Privacy Policy

1. Data Controller and Contact

Tutorelli is a product of Intransigense Corporation ("we", "us", "our"). We are committed to compliance with applicable privacy legislation, including the General Data Protection Regulation (GDPR) and the Personal Information Protection and Electronic Documents Act (PIPEDA).

For privacy inquiries, contact us at support@tutorelli.ai

2. About Tutorelli

Tutorelli is an AI-powered educational platform with two distinct sides:

• Student side: AI tutoring, PDF uploads for study, AI chat, flashcards, quizzes, exams, and voice tutoring.
• Professor side: Exam grading (upload student exam PDFs for AI-assisted marking), slide creation, assignment marking (upload student work with rubric-based grading), quiz generation, and billing/payments.

This policy explains how we collect, use, store, and protect information across both sides of the platform.

3. Information We Collect

3.1 Account Information (All Users)

• Name and email address
• Password (stored in hashed form only; we never store plaintext passwords)
• Institution or organization name
• Google OAuth tokens (if you sign in with Google)

3.2 Student Data

• Uploaded PDFs, lecture materials, and study documents
• Extracted text from uploaded documents
• AI chat messages and conversation history
• Quiz attempts, exam responses, and performance scores
• Flashcards and other study materials you create
• Voice recordings processed through the voice tutor feature (via ElevenLabs)

3.3 Professor Data

• Uploaded exam PDFs, which may contain student names, student IDs, and handwritten answers
• Grading results, including per-student scores and per-question breakdowns
• Assignment rubrics and marking criteria
• Uploaded student assignment files (documents, code, and other work)
• Generated slides and course outlines
• Course and section information

3.4 Payment Information

All payment processing is handled by Stripe. Credit card numbers, bank account details, and other financial information are collected and processed directly by Stripe and never touch our servers. We receive only non-sensitive transaction metadata (such as subscription status and invoice identifiers) from Stripe.

3.5 Technical Information

• IP addresses
• Browser type and version
• Session cookies (used for authentication only)
• Server access logs

4. Legal Basis for Processing

We process your personal data under the following legal bases as defined by the GDPR:

• Performance of a contract: Processing necessary to provide the services you signed up for, including AI tutoring, exam grading, content generation, and account management.
• Legitimate interest: Processing for platform security, fraud prevention, service improvement, and usage analytics.
• Consent: Processing for optional features such as the voice tutor, marketing communications, and any other features where we explicitly request your consent. You may withdraw consent at any time.
• Legal obligation: Processing required to comply with applicable laws, such as retaining financial records.

5. How We Use Your Information

We use collected information for the following purposes:

• Provide AI tutoring, chat, quiz generation, and study aid features for students
• Provide exam grading, assignment marking, slide creation, and quiz generation for professors
• Process uploaded documents through OCR and AI analysis
• Generate personalized flashcards, summaries, and study materials
• Track learning progress and provide performance analytics
• Process payments and manage subscriptions
• Maintain account security and prevent fraud
• Send service-related communications and important updates
• Respond to support requests
• Improve and develop our platform

We do not sell your data. We do not use your data for advertising. We do not use tracking cookies.

6. Third-Party Processors

To provide our services, we share data with the following third-party processors. All processors are contractually bound to handle your data securely and only for the purposes we specify.

AI model training: Data sent to OpenAI, Anthropic, and Google Cloud via their APIs is not used to train their models. Per each provider's API usage policies, API inputs and outputs are not used for model training purposes.

7. International Data Transfers

Tutorelli is operated from Canada. Our data processing infrastructure and third-party processors listed in Section 6 are located in the United States.

By using Tutorelli, you acknowledge that your data will be transferred to and processed in the United States, which may have different data protection laws than your country of residence. We ensure that all transfers are conducted with appropriate safeguards, including contractual protections with our processors.

For users in the European Economic Area (EEA), transfers are made pursuant to Standard Contractual Clauses (SCCs) or other approved mechanisms as required by the GDPR.

