Privacy Policy

Last updated: 10 September 2026

1. Introduction

in-Tune ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our software-as-a-service (SaaS) platform for tutoring and teaching management (the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Name, email address, phone number, postal address, and other contact details
  • Business Information: Business name, registration details, payment information, and billing address
  • Student Information: Student names, ages, contact details, lesson history, and progress records
  • Content: Messages, lesson notes, homework assignments, and other content you create or upload
  • Payment Information: Credit card details processed securely through our payment providers (we do not store full card details)

2.2 Automatically Collected Information

  • Usage Data: How you interact with our Service, features used, and time spent
  • Device Information: IP address, browser type, operating system, and device identifiers
  • Cookies and Tracking: We use cookies and similar technologies to enhance your experience

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our Service
  • Process payments and manage subscriptions
  • Send administrative information, updates, and support communications
  • Respond to your inquiries and provide customer support
  • Monitor and analyse usage patterns to improve functionality
  • Detect, prevent, and address technical issues and security threats
  • Identify inactive accounts and send service notices before automated closure
  • Comply with legal obligations and enforce our terms

4. Google account data

If you choose Continue with Google, in-Tune requests access to certain Google user data so you can sign in and, if you allow it, connect Google Calendar and Google Drive. Connecting Google is optional. We do not access your Google account unless you sign in with Google or connect these features.

4.1 Data we receive from Google

  • Sign-in (openid, email, profile): your Google account identifier, name, email address, and profile photo, used to create or sign in to your in-Tune account.
  • Google Calendar (https://www.googleapis.com/auth/calendar): calendar event titles, times, locations, descriptions, attendees, and related Meet links on calendars you can access. We use this to show your Google events inside the in-Tune calendar, to create, update, or delete Google Calendar events when you create, edit, reschedule, or delete an in-Tune appointment or lesson, and to attach a Google Meet link when you choose a video meeting.
  • Google Drive (https://www.googleapis.com/auth/drive.file): only files you explicitly pick in Google Picker (for example a teaching resource). We do not scan or access your full Drive.

4.2 How Google data is used, stored, and shared

  • Google sign-in details are stored on your in-Tune user record so you can log in again.
  • OAuth access and refresh tokens are stored securely so in-Tune can keep Calendar in sync until you disconnect Google or delete your account.
  • Google Calendar events shown in in-Tune are loaded for display in your calendar. Dual-written in-Tune appointments may store the related Google event identifier so updates and deletions stay in sync.
  • Drive files you pick may be attached to in-Tune resources you create. We do not use Google user data for advertising, and we do not sell it.
  • We do not share Google user data with other in-Tune users except where you have already added those people as attendees on an appointment, or where a file is part of a resource you chose to share.

4.3 Limited Use

in-Tune's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.4 Retention and revocation

We keep Google tokens and related identifiers while your Google connection is active. You can disconnect Google from in-Tune settings (or by revoking in-Tune in your Google Account permissions). We then stop calling Google APIs with your tokens and delete stored refresh tokens. Remaining in-Tune appointment records you created are kept according to Section 7 unless you also delete your in-Tune account.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

  • Service Providers: With trusted third-party providers who assist in operating our Service (e.g., payment processors, cloud hosting, email services)
  • Legal Requirements: When required by law, court order, or governmental authority
  • Business Transfers: In connection with a merger, acquisition, or sale of assets (with notice to users)
  • With Your Consent: When you explicitly authorise us to share information

6. Data Security

We implement industry-standard security measures to protect your information, including:

  • Encryption of data in transit and at rest
  • Secure authentication and access controls
  • Regular security assessments and updates
  • PCI DSS compliance for payment processing
  • SSL/TLS encryption for all communications

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as necessary to provide our Service and fulfil the purposes outlined in this policy, unless a longer retention period is required or permitted by law. When you request account deletion, we delete or anonymise data in line with the scope of your request, except where we must retain limited records for legal, tax, accounting, fraud prevention, or security purposes.

Deletion scope: standard user deletion removes or anonymises user-linked account data. If the requester is the sole owner of a business account, we process the request as full business closure, including business-wide data removal and subscription cancellation.

7.1 Inactive business accounts

For tutor business accounts, we use tutor sign-in activity across the business to identify accounts that are no longer in use. Our current practice is:

  • After 90 days without any tutor sign-in, we email business owners with an inactivity warning, including the date of last tutor activity and notice that the account may be closed if there is no further tutor sign-in.
  • After 120 days without any tutor sign-in, we automatically remove the business account and delete associated In-Tune data, and we cancel any active In-Tune subscriptions for that business.
  • Stripe Connect: If a connected Stripe account was used for payments, closure emails to owners may include a link to access Stripe and withdraw remaining balances. Funds held by Stripe are subject to Stripe's own retention and payout rules.

Inactive-account emails are sent to business owners only. Operational logs of these warnings and closures may be retained internally for audit and support purposes. See our Terms & Conditions for full details.

8. Your Rights

Under UK GDPR and data protection laws, you have the right to:

  • Access your personal data
  • Rectify inaccurate or incomplete data
  • Request deletion of your data (with scope based on account role and ownership, as described in Section 7)
  • Restrict processing of your data
  • Data portability (receive your data in a structured format)
  • Object to processing of your data
  • Withdraw consent where processing is based on consent

To exercise these rights, please contact us using the details provided in Section 10.

9. Children's Privacy

Our Service is designed for tutoring organisations and is not intended for direct use by children under 13. However, we may process information about students (including children) on behalf of our customers (tutoring organisations). In such cases, the tutoring organisation is responsible for obtaining necessary consents and ensuring compliance with applicable laws regarding children's data.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. You are advised to review this policy periodically for any changes.