Privacy policy

Effective date: 7 October 2026

Who is responsible for your information?

Katherine Downes, trading as The Business Tutor, is responsible for the personal information described in this notice.

This notice covers our website, course enquiries, free resource requests, tutoring administration and use of advertising tools. It applies to students, parents or carers and teachers contacting us, including families outside the UK.

Information we collect

When you enquire, we collect the information you provide: your name, email address, telephone or WhatsApp number, whether you are a student or parent, the student’s name where a parent enquires, school, qualification, course interest and any questions or learning needs you choose to describe. We also keep relevant correspondence and, when you book, booking and payment records. Teaching may involve the work you send for feedback.

If a parent provides a student’s details, we receive that information from the parent. Please share this notice with the student. Avoid sending medical information or other sensitive personal details through the general enquiry form; contact Katherine first if you need to discuss additional support.

When you request a free resource, we collect your first name, email address, whether you are a student, parent or carer, or teacher, and the qualification you are studying or supporting. We record the resource request, its reference and receipt time, and your choice about occasional marketing emails, including the wording/version of that choice. The checkbox is optional and does not affect delivery of the resource. We do not need a telephone number, school or grades for this request.

For resource accounts and purchases, we also keep your verified email, saved profile (including an optional school or college), free-resource claims, order items, amounts and payment status, download-access records and email choices. We use Supabase to store these records and verify sign-in codes. Earlier guest requests made with the same email are linked only after you verify that email. Card details are entered directly at Stripe; the store retains payment references rather than full card details.

Website services may receive your IP address, browser and device information, pages visited, referrer, timestamps and interaction events. If you allow advertising measurement, campaign details in links help us understand which advertising led to an enquiry. Payment details entered at Stripe checkout are handled by Stripe; we do not receive your full card number through our enquiry form.

Why we use information

Required form fields allow us to respond and understand the course you need. You can leave optional learning-needs details blank. Without the necessary contact or booking details, we may be unable to handle your enquiry or provide the course.

Website analytics and advertising

We use Vercel Web Analytics for aggregate website statistics, Google Ads for advertising measurement, and the Meta Pixel for Facebook and Instagram advertising measurement. Vercel says Web Analytics does not use cookies; it creates a visitor hash from the incoming request that resets after 24 hours and provides aggregate statistics such as pages, referrers and device/browser information. We use these statistics to understand and improve the website, not to profile individual visitors or measure advertising performance. Vercel’s Web Analytics privacy information explains its processing in more detail.

If you allow advertising measurement, our form includes campaign attribution in the enquiry sent to Katherine. Campaign attribution is also stored in browser session storage until that browser session ends. The current form code does not deliberately include the names, email addresses, phone numbers or free-text answers from the form in its advertising event payloads.

Vercel Web Analytics runs by default for aggregate website statistics. Google and Meta advertising tags, campaign attribution and advertising events load only after you allow advertising measurement. Choose Reject advertising or Allow advertising; you can reopen Cookie settings at the foot of any page to change your advertising choice. Saving a choice reloads the page to apply it, so please save your choice before completing a form.

We remember your advertising choice in local storage for 180 days so we do not repeatedly ask. This necessary preference storage does not itself authorise advertising. A session-only preference may also remember that you dismissed a course notice. If storage is unavailable, advertising measurement remains off by default.

Advertising tools can set identifiers such as Meta’s _fbp and _fbc and Google’s _gcl_ cookies. Provider lifetimes can vary; their cookie and privacy policies describe their use. Withdrawing consent prevents further loading on our site and clears accessible first-party advertising cookies. It does not remove records already received by providers or cookies on their own domains; you can use their privacy tools and your browser controls for those.

Signing in uses necessary, secure, httpOnly session cookies: a short-lived access cookie (up to one hour) and a refresh cookie (up to 30 days). These provide account access and are separate from advertising consent. We also use short-lived, hashed request counters to limit repeated sign-in, resource and checkout requests.

Who receives information?

Relevant information is handled by Katherine and service providers supporting the business, including:

We may also share information with professional advisers or authorities where necessary to meet legal obligations or handle a dispute. We do not sell course enquiry details.

The Business Tutor Ads integration is used to manage our own advertising assets. It is not a student login service. Advertising account permissions do not give the integration access to the contents of our enquiry email inbox.

International processing

Our providers may process information in the United States and other countries outside the UK. Vercel and Resend publish data-processing terms that include contractual safeguards for international transfers. Google describes its use of adequacy arrangements, the UK Extension to the Data Privacy Framework and standard contractual clauses. Stripe and Meta describe their international processing in their privacy information. The mechanism that applies depends on the provider, service and destination. Contact Katherine for information about safeguards relevant to your data.

Provider information: Vercel, Resend, Google, Meta Stripe and Supabase.

How long we keep information

We keep unsuccessful course enquiries for 12 months after our last substantive contact, then delete or anonymise them unless a legal obligation or unresolved dispute requires longer retention. This includes relevant enquiry emails and any copies used to administer those enquiries.

Guest resource-only contact and request records are kept for up to 12 months after your last request or substantive contact. If you opt into occasional marketing emails, we keep the relevant contact and permission records while that subscription is active, and review inactive subscriptions after 12 months. After you unsubscribe, we retain only the information reasonably needed to respect that preference and document it. Records in Resend Contacts and notification emails are included in these reviews; deletion is not automatic.

When requests are linked to an account, we retain the profile and resource library while needed to provide your account and purchased-resource access. You can ask Katherine to close your account. We remove or anonymise information no longer needed, while retaining payment, preference or dispute records where required by the rules below.

For completed courses and resource purchases, our retention policy is:

We review records for deletion regularly. These are business retention rules, not a promise that an email is automatically deleted on its anniversary. Service-provider logs, backups and records they hold for their own purposes follow their separate retention schedules, described in their linked privacy information. Deleted records may remain in restricted backups until those backups expire. We can help you request deletion from relevant providers where applicable.

Your choices and rights

Depending on the circumstances, you can ask to access, correct or delete your information, restrict its use, object to processing based on legitimate interests, or receive certain information in a portable format. Where we rely on consent, you can withdraw it; this does not affect processing that was lawful before withdrawal. You can object to direct marketing at any time.

Email Katherine using the contact details above. We may need proportionate information to verify your identity or authority to act for a student. We normally respond within one month. If a permitted extension is necessary, we will explain why and when you can expect a response. These rights are subject to legal conditions; for example, some accounting records cannot be deleted immediately.

See our data-deletion instructions for a straightforward way to request deletion. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You may also have rights to contact a regulator in your own country.

Changes

We will update this notice and its effective date when our practices change. If a change materially affects how we use your information, we will provide an appropriate notice.