Buzzlessons1. Who we are
Buzzlessons ("we", "us") operates an online tutoring service connecting students with teachers for live sessions. We act as the data controller for account and platform data, and as a data processor on behalf of parents for the learning records of their children. For any privacy question or request, contact privacy@buzzlessons.com.
2. The data we collect
Parents (account owners)
- Name and email address, used to create and secure the account.
- Authentication data (a hashed password, or a Google sign-in identifier).
- Verifiable parental-consent records (see the Child Safety & Consent policy).
- Billing records when a subscription or credit purchase is made.
Children (profiles under a parent)
- A nickname or first name and a chosen avatar — not a full legal name.
- A date of birth, used only to determine that a profile is a minor and apply protections.
- A private login username and a passcode (stored only as a cryptographic hash).
- Learning records: lessons booked, attendance, homework, notes, and progress.
Teachers
- Name, email, profile and qualifications, availability, and payout details.
Collected automatically
- Essential session cookies to keep you signed in. We do not use advertising or cross-site tracking cookies.
- Basic security and rate-limiting signals (such as a coarse indication of request origin) to protect accounts from abuse.
3. How we use data
- To provide the service: scheduling, running, and recording the outcome of lessons.
- To keep accounts secure and prevent abuse (for example, rate-limiting sign-in attempts).
- To process payments and allocate lesson credits.
- To send transactional messages a parent has asked for (consent confirmations, booking notices).
We do not sell personal data, we do not show advertising, and we do not profile children for marketing.
4. Children first: how minors are protected
A child cannot create an account on their own. A parent creates the account, verifies they are a parent, and only then adds child profiles. Technically, each child profile is kept separate from any real login identity, and access to a child's records is restricted at the database level to that child's parent. Children never see pricing or payment information. See our Child Safety & Consent policy for the full detail.
5. Who we share data with (subprocessors)
We use a small set of vetted infrastructure providers, and we route any transfer of a child's personal data through a single controlled point so it is only shared where a parent has consented:
- Supabase — database, authentication, and storage (data encrypted at rest).
- Cloudflare R2 — storage for lesson media, encrypted at rest.
- Resend — delivery of transactional email.
- Upstash — abuse-prevention and rate-limiting signals.
- Stripe — payment processing (activated when billing is enabled); card details are handled by Stripe, never stored by us.
These providers act on our instructions and are not permitted to use the data for their own purposes.
6. Data retention and erasure
We keep personal data only for as long as an account is active or as needed to meet legal and financial obligations. When a parent deletes their account, we run a cascading erasure that removes the parent's and their children's personal data and anonymises the associated financial ledger entries that we are required to retain.
7. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you or your child.
- Correct inaccurate data.
- Delete your account and its data (right to erasure).
- Object to or restrict certain processing.
- Receive a copy of your data in a portable format.
To exercise any of these, email privacy@buzzlessons.com. A parent may exercise these rights on behalf of their child.
8. Security
- All traffic is encrypted in transit (HTTPS); stored data is encrypted at rest.
- Access to each account's data is enforced at the database layer with row-level security.
- Passcodes and passwords are stored only as salted cryptographic hashes.
9. International transfers
Our providers may process data in regions outside your own. Where they do, we rely on the safeguards those providers offer for lawful cross-border transfer.
10. Changes to this policy
We will update this page when our practices change and revise the "last updated" date above. Material changes affecting children will be notified to parents.
11. Contact
Privacy questions and requests: privacy@buzzlessons.com.