Parents see only their own children
A parent's sign-in shows their own children's timetables, attendance, shared notes and homework, messages and bills. Records of other families are not available to them.
Resources
Trust and data
Tuition centres hold details about children. This page describes how TutorHQ is set up today: who can see what, where records are kept, how they are backed up, and which outside services are involved, and when.
Who can see what
Access is decided by role, and the server enforces it, not only the screen.
Tutors see only their own groups
Tutors see the lessons, registers and students of the groups they teach. Students are shown by first name and last initial. Notes marked as issues or recommendations stay with the office and are not shown to parents.
Office staff get the permissions you give them
Permissions are set per person: viewing and running operations, editing people, viewing and editing accounts, message templates, analytics, imports, exports, and settings. Staff without accounts permission don't see money, including in exports and the Today screen.
The owner controls connections
Only the account owner can connect, change or disconnect outside services. Credentials entered in Settings are stored encrypted and are never shown again in full, only as a mask such as ••••1234.
Everything is logged
Every change is written to the activity log with who made it and when. Each person, group and lesson also shows its own history.
Sign-in
Passwords are stored as salted hashes, not as text. Repeated failed sign-ins are slowed down per account and per network. Office and parent sessions end after 12 hours. A tutor's private link can be replaced at any time, which stops the old one working at once.
Where data is held
Your centre's records are held in one database on a server that we manage. All traffic to it is encrypted over HTTPS, only the web and management ports are open, and security updates are installed automatically.
We will confirm the hosting provider and the server's location in writing before you sign. If you have a requirement about where your data must be held, tell us at the start.
Backups
Every night, on the server
A copy of the whole database is saved on the server every night, and the 14 most recent copies are kept.
Every night, off-site, when you connect storage
When the owner connects S3-compatible storage of their choice, a nightly copy is also encrypted with a passphrase the centre keeps and uploaded there. Without the passphrase, the file can't be read. If an off-site backup fails, your team is alerted.
Restoring has been tested
Restoring from a backup was last tested on 5 October 2026: the latest backup was unpacked and the system started with all its data. Our automated tests also check that backups are made.
Connection settings are kept apart
The saved credentials for outside services are encrypted with a key that is kept outside the database, so a database backup on its own doesn't contain usable credentials.
Archive and removal
Withdrawn students are archived
When a student leaves, they become inactive rather than being deleted. Their lessons, attendance, payments and messages stay on file, so balances and history still add up.
Removal on request
If a family asks for their data to be removed, they ask your office. Your centre decides what it must keep, for example for financial records, and we carry out the removal with you. This is handled by request rather than by a delete button in the app.
Getting your data out
Reports export to Excel or CSV or print as PDF, and staff with the export permission can download your records from Settings at any time.
Sample data stays separate
New centres start with fictional sample data to try things out. The owner removes it before go-live, and sample families are never emailed for real.
Outside services
Two services are always involved: our hosting provider, and Google Fonts, which supplies the typefaces. Every other service receives data only when your centre connects it. Each is connected by the owner in Settings, and can be disconnected there.
Our hosting provider
AlwaysRuns the server that holds the database and the on-server backups. We confirm the provider and location in writing before you sign.
Google Fonts
AlwaysThe website and the office, parent and tutor pages load their typefaces from Google Fonts, so Google receives each visitor's IP address and browser details. No records from TutorHQ are sent.
Stripe
Only if you take card paymentsWhen a parent pays by card, TutorHQ sends Stripe the amount, what the payment is for and the parent's email address. Card details are entered on Stripe's own payment page and are not stored by TutorHQ.
Slack
Only if you connect itPosts staff alerts and the morning summary to your Slack channel. If you choose, it also posts copies of messages, which can include parents' names and children's first names. You choose what each channel receives.
WhatsApp (Meta)
Only if you send WhatsApp messagesMessages to parents who agreed to WhatsApp. Once WhatsApp Business is connected, Meta receives the parent's WhatsApp number and the message; until then the office sends each one from its own WhatsApp by tapping Open in WhatsApp.
SendGrid (email)
Only if you connect itDelivers emails to parents and tutors. It receives the recipient's address and the message. Until one is connected, messages stay inside TutorHQ and on each parent's page.
Off-site backup storage
Only if you connect itStorage in your own account. Backups are encrypted with your passphrase before they leave the server.
An AI provider
OptionalGroq, Cerebras, OpenRouter or Google Gemini, only if you add a key for one of them. See below for what is sent.
The AI assistant
The help chat works without any AI provider, answering how-to questions from a built-in guide. Connecting an AI provider is optional.
What is sent
When a provider is connected, the question and the records the assistant looks up to answer it are sent to that provider. These can include children's names, lessons and bills.
It sees only what the person can see
The assistant looks things up as the person who is signed in, so a parent's assistant sees only that parent's children, and a tutor's only their groups.
Nothing changes without confirmation
If the assistant suggests an action, such as sending a message, it happens only after the person presses Confirm, and it goes through the usual checks and the activity log.
Free tiers that may train on prompts
Free tiers that may use prompts to train their models, which today means Gemini and OpenRouter's free models, are by default used only while the sample data is loaded, not with real families. Check your chosen provider's terms before using any provider with real families.
Questions about data
TutorHQ is built with UK GDPR and the ICO Children's Code in mind. This page describes how the software works; it is not a certification, and your centre remains responsible for its own policies. For questions about data, contact us.
See how access works in practice.
Switch between the office, tutor and parent views in the demo, or book a walkthrough and bring your questions about data.