Last updated: 20 May 2026
1. Who we are
EZ Tutor is a UK-based private tutoring service operating at www.eztutor.co.uk. We are the data controller for any personal data you give us when using this website or our tutoring service.
For questions about your data, contact info@eztutor.co.uk.
2. What data we collect
We only collect the data we genuinely need to provide the service.
When you visit the site
- Standard server logs (IP address, browser type, pages viewed). Used to detect abuse and improve the site.
- Cookies — see section 7 below.
When you submit the contact form
- Parent name and email address (always required).
- Phone number, child's name, year group, subject, session type, preferred time (optional, only if you choose to share).
- The message you write to us.
When you create an EZ Tutor account
- Email address (used for sign-in via one-time code — no passwords stored).
- Optional profile fields: year group, difficulty preference.
- Practice and mock-paper attempt history (which questions you answered, your scores, time taken). Used to show you your progress and recommend weak areas.
When you buy a product
- On the website, Stripe handles all payment data — we never see your card details. Stripe shares back: the email used, the product purchased, the amount paid, and a session ID for our records.
- In our mobile apps, purchases are handled by the Apple App Store or Google Play. They confirm the product and that payment succeeded; we never see your card details.
- We store the plan/subscription tier and expiry (or renewal) date on your account.
When you subscribe to the newsletter
- Email address only. You can unsubscribe at any time via the link in any email.
3. Why we collect it
Each lawful basis under UK GDPR, mapped to what we collect:
- Contract — account email, subscription status, attempt history. Without these we cannot provide the service you paid for.
- Legitimate interest — server logs (security), contact-form data (responding to your enquiry).
- Consent — newsletter subscription, optional cookies. You can withdraw consent at any time.
- Legal obligation — tax/accounting records of purchases (kept for 7 years as required by HMRC).
4. Who we share it with
We share the minimum data necessary with a small number of trusted processors. Each is itself UK/EU GDPR-compliant.
- Supabase (EU region) — database and authentication.
- Stripe — payment processing only. Stripe sees the data needed to charge your card; we never see card numbers.
- Resend — sending transactional emails (sign-in codes, welcome emails, weekly progress reports).
- Netlify / Cloudflare — static site hosting and DNS.
We do not sell your data. We do not share it for advertising. We do not give it to third parties for their own marketing.
5. How long we keep it
- Server logs: 30 days.
- Contact-form enquiries: 12 months after last contact, then archived for a further 12 months.
- Account data + attempt history: while your account is active. Deleted within 30 days of you closing your account.
- Purchase records: 7 years (HMRC requirement).
- Newsletter list: until you unsubscribe.
6. Your rights
Under UK GDPR you have the right to:
- Access the data we hold about you.
- Correct it if it is wrong.
- Have it deleted ("right to erasure"), subject to legal obligations on us to keep some records.
- Object to processing based on legitimate interest.
- Receive your data in a portable format (export).
- Withdraw consent at any time for anything based on consent.
- Complain to the ICO (ico.org.uk) if you believe we have mishandled your data.
To exercise any of these rights, email info@eztutor.co.uk. We will respond within 30 days.
7. Cookies
We use a small number of essential cookies only:
sb-access-token and sb-refresh-token — Supabase authentication. Required to keep you signed in. Without these you cannot use signed-in features.ez_cookie_consent — remembers that you've seen the cookie notice so we don't show it again.
We do not use analytics cookies, advertising cookies, or any third-party tracking. Your browser is yours, not a billboard.
8. Children's data
Although our service is for 11 plus preparation, the customer relationship is with the parent or guardian. We do not knowingly create accounts for children under 13. The attempt history collected through use of the platform is associated with the parent's account, not directly with the child.
If you believe a child under 13 has created an account, please contact us at info@eztutor.co.uk and we will close it.
9. Changes to this policy
If we change this policy materially we will email registered users. Minor changes (typos, link updates) we make silently. The "Last updated" date at the top reflects the most recent change.
For any privacy question — including requests to access, correct, or delete your data — email info@eztutor.co.uk. We aim to respond within five working days and always within the 30-day GDPR window.