how we handle your information.

tuon is operated by Valentin Cela, a sole proprietor based in Toronto, Ontario, Canada. you can reach us at valentcela@gmail.com.

this policy follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario provincial privacy law.

only what we need to match a student with a tutor and deliver a session:

• identity: first name, age range, grade, school, region.
• contact: phone, email. for under-18 students: parent phone and email.
• academic context: course code, current location in the syllabus, recent grades, blockers, deadlines, optional teacher name.
• behavioral signals: study hours, attendance, screen time, study mode, preferred time of day. used to match tutors and inform session 1.
• free-text answers: what's going on in your own words. these go directly to your assigned tutor and to Valentin.
• voice recordings (optional): if you choose voice input, we transcribe and store. you can opt out of keeping the recording. for parent flow with grade 1-8 children, voice is disabled by default.
• file uploads (optional): worksheets, report cards, or test photos you upload.
• address (in-home only): for in-home tutoring, your street address, city, and postal code, shared only with your assigned tutor.
• payment information: handled entirely by Stripe. we never see or store your card number. we keep a Stripe customer ID and payment method ID.

• match you with a tutor based on course, region, and availability
• generate a tutor brief that the assigned tutor reads before session 1
• schedule sessions and provision Daily.co rooms (online) or share addresses (in-home)
• send transactional emails: confirmation, session reminders, weekly progress digests, tax receipts
• charge you per session through Stripe
• improve tuon over time using anonymized, aggregate patterns (never individual data)

we do not sell your information. we do not show ads. we do not share your information with anyone outside the people directly involved in delivering your tutoring (you, your parent if applicable, your assigned tutor, Valentin).

for any student under 18, an adult parent or legal guardian must give explicit consent before any of the student's information is shared with an assigned tutor. this consent is captured at the contact step of intake.

parents have full visibility into the student's tutoring through the parent dashboard. parents can revoke consent and delete all data at any time by emailing valentcela@gmail.com or using the delete-my-data button on the parent dashboard.

for parent flow branches A and B (children in grades 1-8), voice recording is disabled by default given heightened privacy considerations for younger children's voice samples.

• your assigned tutor: full intake brief and session history
• Valentin: every intake brief, for matching
• your parent (under-18 students only): summary view via the parent dashboard
• service providers: Neon (database hosting · USA region us-east-1), Stripe (payments · global), Resend (email), Daily.co (video), Vercel (hosting). each is bound by their own privacy and security commitments.

that's it. nobody else.

our database is hosted by Neon in AWS us-east-1 (Virginia, USA). this means your information crosses the Canadian border. we made this choice for reliability and cost; you can request deletion at any time and we will permanently remove the data within 14 days.

• active customers: we keep all information while you have an active relationship with tuon
• after you cancel or pause: 12 months, then archived to anonymized form for tax and legal records
• voice recordings: 90 days after the session, then deleted automatically unless you opt to extend
• tax records: 7 years (Canada Revenue Agency requirement). anonymized after the periods above.

under PIPEDA you have the right to:

• access a copy of all personal information we hold about you
• correct any inaccurate information
• delete all personal information (except records we are legally required to keep, such as tax records)
• withdraw consent at any time
• complain to the Office of the Privacy Commissioner of Canada

to exercise any of these rights, email valentcela@gmail.com or use the delete-my-data button on your parent dashboard. we respond within 14 days.

• all data in transit is TLS-encrypted
• database access is restricted to Valentin and Vercel deployment infrastructure
• passwords (when introduced) will be bcrypt-hashed
• magic-link tokens expire after 90 days
• tutors see only the families assigned to them, never others
• no information is ever displayed publicly

we use Plausible Analytics, a privacy-first analytics tool that does not use cookies and does not collect personal information. we do not use Google Analytics, Facebook Pixel, or any third-party tracking script.

session cookies (if any in future) will be functional only.

if we change this policy, we'll email anyone with an active account at least 14 days before the change takes effect. previous versions are kept on request.

questions, concerns, complaints. Valentin reads every email personally:

valentcela@gmail.com

or by mail: tuon c/o Valentin Cela, Toronto, ON. (full address available on request.)