How we use your information.How we use your information.

Tipu is run by Tipu Ltd. We decide how your information is used, which makes us its “controller”. We don’t have a data protection officer. For anything on this page, email contact@tipu-learn.com.

Tipu Ltd · Registered in England and Wales · Company No. 15042342 · Registered office: 86 Stansted Road, Bishop's Stortford, England, CM23 2DZ · Data protection registration ZC181963.

This notice is for parents, guardians and adult learners. Last updated 30 September 2026.

From you. Your name, email address and, if you give it, your phone number. Your child’s name, year group and subjects, and the email address they sign in with. If you are an adult learner, your date of birth. Anything you upload, such as a school report or a mock paper, and anything you write to us.

From the enquiry form. What you type is emailed to our office. It is not saved in our database.

From your child. When your child signs in, they can log study time and how confident they feel, plan their revision (including when they are free), add exam dates and hand in homework.

From your child’s tutor. Lesson reports, homework feedback and marks, notes on how your child learns best, their current and target grades, and the plan you have agreed with us. A tutor may also note any learning needs or exam access arrangements, such as extra time, but only with your permission (see below). Tutors also keep working notes for themselves and the office, which you can ask to see.

From our office. Your quotes, invoices, lesson hours and the lesson timetable.

From your device. When you sign in or use the site, our providers record your IP address, browser and the pages you ask for, to keep accounts secure and the site working. If a page breaks, we get an error report. Analytics runs only if you say yes (see cookies).

We need your details and your child’s to arrange and teach lessons, and to bill you. Without them we can’t provide the service. Everything else is up to you.

To run your account, teach, report and bill you. This is our contract with you, the parent or adult learner who asked us for tuition. It also covers answering your enquiry before you sign up.

To teach your child. Your child isn’t a party to the contract, so we rely on legitimate interests: yours and ours in delivering the tuition you asked for. We have weighed that against your child’s interests, and we collect only what a tutor needs.

Learning needs. Notes about how your child processes information, what to avoid and any exam access arrangements can reveal health information, which the law treats as special. We record them only with your explicit consent, which you give, or withdraw, on your account page. If you withdraw it, we delete those notes.

To keep children safe. If we are worried about a child’s safety, we may share information with children’s services, the police or another proper authority. The law recognises safeguarding as a legitimate interest in its own right.

To keep the service secure and working. Sign-in records, bot checks and error reports rely on legitimate interests: ours and yours in a site that is safe and doesn’t break.

To keep our accounts. Tax law requires us to keep invoices and payment records.

Analytics runs only with your consent, which you can change on the cookies page. We don’t send marketing emails.

People. Your child’s tutor sees your child’s record while they teach them. Afterwards, they can still read only the reports and notes they wrote themselves, and the details of the lessons they gave. Our office sees your family’s record, to run the service. Adults on your family account see what their part allows, and lesson reports are emailed to them and to your child. We require our tutors to keep what they see confidential.

Providers who run parts of the service for us. They may use your information only to do that job for us.

• Supabase (servers in Ireland) holds our database, sign-ins and uploaded files: your account, your child’s record and our billing.
• Vercel hosts the website, from Dublin. It keeps short-lived request logs, including IP addresses.
• Stripe takes payments. It gets the payer’s name, email address and the invoice. Your card or bank details go straight to Stripe, never to us. Stripe gets nothing about your child.
• Resend sends our emails: lesson reports about your child, invoices and reminders, sign-in and security emails, and the enquiry and complaint forms.
• PostHog (EU) receives error reports, which never include your name or email (if you have said yes to analytics, they are linked to your account ID), and, only if you agree, analytics linked to your account ID and role. Analytics never runs on students’ pages.
• Cloudflare Turnstile checks that a person, not a bot, is filling in our sign-in, sign-up, enquiry and complaint forms. It sees your IP address and details of your device.
• Calendly runs the introductory-call calendar. It gets your name and email address, and whatever you tell it when you book.
• Microsoft Teams carries the lessons. It gets your child’s first name, in the meeting title, and their voice and video during the lesson. We don’t record lessons.
• WhatsApp (run by Meta) carries your family’s group chat with us. We use it for day-to-day messages, homework your child sends as a photo, and, if you pay by standing order, our bank details. WhatsApp handles those messages, and they may be handled outside the UK.

We never sell your information, and we share it with no one else unless the law requires it.

Supabase and PostHog keep our data in the EU, which UK law treats as giving the same protection as the UK. Both are American companies, though, and their staff or the companies they use may reach it from outside the UK, under the same safeguards as the companies below. Vercel, Stripe, Resend, Cloudflare, Calendly, Microsoft and Meta (WhatsApp) are American companies, so your information may be handled in the United States. Where the company has signed up to the UK–US data bridge, we rely on that. Otherwise, our contract with it includes the UK’s standard transfer terms (the International Data Transfer Agreement, or the UK Addendum to the EU’s standard clauses). Email us for a copy.

Invoices, payments and lesson hours: six years after the end of the financial year they belong to, because tax law says so. They include the reference each payment came in under, which can include your surname. Online payments stay in our Stripe account for the same time, with the payer’s email address and any name given when paying.

Your child’s record (reports, homework, notes and uploads): while your child has lessons with us, and for 12 months after their last lesson. Then we ask you, and close your account unless you tell us you’d like to keep it. You can also ask us to close it at any time. When we close an account, we erase the record and your account details, and keep only the money records above.

If another parent or guardian, or someone else who pays, is still on your child’s account, your child’s record stays with them. We remove only you.

The log of sign-ins and sign-in emails: 90 days.

Learning needs notes: until you withdraw consent or close your account, whichever comes first.

Complaints: six years after we close them, in case of a legal claim, then deleted.

Your family’s WhatsApp group: we clear the chat and leave the group within three months of your last lesson.

Accounts that never start lessons, and enquiries: we review them after 12 months without activity, and delete them unless you tell us you’d like to stay.

When your child reaches 18, their information becomes theirs to manage. We ask them whether you should keep seeing their account.

You can ask us to:

• give you a copy of what we hold about you or your child
• correct anything that is wrong
• delete it, apart from what the law makes us keep
• stop using it for a while, for example while we check that it is right
• send what you gave us to you, or to another provider, in a common format
• stop using it where we rely on legitimate interests, unless we have a strong reason
• withdraw a consent you have given, at any time

Email contact@tipu-learn.com. It’s free, and we answer within a month. We may ask you to confirm who you are first. Your child has these rights too, and can ask us directly.

Please tell us first, through our complaints page. We acknowledge a complaint about your information within 30 days, and answer it as quickly as we can.

If you are still unhappy, you can complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk.

What we store in your browser, and your choice about analytics, are on the cookies page.

Your child has their own version of this notice, written for them: your privacy, for young people.

We don’t make decisions about you or your child by computer alone. People at Tipu decide matching, lessons and money. Payment reminders are sent automatically, but a person decides anything that changes your lessons.