Privacy Policy

Who we are

TutorMigo (tutormigo.ai) is an AI tutoring service for students, parents, teachers, tutors and schools. It is operated by CleverCreator AI. You sign in with a CleverCreator account, which handles sign-in, billing and plan usage. The CleverCreator privacy policy covers that account. This policy covers TutorMigo itself.

What we collect

• Account details from your CleverCreator account: name, email address, role (student, parent, teacher, tutor, school staff) and plan.
• Learning content you create: questions, chat and voice sessions, uploaded files and photos, quiz and assignment answers, notes and flashcards.
• Progress data: mastery, streaks, scores and the settings that tailor tutoring to you.
• Class and organisation data that teachers, tutors and schools add: classes, rosters, assignments, grades and bookings.
• Technical data: IP address, device and browser type, and logs needed to run, secure and fix the service.
• Google Classroom and Google Calendar data, only if a teacher or tutor connects them. See Google user data below.

How we use it

• To provide tutoring, practice, progress reports and the classroom and tutoring tools you use.
• To show parents, teachers and schools the progress and safety information they are entitled to see.
• To keep the service secure, prevent abuse and fix problems.
• To send service messages such as invitations, booking reminders and progress digests. You can turn off optional emails.

We do not sell personal information, and we do not use it for third-party advertising.

AI tutoring

To answer a question, we send the relevant part of your conversation and any file you attach to the AI model provider that produces the reply. Providers process it to return the answer under contracts that limit how they may use it. Student and class names imported from Google Classroom can be part of that context, only to tutor that class. Google Calendar data is never sent to AI providers. Google data is never used to train AI models. See Google user data.

Google user data

Teachers and tutors can choose to connect a Google account to TutorMigo. Google sign-in for your account itself is handled by your CleverCreator account and does not give TutorMigo access to any of the data below. We ask for Google Classroom and Google Calendar permissions separately, and only at the moment you turn on that feature. If you never connect them, we never receive this data.

TutorMigo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect it

• Access and refresh tokens are encrypted with AES-256-GCM before they are stored. The key is kept in a managed key vault, separate from the database.
• Tokens stay on our servers. They are never sent to your browser or included in a URL, and they are never written to logs.
• All traffic to and from Google uses TLS.
• Only the account that connected an integration can use it. School administrators see connection status, not tokens.

How we use it, and how we don't

• We use Google user data only to provide the features described above, which you can see and control in the app.
• We never sell Google user data, never use it for advertising, retargeting or interest-based ads, and never share it with ad networks or data brokers.
• We never use Google user data to develop, improve or train any artificial intelligence or machine learning model, whether general or personalised.
• Names that come from a Google Classroom roster (student names and class names) become part of the class in TutorMigo. Our AI service providers may process them solely to deliver tutoring to that class, for example so the tutor can address a student by name, Those providers are contractually prohibited from using it to train their models and may retain it only for the limited period their service terms allow (for example, abuse monitoring).
• Google Calendar data is never sent to AI providers. We only read busy and free time ranges and store the ID of each event we create.
• Beyond the service providers that run these features for you, we do not transfer Google user data to third parties, except where the Google API Services User Data Policy allows it: when you ask us to, to comply with the law, or as part of a merger or acquisition with your consent.
• We do not use Google user data to decide creditworthiness or for lending.
• Our staff do not read Google user data, except when you ask for help and agree to it, when it is needed for security (for example, investigating abuse), or when the law requires it.

Retention, deletion and revoking access

• Disconnect in the app.Use Disconnect on the Google Classroom page or on the Google Calendar card. We delete that integration's stored tokens straight away. We also revoke our access at Google. Google revokes all of an app's permissions at once, so if your other Google integration is still connected, we revoke when you disconnect that one too.
• Revoke in your Google Account. You can remove TutorMigo's access at any time at myaccount.google.com/permissions. The integration then stops working and asks you to reconnect.
• Tokens are kept only while the integration is connected. Busy times from Google Calendar are never stored.
• Classes, rosters and assignments you imported stay in your classes after you disconnect, so your teaching records don't vanish. You can delete them by deleting the class. A school can ask us to delete its data.
• When you delete your account, we delete your Google tokens together with the rest of your personal data, as described under Retention and deletion.

Students and children

TutorMigois built for K-12 learners. Accounts for children under 13 need consent from a parent, or authorisation from their school acting for the parent. Parents can review and manage their child's data from the parent area. When a school or teacher provides TutorMigo, we process student data on the school's instructions and only for the school's educational purposes.

Sharing

• With the people you are connected to in the product: a student's parents, teachers and school, within their role.
• With service providers who host, store, email and process data for us (for example cloud hosting and AI model providers), under contracts that limit their use.
• When the law requires it, or to protect the safety of users.

Retention and deletion

• We keep your data while your account is active.
• You can delete individual conversations at any time. You can export your data from Settings › Privacy.
• When you ask to delete your account, it is scheduled for deletion after 30 days so you can change your mind. We then erase your learning content, sessions and memory, Google tokens and preferences, and anonymise the remaining account record.
• Schools can ask us to delete the data of their organisation.

Security

Data is encrypted in transit with TLS. Secrets and encryption keys are kept in a managed key vault, and access to production systems is limited to staff who need it. No system is perfectly secure. If a breach affects your data we will tell you as the law requires.

Your choices and rights

Depending on where you live, you can ask to access, correct, export or delete your data, or object to some uses. Use Settings › Privacy in the app, or contact us. We answer within 30 days.

Changes and contact

We will update the date at the top of this page when this policy changes, and tell you in the app about significant changes. Questions or complaints: contact us. See also our Terms of Service.