Privacy Policy

1. Who we are

Tuition One Grinds is the data controller for the personal data described here. We are based in Ireland, and we handle your data under the General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988–2018.

This policy explains what we collect, why, how long we keep it, and what you can ask us to do with it.

Tuition One Grinds
Email: tuitiononegrinds@gmail.com
Instagram: @tuition_one

We aim to reply to every message within 2 working days.

2. What we collect

Details you give us

• Parent or guardian name, email address and mobile number.
• Student name.
• Delivery address, including Eircode, so printed booklets can be posted.
• Anything you write to us in a support message.

Details created by your purchase

• Which course and option you bought, the amount, the currency and the date.
• Stripe's reference for the payment. We never see or store your card number — Stripe handles the card itself.
• A record that you accepted these policies at checkout, with the date and the IP address it came from.

Details created by using the site

• An access log of which videos and booklets were opened from your account, with the date and IP address. We keep this to protect the material from being shared, and to help us support you.
• Anonymous page views — the page, the referring page and a random identifier held in your browser for the visit only. It is not a cookie and is not linked to you.

3. Why we use it, and our legal basis

• To give you what you bought — creating your account, emailing your sign-in link, granting access, posting booklets. Legal basis: performance of our contract with you.
• To take payment and prevent fraud — through Stripe. Legal basis: performance of our contract, and our legitimate interest in preventing fraudulent payments.
• To support you — answering your questions and fixing problems. Legal basis: performance of our contract, and our legitimate interest in running the service well.
• To protect the course material — the content access log above. Legal basis: our legitimate interest in preventing our material from being copied and shared.
• To understand how the site is used — anonymous, aggregated page views. Legal basis: our legitimate interest in improving the site.
• To meet our legal duties — keeping records of sales for tax. Legal basis: legal obligation.

We do not sell your personal data, we do not use it for automated decision-making or profiling, and we do not send marketing emails unless you have asked us to. If we ever do, every message will have a one-click unsubscribe and you can withdraw consent at any time.

4. Cookies and analytics

We use a strictly necessary cookie to keep you signed in after you click your sign-in link, and a short-lived one to protect forms against cross-site request forgery. These are required for the site to work and cannot be turned off.

Our own page-view counting does not use cookies at all. It stores a random identifier in your browser's session storage, which is cleared when you close the tab, so we can count a visit without identifying you.

We also use Vercel Analytics and Vercel Speed Insights to measure traffic and page performance. Both are cookie-free and designed not to identify individual visitors.

5. Who we share it with

We do not sell or rent your data. We share it only with the service providers who make the site work, each acting as our processor under a written agreement, and only with what they need:

• Stripe — payment processing. Stripe is a controller in its own right for card data. See Stripe's privacy policy.
• Vercel — website hosting, the database that stores your account, and analytics.
• Resend — sending your sign-in links and service emails.
• Cloudflare R2 — storing the course videos and booklets.
• Upstash — rate limiting, to stop automated abuse of checkout and sign-in.
• An Post or a courier — your delivery address, only when a printed booklet is being posted to you.

We may also disclose data where the law requires it, or to establish or defend a legal claim. If our business were ever transferred to someone else, your data would move with it and we would tell you first.

6. Where your data is held

Your data is stored and processed in the European Economic Area. Several of our providers are global companies, so where a service offered a choice of region we selected an EU one — the database, the file storage holding the course material, the rate limiting and the email delivery are all configured to keep data within the EEA.

Stripe is a separate controller for payment data and operates internationally under its own safeguards; see its privacy policy for details. Should we ever need to move any other processing outside the EEA, we would update this policy first and rely on an adequacy decision of the European Commission or the EU Standard Contractual Clauses.

7. How long we keep it

• Your account — for as long as you have one. Ask us to delete it and we mark it deleted immediately; it is permanently erased within 30 days.
• Sales and payment records — six years, because Revenue requires us to keep them.
• Content access and security logs — up to 12 months, then deleted.
• Support messages — up to two years after the issue is closed.
• Page-view counts — kept in aggregate; they contain nothing that identifies you.

Where we must keep a sales record after you delete your account, we keep only what the tax rules require and nothing more.

8. Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong or out of date;
• delete your data, where we have no overriding reason to keep it;
• restrict or object to how we use it, including anything we do on the basis of legitimate interests;
• port it — send you, or another provider, a machine-readable copy;
• withdraw consent at any time, where consent is what we relied on.

If you have an account, the quickest route is to sign in — your dashboard can export your data and request deletion directly. Otherwise, email tuitiononegrinds@gmail.com. We reply within one month, and we never charge for a request unless it is clearly excessive or repetitive.

9. Students under 18

Our courses are written for second-level students, most of whom are under 18, but accounts are opened and paid for by an adult. The data we hold about a student is limited to their name and the course they are taking; we do not ask students for their own contact details and we do not market to them. If you believe we hold data about a child that we should not, email us and we will remove it.

10. How we protect it

The site runs over HTTPS. There are no passwords to steal — signing in uses a one-time link that expires after 24 hours and works once. Course videos and booklets are served through short-lived private links rather than public URLs, access to your data is limited to the people who run the service, and sign-in and checkout are rate limited against automated abuse. No system is perfectly secure, but if a breach ever put your rights at risk we would notify the Data Protection Commission within 72 hours and tell you without undue delay.

11. Changes to this policy

We will update this policy when what we do changes. The date at the top shows the last revision. If a change materially affects how we use your data, we will tell you by email.

12. Questions and complaints

Talk to us first — email tuitiononegrinds@gmail.com and we will do our best to put it right. You also have the right to complain to the Irish supervisory authority:

Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28
dataprotection.ie

See also our Terms of Service and our Refund & Cancellation Policy.