TUTORERA Global Privacy Policy

The controller responsible for processing your personal data across the TUTORERA platform and mobile applications is MENTISERA (SMC-Private) Limited, a registered corporate entity in House 387, Street 11, Phase 5-b, Ghauri Town, Islamabad, Islamabad Capital Territory, Pakistan. For all data protection and privacy inquiries, contact our Privacy Team at hello@mentisera.pk.

We collect and process the following categories of personal data based on your platform role: • Account Data: Full name, email address, password hash, phone number, role (student/tutor), country code, city, and IANA timezone. • Student & Learner Data: Academic grade, curriculum, learning objectives, subjects needed, scheduling preferences, and proposed budget. • Parent / Guardian Data: Guardian name, contact details, relationship to student, and consent verification timestamps. • Tutor Professional Data: Bio, profile photograph, introductory video, subject proficiencies, education history, hourly rates, and availability slots. • Verification & Trust Data: Government ID documents (CNIC, Emirates ID, Passport, Driver's Licence), academic degrees, demo videos, and background character certificates. (Sensitive identification numbers and background records are stored in restricted access vaults and NEVER exposed publicly). • Transactional Data: Bids, agreed rates, currencies, invoice summaries, payment timestamps, and payout records. (Raw credit/debit card numbers are handled exclusively by PCI-DSS certified payment processors). • Communications & Support: Messages exchanged via the internal chat system, support tickets, dispute submissions, and notification logs. • Technical & Device Data: IP address, device model, operating system, browser type, app version, error logs, and cookie identifiers. • Geolocation Data: Country, city, and approximate district/area. Precise GPS location is requested only with explicit consent where necessary for home tuition proximity matching.

We process personal data only when an established lawful basis exists: • Performance of a Contract: To register your account, match requests with tutors, negotiate offers, lock final rates, process bookings, and facilitate payouts. • Legitimate Interests: To detect platform fraud, prevent off-platform fee circumvention, safeguard child welfare, optimize algorithmic matching (Match Score), and maintain security. • Legal Obligation: To comply with mandatory tax accounting, financial reporting, and lawful regulatory subpoenas. • Explicit Consent: For marketing newsletters, non-essential cookies, and specific parental authorization for minor accounts. You may withdraw consent at any time without penalty.

TUTORERA applies data minimization across all user journeys: • Student profiles are private by default and are not indexed by search engines. • Exact home addresses are shielded and revealed only to confirmed tutors following an agreed in-person booking. • Government identity documents submitted by tutors are restricted strictly to authorized compliance officers and are never viewable by students, other tutors, or public crawlers.

TUTORERA is dedicated to protecting child privacy under international frameworks (including COPPA in the United States, UK GDPR and the Age Appropriate Design Code in the UK, and UAE Federal Decree-Law No. 45): • Independent account creation is restricted to users aged 18 and older. • For learners aged 13 to 17, parental or legal guardian consent is verified prior to booking. • For children under 13, accounts must be created and operated entirely by a parent or legal guardian. • We do not profile children for behavioral advertising or sell minor personal data. Full details are available in our dedicated Child Safeguarding Policy.

Because TUTORERA operates a global marketplace, personal data may be stored or processed in cloud hosting facilities or by vendors located outside your country of residence (including Pakistan, the European Union, the United Kingdom, and the United States). Where data is transferred internationally, we implement recognized legal transfer mechanisms: • Standard Contractual Clauses (SCCs) approved by the European Commission. • The UK International Data Transfer Addendum (IDTA). • Contractual data processing agreements (DPAs) requiring equivalent technical encryption and security standards. We never claim that using the platform waives your international transfer statutory protections.

We share data with trusted third-party subprocessors strictly to deliver platform services: • Cloud Infrastructure & Hosting: MongoDB Atlas, Render, Cloudflare Workers, Cloudinary. • Authentication & Security: Google OAuth, JSON Web Token cryptography. • Payment Processing: Authorized PCI-DSS payment gateways and local banking partners. • Email & Transactional Notifications: SendGrid, Resend. View our complete, updated directory on our Subprocessors Page.

We do not retain personal information indefinitely: • Active Accounts: Retained for the duration of your active account existence. • Account Deletion Requests: Personal identifying information (name, email, phone, avatar) is purged or anonymized within 30 days. • Transaction & Tax Records: Invoices, fee snapshots, and payment records are retained for 7 years to comply with statutory accounting and tax regulations. • Safety & Dispute Records: Dispute and moderation logs are retained for 2 years post-resolution to protect against fraud, child safety threats, and repeat abuse.

Subject to your jurisdiction (including GDPR, UK GDPR, UAE PDPL, and applicable US state laws), you possess: • Right of Access & Portability: Download a machine-readable JSON export of your personal profile, requests, bids, and reviews via our Privacy Center. • Right to Rectification: Correct inaccurate contact or academic information in your settings. • Right to Erasure (Right to be Forgotten): Initiate self-serve account deletion via /account/delete. • Right to Object & Restrict: Opt out of marketing communications or algorithmic profiling. • Right to Withdraw Consent: Toggle cookie and marketing preferences at any time without affecting core service access. To exercise rights not available self-serve, contact hello@mentisera.pk.

We use cookies and local storage to keep you authenticated, remember your preferred currency/timezone, and analyze site traffic. Non-essential analytics and marketing cookies require prior consent in jurisdictions where legally mandated. We also participate in Google AdSense (publisher ID ca-pub-2559940686225219), which uses cookies such as __gads to serve relevant contextual and interest-based advertisements and to measure ad performance. These cookies are only set after you have given advertising consent through our Cookie Banner. We do NOT sell your personal data to advertisers and never share identifiable information with advertising partners beyond what is necessary for ad delivery. Learn more in our Cookie Policy.

Our Android and iOS mobile applications request only necessary permissions: • Camera / Photos: Uploading tutor profile avatars, introductory videos, and verification credentials. • Microphone / Audio: Delivering live online audio/video tutoring sessions. • Location: Determining approximate city/district for home tuition matching (never continuous tracking). • Push Notifications: Alerting you to new tutor offers, messages, and session reminders. Our Google Play Data Safety declarations accurately reflect these data collections.

We protect personal data with industry-standard safeguards: TLS 1.3 encryption in transit, bcrypt password hashing with salt factor 12, role-based access control, least-privilege infrastructure separation, and regular vulnerability audits. While we implement rigorous controls, no internet transmission is 100% immune from breach.

We may revise this Privacy Policy to reflect platform enhancements or statutory changes. When material modifications occur, we will notify you via dashboard alert or email at least 15 days before changes take effect. For questions or data requests: MENTISERA (SMC-Private) Limited Privacy Officer: hello@mentisera.pk Support: hello@mentisera.pk