Data Processing Agreement

Last updated: 15 November 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between TutorLedger and the tutor using TutorLedger ("you"). It applies when TutorLedger processes personal data about your students and their families on your behalf, including under the EU GDPR, the UK GDPR, India's DPDP Act 2023 and similar laws. It takes effect when you accept the Terms. If you need a signed copy, email our support email.

1. Roles

You are the controller (under the DPDP Act, the data fiduciary) of your students' and families' personal data. TutorLedger is your processor.

2. Details of the processing

Subject matter and purpose	Keeping your lesson schedule and fees, and sending lesson reminders, payment reminders, package notices and lesson notes to parents on your behalf
Duration	For as long as you have a TutorLedger account, plus up to 30 days for backups to be overwritten
Types of personal data	Student first name; parent or guardian email address, language, time zone and currency; lesson times; fees charged and paid; prepaid packages; lesson notes; email delivery records
Data subjects	Your students (who may be children) and their parents or guardians
Special category data	None. Please do not enter it, and do not enter sensitive information about a child.

3. TutorLedger's commitments

Instructions: we process the data only on your documented instructions, which are given by how you use the app, unless the law requires otherwise (in which case we will tell you, unless the law forbids it).
Confidentiality: anyone authorised to process the data is bound by confidentiality.
Security: we use appropriate technical and organisational measures, including encryption in transit (HTTPS), salted password hashing, separation of each tutor's data, access limited to what's needed, and log-in and sending limits.
Sub-processors: you authorise the sub-processors listed below. We will give you at least 14 days' notice (by email or by updating this page) before adding or replacing one, so you can object. If you object on reasonable grounds and we can't resolve it, you may cancel your subscription. We impose data protection obligations on sub-processors that are at least as protective as this DPA.
Help with requests: we will help you respond to requests from parents exercising their or their child's data rights, taking into account the nature of the processing.
Breaches: we will notify you without undue delay, and where possible within 72 hours, after becoming aware of a personal data breach affecting your data, with the information you reasonably need.
Assistance: we will reasonably help you with data protection impact assessments and consultations with authorities relating to TutorLedger.
Deletion: when you delete a student permanently, or delete your account, we delete the related data from the live system immediately. Backups are overwritten within 30 days.
Audits: we will make available the information reasonably necessary to show compliance with this DPA, usually through written answers to your questions. On-site audits require reasonable notice and are at your cost.

4. International transfers

Some sub-processors process data outside the EU/EEA and UK, including in the United States and India. Where required, transfers are protected by the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism.

5. Your commitments

You confirm that, before adding a student, you have the agreement of the student's parent or guardian to the processing described here, that you have given any notices required by law, and that your instructions to TutorLedger comply with data protection and child protection law.

6. Authorised sub-processors

Provider	What they do for TutorLedger	Location
Cloudflare, Inc.	Hosts the app, stores its database, protects against attacks	United States and global network
Resend (Plus Five Five, Inc.)	Sends emails to parents and account emails	United States
Lemon Squeezy (a Stripe company)	Reseller and merchant of record: checkout, payments, invoices, sales tax and VAT	United States
Google LLC (Gmail)	Our support inbox	United States and global

7. Order of precedence

If this DPA conflicts with the Terms on the processing of personal data, this DPA applies.

Back to TutorLedger