8. Professor-Uploaded Student Data

This section addresses the specific privacy considerations for student data uploaded by professors through the exam grading, assignment marking, and related features.

8.1 Roles and Responsibilities

• Professors act as data controllers for the student data they upload to Tutorelli. Professors are responsible for ensuring they have the necessary institutional authorization to upload and process student work through our platform.
• Tutorelli acts as a data processor, processing student data solely on behalf of and under the instructions of the professor.

8.2 What Student Data Is Processed

When professors upload exam PDFs and student assignments, this data may contain:

• Student names and student identification numbers
• Handwritten or typed answers, code submissions, and other student work
• Exam scores and per-question grading breakdowns generated by the platform

8.3 How Student Data Is Used

• Student personally identifiable information (names, IDs) is processed solely for the purpose of grading and returning results to the professor.
• Student data is not used to train AI models.
• Student data is not shared with other professors, students, or any third parties beyond the processors listed in Section 6.
• Student data is not used for marketing, advertising, or profiling.

8.4 Institutional Notice

Professors should ensure their institution informs students that exam and assignment data may be processed by AI-based tools for grading purposes. This notice should be provided by the institution or professor as part of course syllabi or institutional privacy policies.

9. Data Retention

• Active accounts: Your data is retained for as long as your account remains active.
• Deleted accounts: Upon account deletion, personal data is deleted within 30 days. Backup copies are purged within 90 days.
• Exam and assignment data: Retained while the professor's account is active. Deleted when the professor deletes their account.
• Payment records: Stripe retains payment records as required by law (up to 7 years for financial compliance).

You can delete your uploaded content at any time through your account settings.

10. Your Rights

Under the GDPR, PIPEDA, and other applicable laws, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data (subject to legal retention requirements).
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to restriction: Request that we limit how we process your data.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
• Right to lodge a complaint: File a complaint with a supervisory authority (for EEA residents) or the Office of the Privacy Commissioner of Canada.

How to Exercise Your Rights

To exercise any of these rights, contact us at support@tutorelli.ai. We will respond to your request within 30 days. We may ask you to verify your identity before processing the request.

11. Data Security

We implement appropriate technical and organizational measures to protect your data:

• All data is encrypted in transit using TLS (HTTPS)
• All data is encrypted at rest using AWS encryption
• Passwords are cryptographically hashed and never stored in plaintext
• Access controls and role-based authentication
• Environment-based data isolation
• Regular security monitoring and updates
• Automated dependency security scanning
• Threat detection and monitoring

12. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We do not use your data for advertising. We share information only in these limited circumstances:

• With the third-party processors listed in Section 6, solely to provide our services
• With your explicit consent
• To comply with legal obligations, court orders, or lawful government requests
• To protect the rights, property, or safety of Tutorelli, our users, or the public

13. Cookies

Tutorelli uses only essential session cookies required for authentication and maintaining your logged-in state. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. No cookie consent banner is required because we only use strictly necessary cookies.

14. Children's Privacy

The student side of Tutorelli is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take prompt steps to delete that information.

The professor side of Tutorelli may involve the processing of data belonging to students who are minors (under 18). As described in Section 8, professors are the data controllers for this data and are responsible for ensuring they have appropriate authorization from their institution to process it.

15. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by the GDPR
• Notify affected users promptly and without undue delay
• Report the breach to the Office of the Privacy Commissioner of Canada as required by PIPEDA
• Document the breach and the remediation steps taken

16. Complaints

If you are not satisfied with how we handle your personal data, you have the right to:

• Contact our Privacy Officer at support@tutorelli.ai
• File a complaint with the Office of the Privacy Commissioner of Canada (for PIPEDA matters)
• File a complaint with your local data protection supervisory authority (for GDPR matters)

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify users via email or through the platform. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of Tutorelli after changes are posted constitutes acceptance of the updated policy.

18. Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise any of your rights, please contact us:

Intransigense Corporation
Email: support@tutorelli.ai