Privacy policy

Who is responsible for Tutorish

Operators

Alikhan Tuganbayev and Alina Saadabaeva

Contact

tutorish4@gmail.com

Account and technical information

We process your display name, email, role, account identifiers and verification status to provide an account and protect access. Passwords are stored as salted hashes. Sessions and email verification or recovery codes use protected verification values. Service emails require your address and the message content. A contact phone number with a country code is required when registering as a student or tutor. It is stored separately from public profiles for lesson-related contact and support; it is not published or verified by SMS.

A session cookie keeps you signed in for up to seven days. A language cookie remembers your choice for up to a year and is removed when you select your device language. Browser language and timezone help display dates and notices. Request information, including an IP address from a trusted proxy, may be used to prevent abuse; rate limits use hashed keys. Hosting providers may keep technical logs. A theme cookie remembers your manually selected light or dark appearance for up to a year; until you choose, the site follows your device.

Profiles and tutor review

Tutor profiles contain a name, description, subjects, hourly rate in KZT, availability and an optional photo. A published, approved tutor profile and its photo are public. Photos become thumbnails with metadata removed. Other profile photos are available to their owner and authorized administrators or moderators.

Tutor review uses your experience statement, a saved profile version and any optional contact or HTTPS link to a transcript, certificate or portfolio. Evidence links and review contacts are private to the applicant and authorized administrators or moderators. Tutorish stores the link, not an uploaded document; you control access on the external service. Remove information unnecessary for review.

Lessons, messages and support

We keep participants, the subject or course request, time, duration, notes, status and messages to organize lessons and communication. Lesson conversations are available to their two participants through the app. Support conversations are available to their author, support staff and administrators. Staff permissions, review decisions and support status changes are recorded in an activity log. Manual payment review stores the lesson amount, uploaded receipt image, review status, feedback and a private discussion. In the app, receipts, feedback and this discussion are available only to the booking student and authorized payment reviewers or administrators. The lesson tutor can see the amount and review status, but cannot access these private materials, including through a staff role.

Do not send passwords, verification codes, payment card details or unrelated personal information. Technical database access is separate from staff roles in the app; conversations are not end-to-end encrypted.

Providers and processing locations

The main application records are stored in Yandex Cloud YDB in Kazakhstan. The application runs on Vercel outside Kazakhstan, where requests are processed and infrastructure logs may be kept. Processing is therefore not limited to Kazakhstan even though the main database is there.

Resend receives recipients’ email addresses and service email content and processes them outside Kazakhstan. The recipient’s email provider also processes delivered messages. Account emails and lesson confirmations therefore involve transfer of personal data outside Kazakhstan. With your device permission, browser push services (Apple, Google or Mozilla) process a device endpoint and encrypted notification payload, potentially outside Kazakhstan. We store the subscription keys, delivery status and inbox history in YDB. Notifications contain lesson/payment status and may be visible on the lock screen, but never include receipt images, card details or private payment messages. You can disable this device on the notifications page or in browser settings. We also store receipt image fingerprints to flag exact reuse; this does not prove payment or fraud.

If Upstash QStash is enabled for technical retries, it receives the protected endpoint URL and delivery status. Scheduled requests contain no participant email addresses or lesson content. This provider also processes technical information outside Kazakhstan.

Emails sent to the operators, including a representative’s consent request, are processed through Gmail outside Kazakhstan. They include the sender’s email address and the details you provide about the child and consent. Provide only information needed to arrange participation or resolve your request.

Google Calendar and Google Meet

When meetings are enabled, Tutorish sends Google both participants’ email addresses, the lesson time, duration and booking identifier to create a private Calendar event and Meet link. Tutorish stores the link and preparation status and shares the link with the booked participants on their lesson page and by email. The email also includes the subject, local time and the other participant’s name. Language and timezone preferences are saved for these notices.

The organizer authorizes Calendar access. Tutorish does not connect participants’ personal calendars or ask for Google passwords. Data obtained from Google is used to arrange and maintain meetings, not for advertising, sale or model training. Tutorish does not record lesson audio or video. Google processes activity inside Meet under its own privacy policy.

Google privacy policy

Storage and your requests

Contact the operators to ask what personal data is processed, request correction, withdraw consent or request deletion or restriction where the law provides for it. We may need information to verify that the request concerns your account. Send only what is needed. You may also approach the competent authority or use other remedies under Kazakhstan law.

Requests are handled manually. There is no self-service account deletion or complete data export yet. Storage depends on the record’s purpose and applicable obligations; automatic deletion is not generally implemented for profiles, messages, applications and meeting records. When considering a request, we will explain information that must be retained. Removing a photo does not delete the account or other records. Payment review records are also stored without automatic deletion.

Consent, changes and questions

This policy explains processing and does not replace consent where consent is required. New purposes or services must be explained before use and require appropriate consent where applicable. We update this page when processing changes. For data questions, contact the operators or open a support request while signed in. A representative should contact the operators by email before a minor’s booking to arrange any required consent; see the Terms of use.