Privacy Policy

TutorCelle is a global tutoring marketplace and a product of ExcelUp Lab LLC ("ExcelUp Lab", "we", "our", or "us"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have based on where you live. Plain-language summaries are provided alongside the legal detail.

TutorCelle is operated by ExcelUp Lab LLC. Users may be presented with information about other products and services offered by ExcelUp Lab LLC.

To help tutors prepare for sessions involving children, Parent accounts and the requests they post are visibly labelled across the platform with a "Tutoring for a minor" indicator (for example on parent profile cards, on request posts, and inside conversations). This is a safety signal, not a disclosure of any child's personal data.

1. Data we collect

• Account data: name, email, password hash, role (student, parent, tutor), country, time zone, language.
• Profile data: photo, bio, subjects, grade level, credentials, rates.
• Verification data (tutors): government ID, teaching credentials, background-check status.
• Verification data (adult students): date of birth and a government-issued ID (passport, driver's license, or national ID) uploaded on first sign-in to confirm the account holder is 18 or older. These documents are reviewed privately by our team and are never shown to tutors.
• Parent consent records: when a parent or legal guardian creates a Parent account, we store an electronic consent record containing the parent's typed full legal name (digital signature), the date and time of consent, the IP address used, the consent version, and the associated account ID. This record evidences guardian status, consent to the child's use of TutorCelle, agreement to our Terms and Privacy Policy, acknowledgement that TutorCelle connects students with independent tutors, and agreement to be visible on camera with the child during virtual tutoring sessions.
• Verification data (parents): a government-issued ID whose name must match the parent's signed legal name on the consent record. These documents are reviewed privately by our team and are never shown to tutors.
• Verification data (minors): only the minimum information the parent provides about the child through the Parent account.
• Tutor child-safety acknowledgements: when a tutor accepts or is accepted for a session involving a minor, we store an electronic acknowledgement record containing the tutor's typed full legal name (digital signature), the date and time, the IP address used, the acknowledgement version, and the associated account ID. This record evidences that the tutor has reviewed and agreed to our child-safety requirements (including parent-on-camera, no off-platform private contact with minors, mandatory reporting of safety concerns, no recording without consent, and age-appropriate conduct).
• Booking and lesson data: session times, messages, reviews, dispute history.
• Third-party video conferencing: we do not host video. Live lessons happen on third-party tools (such as Zoom, Google Meet, or Microsoft Teams) using a meeting link the tutor provides. we store the meeting link the tutor submits so our team can review it before it is shared. Anything that happens inside the third-party call (audio, video, recordings, chat) is handled by that provider under its own privacy policy, not ours.
• Device and usage data: IP address, browser, OS, pages viewed, approximate location derived from IP.
• Cookies and similar tech: see Section 8.

2. Why we use your data (legal bases)

• To provide the Services — perform our contract with you.
• To verify tutors and protect minors — legal obligation and legitimate interest in safety.
• To prevent fraud and abuse — legitimate interest in keeping the platform safe.
• To send service messages (booking confirmations, parent notifications, security alerts) — contract performance.
• To send marketing — only with your consent; you can withdraw at any time.
• To improve and secure the platform — legitimate interests balanced against your rights.

Safety and transactional emails (parent notifications, booking confirmations, security alerts, account and policy notices) are part of the Service and cannot be turned off while your account is active. Only marketing emails are optional and can be unsubscribed from at any time.

3. Children's privacy

Minors cannot register on TutorCelle. Student accounts are reserved for adult learners aged 18 or older. A person under 18 may use TutorCelle only after a parent or legal guardian has registered a Parent account in their own name and added the minor to it. The parent or guardian is the account holder, gives consent, and is responsible for the minor's use of the platform. We collect the minimum necessary data about minors, never sell it, and never use it for advertising. For users under 13 in the US, we comply with COPPA: the parent creates the account, provides verifiable consent, and approves every tutor interaction. Parents can review or delete their child's data at any time by emailing privacy@exceluplab.com.

A parent or legal guardian must also be present and visible on camera with the minor for the entire duration of any video conference, virtual meeting, or live session with a tutor.

If an adult student's age-verification documents indicate the user is under 18, the Student account will be locked and the minor must instead be registered by a parent or legal guardian through a Parent account. Identity documents submitted by adult students are retained only as long as needed to maintain verified status and are then deleted.

4. Sharing

We share personal data only with:

• Tutors and students you choose to interact with (limited to what is needed for the booking).
• Service providers that host, secure, and operate our platform under written data-processing agreements (cloud hosting, email delivery, identity verification, analytics, customer support).
• Authorities where required by law, court order, or to protect safety.
• Acquirers in a merger or acquisition, with prior notice and continuing protection.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

4a. Administrator and Trust & Safety access

Authorised TutorCelle staff ("administrators") have limited access to the platform for moderation, compliance, and support. In plain language, this means:

