Privacy Policy

1. Who we are

fair-do is a B2B SaaS studio portal for tutors. We provide software that an independent, UK-based tutor uses to run their own private studio — managing their own student list, scheduling and conducting video lessons, taking payments and keeping light notes. Our customer is the tutor.

The portal is operated by [PLACEHOLDER: registered entity](UK company registration pending). We are registered, or registering, with the Information Commissioner's Office (ICO).

Contact: privacy@fair-do.com

2. Our two data-protection roles

It matters which role applies to a given piece of data. fair-do holds two distinct roles under UK GDPR:

• fair-do as controller.For the tutor's own account, identity, billing, subscription, usage and support data — and for data about visitors to our website — fair-do is the controller. This policy applies to that data.
• fair-do as processor. For a tutor's students' data (including data about minors), fair-do is a processor, acting only on the tutor's documented instructions under a Data Processing Agreement (UK GDPR Article 28). The tutor is the controller of that student data.

fair-do does notown the teaching record and does not decide why or how a tutor's students' data is used. Tutors keep teaching documents in their own storage; the portal holds only links to those documents plus light notes.

If you are a student of a tutor who uses fair-do: this is not the right document for you. Please refer to your tutor's own privacy notice, and contact your tutor to exercise your rights. fair-do will assist your tutor as required under the DPA.

3. What we collect (as controller)

We collect the following categories of personal data about tutors and website visitors:

• Account & identity: name, email, phone, login credentials (passwords stored hashed via Clerk)
• Studio details: business name, qualification body, qualification reference and verification information
• Billing & subscription: plan, transaction history, and records of the card-payment commission
• Usage & analytics: features used, timestamps, IP address, device and log data
• Support & communications: messages you send us and our responses
• Marketing data: contact details and preferences, where you have opted in

Not covered here: a tutor's students' enrolment and lesson data. fair-do processes that only as a processor on the tutor's instructions under the DPA (see Section 2).

4. How we use your data (as controller)

• To create and manage the tutor's account and provide the portal (contract)
• To process the monthly subscription and the small card-payment commission (contract / legal obligation)
• To provide customer support and respond to enquiries
• To verify qualifications and eligibility to use the portal
• For security, fraud prevention and protecting the portal
• For product analytics and service improvement (aggregated where possible)

We rely on the lawful bases of contract, legitimate interests, legal obligation and (for some marketing) consent. As controller, fair-do does not rely on these bases to process students' data — that processing sits with the tutor as controller.

5. Sub-processors

We use the following providers under written Article 28 terms. They process fair-do's controller data, and (under the DPA) act as sub-processors for student data:

• Vercel — application hosting (US/EU edge, SCCs / IDTA in place)
• Neon — application database (UK/EU regions selected where available)
• Clerk — authentication / identity (US, SCCs / IDTA in place)
• Stripe — payment processing, subscription billing and payouts (US/EU, SCCs in place)
• Daily — video lesson delivery and transcription (US, SCCs / IDTA in place)
• Anthropic — AI lesson notes and support triage; may process lesson transcripts, including of minors (US, SCCs / IDTA in place). See Section 11.
• Cloudinary — image and document hosting, including uploaded student documents (US/EU, SCCs / IDTA in place)
• Resend — transactional and account email (US, SCCs / IDTA in place)
• Twilio — SMS lesson reminders (US, SCCs / IDTA in place)
• Onfido — tutor credential / DBS verification (UK/EU)
• Upstash — rate-limiting (transient IP / account identifiers)
• Sentry — error monitoring (US/EU; configured not to capture personal data by default)
• Support mailbox provider (IMAP) — inbound support email
• Plausible — cookieless, privacy-focused website analytics (EU)

We keep a current sub-processor list and update it before adding any new provider that processes personal data.

We do not sell your personal information.

6. International data transfers

Our preferred residency for personal data is UK or EU regions. Some sub-processors are US-based (notably Vercel, Clerk, Stripe, Daily, Anthropic, Cloudinary, Resend and Twilio). Where personal data is transferred outside the UK, we put in place an appropriate safeguard — typically the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCCs) with the UK Addendum — supported where required by a transfer risk assessment.

7. Retention

We keep controller personal data only for as long as necessary, and to meet legal, accounting and dispute-resolution requirements (billing records are typically kept for around 6 years for tax purposes). When controller data is no longer required, we securely delete or anonymise it.

Retention of a tutor's students' data is governed by the DPA and the tutor's own record-keeping obligations. fair-do returns or deletes that data on the tutor's instruction or on termination — fair-do does not set or hold the retention period.

8. Your rights

Where fair-do is the controller of your data, under UK GDPR you have the right to access, rectify, erase, restrict and port your data, and to object to processing or withdraw consent. Contact privacy@fair-do.com to exercise any right. You also have the right to lodge a complaint with the ICO at ico.org.uk.

If you are a student of a tutor, contact your tutor (the controller) to exercise rights over your data — not fair-do.

9. Cookies & analytics

We use strictly necessary session cookies only (e.g. authentication and security) — no advertising trackers. For website analytics we use Plausible, which is cookieless and does not collect personal data or track you across sites.

10. Children's data

fair-do is a tool for tutors, and tutors often teach children. fair-do does notoffer accounts to children and does not market to them. A tutor's students may be minors, but that student data is processed by fair-do only as a processoron the tutor's instructions (see Section 2) — the tutor is the controller and is responsible for the lawful basis (including any parental consent) for teaching and recording that child.

Consistent with the UK Age Appropriate Design Code (Children's Code), the portal is built to minimise data about minors: we collect only what a tutor enters, we do not profile children, do not use their data for advertising, and do not build behavioural profiles. Where a child's data is processed by AI features, see Section 11.

If you are a parent or guardian and want to exercise a child's data rights, contact the child's tutor (the controller). fair-do will support the tutor in responding.

11. AI features

fair-do offers optional AI features. Where a tutor enables lesson notes, a lesson transcript (which may include a minor's voice and words) is sent to our AI sub-processor, Anthropic, to generate a written summary for the tutor. We also use Anthropic to triage inbound support email. Where a tutor generates a practice quiz or end-of-term assessment, the tutor's approved lesson notes (and, for post-lesson quizzes, a short transcript excerpt) are sent to Anthropic on the same basis to draft questions for the tutor's review before anything is shown to a student.

• AI notes are generated on the tutor's instruction and are only visible to the tutor unless the tutor chooses to share them.
• Transcript and note content is not used to train third-party AI models; it is processed under Article 28 sub-processor terms.
• AI output is a draft aid for the tutor, not an automated decision about a student — there is no profiling and no automated decision-making with legal or similar effect.
• A tutor can operate fair-do without AI notes; the feature can be disabled.

Because this can involve minors' data, tutors are responsible for having the appropriate lawful basis and consent before enabling AI notes for a child.

12. Data breaches

We maintain security measures to protect personal data and have an incident-response process. Where fair-do is the controller and a personal data breach is likely to result in a risk to individuals, we will notify the ICO without undue delay and within 72 hours where required, and affected individuals where the risk is high.

Where fair-do is a processor(for a tutor's students' data), we will notify the affected tutor (the controller) without undue delay after becoming aware of a breach, so the tutor can meet their own notification duties.