistant.

We avoid collecting sensitive personal data, and ask for nothing we do not need to run the Platform.

5. How We Use Personal Data

We use personal data to:

  • create and manage accounts, including sign-in with Google;
  • verify a tutor's email address before they can add or invite students, and start their free month when they do;
  • connect a student to the tutor who invited them, and to that tutor's academy;
  • establish whether a student is under 18, so their tutor knows they are teaching a child and who the responsible adult is;
  • check that a parent or guardian taking responsibility for a child's account is themselves at least 18;
  • run lesson requests, bookings, group classes and the classroom;
  • enable tutor and student messages, including a group's chat;
  • keep a tutor's own record of assessments, learning plans and progress, and show a student their own progress;
  • record lessons held in the classroom, for safeguarding, security and quality purposes;
  • write your lessons into your own Google Calendar where you have connected it, and, for a tutor with two-way sync, stop a student booking over the tutor's own Google events;
  • run a tutor's or an academy's own subscription to us, and any add-on they buy;
  • decide whether a tutor is offered a regional price, and check afterwards that it went to someone who lives where it is offered;
  • show a visitor to our public pages the tutor price that applies where their connection comes from, and our prices in their own currency, approximately;
  • run the referral programme between tutors: record which tutor referred whom, give the referring tutor the free month they earn, and look into referrals that may not be genuine;
  • build a test or a learning plan with Finn when a tutor or an academy asks it to, and measure how much of their monthly allowance it uses;
  • arrange personal setup help for a visitor or tutor who has asked for it;
  • send service emails, such as verification links, lesson notices and reminders;
  • provide support, prevent fraud and abuse, and enforce our Terms;
  • improve the service;
  • comply with legal obligations;
  • send marketing only where you have asked for it.

We do not verify tutors' qualifications and do not process, hold or reconcile payments between a student and a tutor, so we do not use personal data for either purpose. We do not profile anyone, and we make two decisions automatically. Whether a tutor is offered a regional price follows from the country in their profile and the country their connection comes from; a tutor it does not apply to can subscribe at the normal price, and can ask us to look at it. Finn's automatic check can refuse a request that does not look like teaching content; that affects only that one request, which can be reworded, and nothing else about the account.

6. Legal Bases Under GDPR

Where GDPR applies, processing relies on:

  • contract necessity — running your account and the lessons, work and messages in it, the add-ons you buy, such as Finn, and the free months you earn by referring other tutors;
  • consent — optional cookies, marketing, connecting your Google Calendar, and a request to be contacted about personal setup help;
  • legitimate interests — platform security, fraud prevention, service improvement, recording lessons for safeguarding, security and quality, running the referral programme fairly: crediting the tutor whose link brought a new tutor, and looking into referrals that may not be genuine, and checking that a regional price went to a tutor who lives where it is offered;
  • legal obligations;
  • vital interests in rare emergency cases.

7. Who Can See Your Data, and Who We Share It With

People on the Platform.

  • the tutor who invited you, where you are their student — they see your name and photo, your lessons with them, the work they set you, your results and your attendance. They are also shown whether you are under 18, and the name of your parent or guardian where one holds your account; they are not shown your date of birth itself, or your guardian's. A tutor never sees your lessons or records with a different tutor. Each tutor is responsible for their own use of what they record about their students, as an independent controller;
  • your students, where you are a tutor — they see your name, photo, headline, what you teach and the notice you require to cancel a lesson, together with the level, learning plans, results, report cards and attendance you record for them (never the private notes you keep beside a level or on a lesson's attendance). Anyone who opens your invite link, whether or not you sent it to them, sees your name, photo, headline and what you teach;
  • the other members of a group a tutor has put you in — they see your name, and everything you write in that group's chat, and you see theirs;
  • the tutor whose referral link you joined through, where you are a tutor who joined that way — they see your name, the date you joined, and whether you have earned them their free month yet, which tells them whether you have made your first subscription payment. They see nothing else about your account, your students or your billing, and the email telling them they have earned the month names you;
  • the admins of the academy your tutor teaches for, where your tutor is employed by one. They see your name and email address, which of their tutors you are linked to, and the same progress page your tutor sees — the level you were given, how far through their learning plans you are, your marked assessments and the feedback on them, your report cards, and your lesson and attendance figures — for every tutor of that academy you are linked to, and for no other tutor. They do not see your messages with anyone, your calendar, your lessons, or the private note a tutor keeps beside your level. Your tutor's invitation page names their academy, so you know before you join.

Service providers and others.