• What administrators can see: public and account profile data, tutor applications and credentials, parent and student ID verification documents (only while a review is in progress or required for compliance), reports filed by users, evidence attached to reports, and account-action history.
• What administrators can do: approve or reject tutor and identity verifications, issue warnings, temporarily suspend or remove accounts that violate our Terms or Community Guidelines, freeze a conversation while a report is investigated, and refer serious cases to the appropriate authorities.
• What administrators cannot do: administrators cannot read your password (passwords are stored only as one-way hashes), cannot sign in as you, and do not have routine access to read private messages between other users. Messages are reviewed only in response to a report or a credible safety concern, and only to the extent necessary to act on it.
• Audit logging: every administrator action that affects an account (warning, suspension, removal, verification approval/rejection, conversation freeze, credential review, report decision) is recorded in a tamper-resistant internal audit log including who took the action, when, the affected account, and the reason. This log is used to investigate complaints, prevent abuse of administrator powers, and respond to lawful requests.
• Document retention: ID documents submitted for parent and adult-student verification are automatically purged from active storage 90 days after the review decision; the review record (status, reviewer, date) is preserved for compliance.

5. International data transfers

We operate globally and may transfer data to countries other than yours, including the United States. When data leaves the UK, EU/EEA, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another approved mechanism. For users in regions with strict data-protection laws (see Section 7), you may request that your data be processed primarily within your region where technically feasible, by emailing privacy@exceluplab.com.

6. Retention

• Account data: kept while your account is active and for up to 24 months after closure for fraud prevention and legal compliance, then deleted or anonymised.
• Booking and lesson records: kept while your account is active and for up to 24 months after closure for safety and dispute resolution, then deleted or anonymised.
• Verification documents: kept only as long as needed to maintain a tutor's verified status, then deleted.
• Parent consent records: retained for the life of the Parent account and for up to 24 months after closure as evidence of guardian consent, then deleted or anonymised.
• Tutor child-safety acknowledgement records: retained for the life of the tutor's account and for up to 24 months after closure as evidence of the tutor's commitment to child-safety requirements, then deleted or anonymised.
• Marketing preferences: kept until you withdraw consent.

You can delete your TutorCelle account at any time from the account menu. Deletion removes your profile, tutor listing (if any), role assignments, and sign-in credentials. Messages you sent may remain visible to the other participant in their copy of the conversation, and we may retain a minimal record where required by law or to handle ongoing Trust & Safety matters.

7. Your regional rights

You can exercise the rights below by emailing privacy@exceluplab.com. We respond within 30 days (45 days in California, where allowed). We will not discriminate against you for exercising any right.

United Kingdom & European Economic Area (UK GDPR / EU GDPR)

• Access, rectify, erase, restrict, or object to processing of your personal data.
• Data portability in a machine-readable format.
• Withdraw consent at any time without affecting prior processing.
• Lodge a complaint with your local supervisory authority — for the UK, the Information Commissioner's Office (ICO).
• EU/EEA representative and UK representative details available on request.

California, USA (CCPA/CPRA)

• Know what we collect, delete it, correct it, and limit use of sensitive information.
• Opt out of "sale" or "sharing" of personal information — we do neither, but you can confirm your status.
• Designate an authorised agent to act on your behalf.

Other US states (Virginia, Colorado, Connecticut, Utah, Texas, and similar)

Access, deletion, correction, portability, and opt-out of targeted advertising or profiling that produces legal effects.

Canada (PIPEDA)

Access, correction, and complaint rights to the Office of the Privacy Commissioner of Canada.

Brazil (LGPD)

Confirmation, access, correction, anonymisation, portability, deletion, and information about sharing — exercisable via our DPO.

Australia (Privacy Act)

Access, correction, and complaints to the Office of the Australian Information Commissioner (OAIC).

Other jurisdictions

If your country provides equivalent rights (e.g., Japan APPI, South Korea PIPA, Singapore PDPA, South Africa POPIA, India DPDP, Switzerland FADP, UAE PDPL, New Zealand Privacy Act), we honour them in good faith. Contact us to exercise any right available to you under local law.

8. Cookies and similar technologies

We use strictly necessary cookies for login and security, plus optional analytics and preference cookies. Users in regions that require prior consent (UK, EU/EEA, Brazil, and others) will see a consent banner the first time they visit. You can change preferences any time in your account settings.

9. Security

We use TLS in transit, encryption at rest, least-privilege access controls, background checks for staff with sensitive access, vulnerability scanning, and incident-response procedures. No system is perfectly secure; please choose a strong password and enable any available second-factor option.

10. Data breaches

If a personal-data breach is likely to affect you, we will notify you and the relevant supervisory authority within the timelines required by your local law (e.g., 72 hours under UK/EU GDPR).

11. Automated decisions

We do not make decisions producing legal or similarly significant effects on you based solely on automated processing. Trust & Safety actions are reviewed by a person before account suspension or removal.

In-app messages between users are stored so participants can read their conversation history. They are not proactively moderated. Our Trust & Safety team may review specific messages in response to a report or a safety concern.

12. Data Protection Officer & contact

Privacy questions, rights requests, and complaints: privacy@exceluplab.com. For UK/EU representative details, write to privacy@exceluplab.com.

13. Changes

We will post material changes here and notify you by email or in-app at least 14 days before they take effect.

See also our Terms of Service, Trust & Safety, and Community Guidelines.