Privacy Policy

Tutor Island is a UK-based online marketplace that connects students and parents with background-checked private tutors. In this policy, “we”, “us”, and “Tutor Island” refer to the operator of the Tutor Island platform, Sarah Sattar, a sole trader based in the United Kingdom. For the purposes of UK data protection law, including the UK GDPR and the Data Protection Act 2018, we are the data controller for the personal data described below.

If you have any questions about this policy or how we handle your data, contact us at support@tutorisland.co.uk.

Depending on how you use Tutor Island, we may collect:

• Account details. Your name, email address, role (tutor, student, or parent), and password (stored securely by our authentication provider).
• Tutor profile data. Subjects, levels, pricing, biography, a profile photo, and a copy of your background check. For tutors in the United Kingdom that is an Enhanced DBS certificate, a confirmation of Protecting Vulnerable Groups scheme membership, or an AccessNI Enhanced Disclosure Certificate. For tutors outside the United Kingdom it is the criminal record certificate issued by your own country, and we also collect a copy of your photo identification, such as a passport or national identity card, together with the name of the country that issued the certificate. We use the identification solely to confirm that the certificate belongs to you, because we cannot verify a foreign certificate with the authority that issued it. We review these documents to verify your eligibility to tutor and retain them for audit and safeguarding purposes. They are stored privately and are never shown to students, parents, or other tutors, and they are not included in a data export.
• Student and parent data. The subjects and levels you are interested in, and, where a parent manages a request for a child, the child’s first name and school year only.
• Messages. The content of messages you exchange with other users through the platform.
• Payment data. Records of the one-off connection fee. Card details are handled entirely by our payment processor and are never stored on our systems.
• Review data.If you review a tutor you have connected with, we collect your rating and the text of your review. Approved reviews are shown publicly on the tutor’s profile with your first name and last initial.
• Recommendation data. If you submit a recommendation for a tutor through an invite link, we collect your first name, how you found the tutor, the subject, roughly how long you were tutored, your rating, and your testimonial, even if you do not hold a Tutor Island account. This is reviewed by our team and, if approved, displayed publicly on the tutor’s profile. To have a recommendation corrected or removed, email us.
• Technical data. Basic log and device information needed to operate and secure the service.

Safeguarding is the top design priority of Tutor Island. Children under 16 never hold accounts. Where a parent uses the platform on behalf of a child, we collect only the child’s first name and school year, and a tutor sees these details only within an active conversation the parent has chosen to start.

Students aged 16 and 17 who hold accounts do so with a parent or guardian informed at key steps. Every message sent through the platform is automatically screened for harmful content before it is delivered, and contact details stay hidden until a connection is paid for and confirmed.

We use your personal data to:

• create and manage your account and profile,
• match students and parents with suitable tutors,
• enable and moderate messaging, including screening for harmful content,
• process the one-off connection payment,
• send service and safeguarding-related emails,
• verify tutor eligibility through background checks, and
• keep the platform safe, secure, and working as intended.

We rely on the following legal bases under the UK GDPR: performance of a contract with you, our legitimate interests in operating a safe marketplace, and compliance with legal and safeguarding obligations. We do not currently rely on your consent for any processing; if we ever introduce a feature that requires it, we will ask you first, and you will be able to withdraw that consent at any time.

We do not sell your personal data. We share it only with the service providers who help us run the platform, under contracts that require them to protect it. These include our hosting and database provider (data hosted in Ireland, within the European Union), our payment processor, our email delivery provider, and an automated content-moderation provider used to screen messages. Some of these providers may process data outside the UK; where they do, the transfer is protected by safeguards recognised under UK data protection law, such as adequacy arrangements (which cover the European Union) or standard contractual clauses. We may also disclose data where required by law or to protect the safety of a user, particularly a child.

We keep personal data for as long as your account is active and for a reasonable period afterwards to meet legal, safeguarding, accounting, and dispute-resolution obligations. Records relating to safeguarding may be retained longer where we are required or advised to do so.

Subject to UK data protection law, you have the right to access, correct, delete, or restrict the use of your personal data, to object to certain processing, and to data portability. To exercise any of these rights, email support@tutorisland.co.uk. You can also download a copy of your own account data at any time from your dashboard, covering your profile, your conversations, and your connection records. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

We may update this policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you directly.