  • Google, where you sign in with a Google account, or where you connect your Google Calendar. We write your booked lessons into a calendar we create in your Google account: a student's entry names their tutor; a tutor's entry never names a student. With two-way sync we also read the start and end times of a tutor's own Google events, and no other detail of them. Google processes that data under its own privacy policy, and you can disconnect at any time;
  • Stripe, only for a tutor's or an academy's own subscription to us. Stripe collects and stores the card, under its own terms and privacy notice; we never see or store a card number. Where a tutor is offered a regional price, Stripe also asks for their billing address, of which we keep only the country;
  • Cloudflare, our network provider, through which requests to our servers pass. It sees each request's IP address and tells us which country the request comes from, which is how we know whether to offer a tutor a regional price, and which currency to show a visitor our prices in. We convert them at the European Central Bank's published reference rates, which our servers fetch; nothing about you is sent to the bank;
  • PayPal, where your tutor shows you their own PayPal subscription button and you open that page and press it. We send PayPal nothing about you. PayPal's own software loads in your browser at the moment you press the button, so PayPal sees that visit and whatever you then give it directly, under its own terms and privacy notice — it is a recipient you contact, not one we pass your data to. We store nothing about any student in connection with it: not whether you opened the page, not whether you pressed the button, and not whether you ever paid;
  • Discord, where a visitor asks for personal setup help on our landing page, or a tutor asks for a call while signing up: the email address is posted, together with where the request came from, to a private channel of ours hosted by Discord, so that we see the request promptly and can write back;
  • Microsoft, only where you have accepted optional cookies: Microsoft Clarity records how a visit moves through our website — the pages and what was shown on them, clicks and scrolling, never what is typed into a form — so we can improve it. For a signed-in tutor that can include what their screens show about their students, and the recording is linked to the tutor's account reference, never to a name or email address. Clarity is never used on any screen a student sees. Our Cookie Policy describes this in full;
  • Google, only where you have accepted optional cookies: the Google Ads tag tells Google that someone created a tutor or academy account after visiting us, so we can tell which advertising is worth paying for. We send Google no name, no email address, no phone number and no account reference, we do not upload customer lists, and we do not build advertising audiences or profiles from your visit. It is never used on any screen a student sees, and a student account can only be created through a tutor's invitation, so no sign-up we measure is a student's. Nothing about you is reported to any advertising platform from our servers. Our Cookie Policy describes this in full;
  • AI model providers, only where a tutor or an academy uses Finn: they receive what the tutor typed into Finn's form, the tutor's own section names and, where they ask Finn to reuse them, their own bank questions, as described above, and never anything about a student. Our AI providers page names each one;
  • hosting providers, including the provider that hosts our own classroom server;
  • email providers, which deliver the emails the Platform sends;
  • legal advisers and accountants;
  • courts, regulators, or public authorities where the law requires it.

Lesson recordings are not shared with anyone, including the people in them. A recording is not passed to your tutor, to other students in a group class, or to any third party, and the Platform provides no way to play back, download or share one. It is held on the classroom server we operate, and is disclosed further only where the law requires it. Only our own staff can reach or delete one.

TeacherWave does not sell personal data.

8. International Transfers

Some providers — Google, Microsoft, Stripe, Discord, Cloudflare, our email providers and our AI model providers — may process data outside Greece or the European Economic Area. The AI model provider Finn uses today processes requests in the People's Republic of China, a country the European Commission has not found to protect personal data adequately. Where required, TeacherWave will use appropriate safeguards such as adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.

9. Data Retention

We keep personal data only for as long as it is needed to run your account, to meet legal, tax and accounting obligations in respect of subscriptions, and to prevent fraud, resolve disputes and keep the Platform secure. In particular:

  • a student or academy registration whose email address is never verified, and that has never been signed into, is deleted after seven days. A tutor's account is signed in as soon as it is created, so it is kept like any other account whether or not the email address has been verified, until it is deleted;
  • a tutor's lessons, work and messages with a student are removed when either account is erased;
  • a lesson recording is kept until the account it belongs to is erased, and is deleted then; there is no earlier scheduled deletion;
  • a referral between two tutors is kept while both accounts exist. It is deleted when the referring tutor's account is erased, and when the referred tutor's account is erased — unless the referral had already earned the referring tutor their free month. Then we keep the record of that month for the referring tutor, without the referred tutor's account or the reference of their payment, so it no longer points to them;
  • a request for personal setup help — the email address a visitor leaves on our landing page, or a call a tutor asks for while signing up — is kept until we have been in touch and it is no longer needed, or until they ask us to remove it;
  • the countries recorded for a regional price are kept with the subscription they priced, and deleted when the tutor's account is erased.

Finn's records — when each request was made, for which task, how long it was and what it cost, and the excerpt of any refused request — are kept until the tutor's or academy's account is erased. What an AI model provider keeps of a request is governed by that provider's own terms and privacy notice.

When an academy is closed we delete the academy, its teaching library, its invitations, its subscription records and its admins' accounts. Its tutors' accounts are not deleted: a tutor keeps their account, their students and everything they have taught, because those records are their students' too.

When data is no longer needed, we delete or anonymise it, or keep it securely only where the law requires us to.

10. Your Rights

Where GDPR applies, you may have the right to:

  • access your data;
  • correct it;
  • have it deleted;
  • restrict or object to its processing;
  • data portability;
  • withdraw consent at any time;
  • complain to a supervisory authority.

You can correct your own name, photo, timezone and — for a student, or the guardian who holds their account — the dates of birth and guardian details we hold, from your settings. Other requests can be sent to the contact email above. Where a request concerns what your tutor has recorded about you, your tutor is responsible for it as an independent controller, and you can also ask them directly.

11. Security

We use reasonable technical and organisational measures to protect data, including secure hosting, HTTPS, access controls, hashed passwords, encryption where appropriate (Google Calendar credentials are stored encrypted), and account protection measures. No online system is completely secure.

12. GDPR Compliance Measures

TeacherWave maintains:

  • this Privacy Policy and a Cookie Policy, with a cookie consent banner;
  • a versioned acceptance of the platform rules, recorded per user, and re-asked when the rules change materially;
  • data deletion and data access request processes;
  • a processor list and data processing agreements where needed;
  • a breach response process and internal access controls;
  • records of processing activities where required, and a retention policy;
  • marketing consent records;
  • a child and minor safety process, because students of any age use the Platform.

13. Contact

For privacy questions or to exercise your rights, please contact us through our Contact Us page. See also our Terms and Conditions and Cookie Policy.