Data Processing Agreement
Last updated: 15 November 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between TutorLedger and the tutor using TutorLedger ("you"). It applies when TutorLedger processes personal data about your students and their families on your behalf, including under the EU GDPR, the UK GDPR, India's DPDP Act 2023 and similar laws. It takes effect when you accept the Terms. If you need a signed copy, email support@tutorledger.app.
1. Roles
You are the controller (under the DPDP Act, the data fiduciary) of your students' and families' personal data. TutorLedger is your processor.
2. Details of the processing
| Subject matter and purpose | Keeping your lesson schedule and fees, and sending lesson reminders, payment reminders, package notices and lesson notes to parents on your behalf |
|---|---|
| Duration | For as long as you have a TutorLedger account, plus up to 30 days for backups to be overwritten |
| Types of personal data | Student first name; parent or guardian email address, language, time zone and currency; lesson times; fees charged and paid; prepaid packages; lesson notes; email delivery records |
| Data subjects | Your students (who may be children) and their parents or guardians |
| Special category data | None. Please do not enter it, and do not enter sensitive information about a child. |
3. TutorLedger's commitments
- Instructions: we process the data only on your documented instructions, which are given by how you use the app, unless the law requires otherwise (in which case we will tell you, unless the law forbids it).
- Confidentiality: anyone authorised to process the data is bound by confidentiality.
- Security: we use appropriate technical and organisational measures, including encryption in transit (HTTPS), salted password hashing, separation of each tutor's data, access limited to what's needed, and log-in and sending limits.
- Sub-processors: you authorise the sub-processors listed below. We will give you at least 14 days' notice (by email or by updating this page) before adding or replacing one, so you can object. If you object on reasonable grounds and we can't resolve it, you may cancel your subscription. We impose data protection obligations on sub-processors that are at least as protective as this DPA.
- Help with requests: we will help you respond to requests from parents exercising their or their child's data rights, taking into account the nature of the processing.
- Breaches: we will notify you without undue delay, and where possible within 72 hours, after becoming aware of a personal data breach affecting your data, with the information you reasonably need.
- Assistance: we will reasonably help you with data protection impact assessments and consultations with authorities relating to TutorLedger.
- Deletion: when you delete a student permanently, or delete your account, we delete the related data from the live system immediately. Backups are overwritten within 30 days.
- Audits: we will make available the information reasonably necessary to show compliance with this DPA, usually through written answers to your questions. On-site audits require reasonable notice and are at your cost.
4. International transfers
Some sub-processors process data outside the EU/EEA and UK, including in the United States and India. Where required, transfers are protected by the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism.
5. Your commitments
You confirm that, before adding a student, you have the agreement of the student's parent or guardian to the processing described here, that you have given any notices required by law, and that your instructions to TutorLedger comply with data protection and child protection law.
6. Authorised sub-processors
| Provider | What they do for TutorLedger | Location |
|---|---|---|
| Cloudflare, Inc. | Hosts the app, stores its database, protects against attacks | United States and global network |
| Resend (Plus Five Five, Inc.) | Sends emails to parents and account emails | United States |
| Lemon Squeezy (a Stripe company) | Reseller and merchant of record: checkout, payments, invoices, sales tax and VAT | United States |
| Google LLC (Gmail) | Our support inbox | United States and global |
7. Order of precedence
If this DPA conflicts with the Terms on the processing of personal data, this DPA applies.