Privacy Policy

This Privacy Policy explains how Tutoring Portal (“we”, “us”), a private IB Biology tutoring service operated at biologyprepapp.com, collects, uses, and protects personal information belonging to students, parents/guardians, and other users of this website and application (the “Service”).

We are based in Japan and handle personal information in accordance with Japan’s Act on the Protection of Personal Information (APPI). If you are located outside Japan, please note that your information will be processed in Japan and, as described in Section 5, by service providers located in other countries.

Account information. Name, email address, and a securely hashed password for every account (Teacher, Payer/parent, and Student).

Student information. Grade level and IB subject level (SL/HL or non-IB), which class(es) a student is enrolled in, and which parent/guardian (Payer) account the student is linked to.

Academic data. Assignment and quiz responses, AI-generated and teacher-given marks and feedback, self-test and practice results, and virtual-lab investigation data submitted through the Service.

Payment information. Card payments are processed directly by Stripe — we never receive or store full card numbers. We do store the amount paid, hours purchased, payment date, and (for cash payments) a note entered by the tutor. See Section 5 for how Stripe handles card data.

Booking information. Lesson date/time, booking status, and the Google Meet link generated for a confirmed lesson.

Communications. Emails we send you (e.g. account access codes, payment confirmations, balance notices) through our email provider, Resend.

Technical data. Standard web server logs and session cookies used to keep you signed in, generated automatically by our hosting provider (Vercel) and authentication system.

We use personal information only to operate the Service you or your family have signed up for, specifically to:

• Create and manage accounts, class enrollment, and access to lesson materials
• Grade assignments — including, for Data-Based questions, using Anthropic’s Claude AI to assist with marking (see Section 4)
• Process hours top-ups and cash payments, and maintain an accurate hours balance
• Schedule lessons and generate Google Meet links via the tutor’s connected Google Calendar
• Send account, payment, and balance-related emails
• Track academic progress so the tutor and parent/guardian can review it
• Maintain a record of cash payments and comped bookings for accountability

We do not sell personal information, and we do not use it for advertising or share it with third parties for their own marketing purposes.

Data-Based and Structured written responses a student submits may be sent to Anthropic’s Claude API to help generate a suggested mark and feedback note. Where a question references a reference image or diagram, that image may also be sent along with the response. A teacher always reviews AI-suggested grading before it is released to a student. Anthropic processes this content to generate the response and, per Anthropic’s own policies, does not use API content to train its models by default.

We share the minimum personal information necessary with the following providers, solely to operate the Service on our behalf:

• Stripe (United States/Ireland) — card payment processing
• Google (global) — Calendar and Meet, used only via the tutor’s own connected account to create and manage lesson events
• Anthropic (United States) — AI-assisted grading of submitted answers, as described in Section 4
• Resend (United States) — delivery of account and payment-related emails
• Vercel (global) — website hosting
• Neon (United States) — database hosting

Because several of these providers operate outside Japan, using the Service involves your personal information being transferred to and processed in other countries. We only use providers who are contractually bound to protect this information and to use it solely to provide their service to us.

Many students using the Service are minors. A Student account can only be created by a parent or guardian (Payer account), who provides consent by registering the family’s billing account and then creating the student’s login. We do not knowingly allow a minor to create their own account independently. Parents/guardians can contact us at any time (see Section 9) to review, correct, or request deletion of their child’s information.

We retain account and academic records for as long as an account is active, and for a reasonable period afterward to meet accounting, dispute-resolution, and legal obligations (for example, payment and audit records). If you would like your data deleted sooner, contact us and we will do so except where we are required or permitted to keep it (such as financial records).

Under Japan’s APPI, and as a matter of policy for all users regardless of location, you may request to:

• Be told what personal information we hold about you or your child
• Correct inaccurate information
• Have your information deleted or its use suspended, subject to the retention exceptions above

To make a request, contact us using the details in Section 9. We will respond within a reasonable time and may need to verify your identity first.

Passwords are stored using industry-standard hashing, not in plain text. Payment card details never touch our servers — Stripe handles them directly. Access codes are stored hashed. We restrict access to personal information to what is needed to operate the Service. No online system can be guaranteed 100% secure, but we take reasonable technical and organizational measures to protect your information.

We may update this policy as the Service changes. We will update the “Last updated” date above when we do, and for material changes we will make reasonable efforts to notify active account holders by email.

For any question about this policy, or to make a data access, correction, or deletion request, contact: admin@biologyprepapp.com.