Privacy Policy

TuitionCRM is run by the TuitionCRM team in Singapore (“we”, “us”). This policy explains what personal data we collect when you use TuitionCRM and our website, why, and how we protect it.

Our Data Protection Officer can be reached at our contact form. Questions, requests and complaints about personal data go there.

Your account data — your name, business name, email and password. For this data, we are the organisation responsible under the PDPA.

Data you enter about your students and their parents — for example names, phone numbers, emails, school and level, lesson times, attendance, notes and invoices. You decide what to enter and what it is used for, so you are the organisation responsible for it. We act as your data intermediary: we store and process it only to provide TuitionCRM to you, and never for our own purposes.

• Account details: your name, tuition business name and email. Your password is stored only as a secure one-way hash — we cannot see it.
• What you enter in the app: students, parent contacts, groups, lessons, attendance and notes, invoices, your PayNow details (mobile number or UEN), your centre address and meeting links, email templates, and any calendar link you connect.
• Email records: when the app sends an email for you, we keep a short record (who it went to, which type, and when) so the same email isn't sent twice and you can see what was sent.
• Technical data: your IP address and basic request information, which our hosting provider processes to deliver the site, block abuse and limit repeated sign-in attempts.
• Payment details (paid plans): handled by our payment provider. We never see or store your full card number.

We do not use analytics tools, advertising trackers or social media pixels.

• To create and secure your account and keep you signed in.
• To run the features you use — your schedule, invoices, PayNow QR codes, and the reminder and welcome emails you switch on.
• To send you service emails, such as password reset links.
• To bill paid plans and handle refunds.
• To answer your questions and fix problems you report.
• To meet legal obligations.

We will only send you marketing emails if you agree to them, and you can unsubscribe at any time. We never send marketing to your students or their parents.

By creating an account you consent to us collecting and using your account data as described here. You can withdraw consent by contacting us at our contact form. Because we need this data to run your account, withdrawing consent means we will close your account.

We never sell or rent personal data. We share it only with the service providers we need to run TuitionCRM, who may only use it to provide their service to us:

• Cloudflare — hosts the website and app, and stores your data in its database.
• Resend — delivers the emails the app sends for you (for example lesson reminders to parents).
• Fontshare — serves the website's font, so it sees your IP address when a page loads.
• Our payment provider — processes payments for paid plans.

Parent pages. If you create a parent page for a family, anyone with that private link can see that family's lessons, invoices and payment details (never other students). Links are long and random, are hidden from search engines, and you can replace or turn off a link at any time. If a parent taps “I've paid”, we record the time and show it to you.

If you connect a Google, Apple or other calendar link, we fetch that calendar to show your busy times. We only read it and never change it.

We may also disclose data if Singapore law requires it, or to protect the rights and safety of our users or the public.

Some of our providers store or process data outside Singapore, for example in the United States. When this happens, we take appropriate steps, such as contractual safeguards, so that your data receives protection comparable to the PDPA.

• All connections are encrypted (HTTPS).
• Passwords are stored as one-way hashes. Sign-in uses a secure cookie that page scripts cannot read.
• Each account can only reach its own data. Repeated sign-in attempts are limited.
• Only the people who run TuitionCRM can access the systems, and only when needed to support you.

No system is perfectly secure. If a data breach is likely to cause significant harm, or affects a large number of people, we will notify the Personal Data Protection Commission (PDPC) and the people affected as the PDPA requires — and we will tell you promptly if it involves data you entered about your students.

We keep your data for as long as your account is open. If you ask us to delete your account, we delete your data within 30 days. Copies in our backups are removed automatically within a further 30 days. We may keep billing records for as long as tax law requires.

The app also keeps a copy of your data in your browser so it works quickly and offline. Signing out on a device clears it there.

We use one essential cookie, tos_session, to keep you signed in. It lasts up to 30 days or until you sign out. We do not use advertising or analytics cookies. The demo account is kept only in your browser's storage and never sent to us.

Under the PDPA you can ask us to:

• tell you what personal data we hold about you and how it has been used or shared in the past year;
• correct data that is wrong or incomplete;
• delete your account and data;
• stop using your data (withdraw consent).

Contact us at our contact form using your account email address. We will reply within 30 days. You can change most details yourself in the app under Account settings.

If a parent or student asks about data you entered about them, please handle it with them directly — you can edit or delete any student in the app. If they contact us, we will pass the request on to you.

If you are not satisfied with our response, you may contact the PDPC.

As a tutor or centre, you are responsible under the PDPA for the student and parent data you enter. In practice this means:

• Let parents know you keep their and their child's details to arrange lessons, send invoices and send reminders, and get their agreement. Parents give consent on behalf of young children.
• Only enter what you need, and keep it accurate.
• Remove students' details when you no longer need them.
• Keep your password private and sign out on shared devices.

Example wording you can send parents, for example on WhatsApp when a student joins:

“To arrange lessons, I keep your and your child's name, contact details, school and level, lesson records and invoices in TuitionCRM, a secure scheduling app. I use them only for tuition — scheduling, invoices and reminders — and never share them for marketing. Let me know any time if you'd like to see, change or remove your details.”

TuitionCRM accounts are for tutors and tuition centres, who must be 18 or older. Students do not use the app. Children's details are entered by their tutor, with their parent's consent.

We may update this policy as TuitionCRM changes. We will change the “Last updated” date above and, for important changes, email you before they take effect.

See also our Terms of Service.