What is collected
When you message on WhatsApp: your number and what you write. Those messages stay in WhatsApp, under its own privacy policy.
When your child registers for the study portal with a Google account: their name, the email address of that account, their IB Maths course and year, their school, their time zone and their WhatsApp number, plus your email address as the parent. Your name and WhatsApp number come from your enquiry and are added to the record by Tomás.
During lessons: with written consent, lessons on Google Meet are transcribed as text. Transcripts and the progress records derived from them (topics covered, understanding marked green, amber or red, mistakes made during lessons, and the monthly reports) are stored in private systems. Who can see them is set out below.
In the study portal: the homework files your child uploads, the topics they choose before each lesson, and any lesson change requests they send.
On this website: a Google Ads tag measures whether a visit that came from a Google ad leads to a WhatsApp click. There is no analytics product and no cookie banner. Visitors in the European Economic Area, the United Kingdom and Switzerland are set to the denied state of Google Consent Mode, so the tag stores no advertising cookie for them. Everywhere else, including Hong Kong, the tag runs normally and may set Google cookies. The hosting provider keeps standard server logs, which include the visitor IP address.
How it is used
To run lessons, keep your child's progress record, prepare your monthly report, remind your child about upcoming lessons, and invoice you. Nothing is sold, and nothing is used for advertising beyond the Google Ads measurement above.
Each lesson transcript is turned into topic tags and mistake summaries that feed the study portal, and the approved lesson record is used to draft your monthly report and Tomás's own planning notes. Tomás reviews every lesson record before it reaches your child, reads every report before it reaches you, and no part of your child's work is written for them.
Who can see it
Your child sees their own progress record in the study portal. Your child's tutor (currently only Tomás) sees the full record. Parents receive the monthly report by email and have no login. No one else has access.
Services that process it
Google Workspace (Google Meet for lessons and its transcription), Supabase (database, Google sign-in and file storage), OpenAI (three things are sent to its API: each transcript, to produce the topic tags and mistake summaries; the approved lesson record, to draft your monthly report; and the record of recent lessons, to draft the notes Tomás uses to plan the next lesson. Each request carries a setting that asks OpenAI not to store it), Resend (the account approval email, lesson reminders, monthly reports, and the alert the tutor receives when your child asks to cancel or move a lesson), Vercel (hosting), Google Ads (the measurement tag), Wise (invoices) and WhatsApp (messages). Each processes the data on Tomás’s instructions and under its own security terms.
How long it is kept
All transcripts and derived records are deleted at the end of the tutoring relationship, together with the portal account and homework files. Invoicing records that contain no names or lesson content are kept for accounting.
Your choices
You can ask for a copy of the information held about you or your child, ask for a correction, or ask for deletion at any time by emailing tomas@tutoringbytomas.com or messaging on WhatsApp. Transcription only happens with your written consent, and you can withdraw it for future lessons.
Students are usually under 18, so a parent or guardian provides the consent and can exercise these choices on the student's behalf.
Changes
This policy is dated 22 September 2026. If the way information is handled changes, the date and the text here change with it.
See also the terms of service.