Legal
Privacy Policy
Last updated:
The short version
- Children never get an account, an email address or a password here
- We store your child's first name and age — not a surname, address or photo
- Classes are live and are never recorded
- We don't sell data, and we don't run advertising trackers
- You can see, correct or delete everything we hold, whenever you like
1. Who we are
Novinity ("we", "us") provides live one-to-one online classes for children. For data protection purposes the data controller is [YOUR REGISTERED COMPANY NAME], [YOUR REGISTERED ADDRESS]. You can reach us about anything on this page at .
2. Whose data we hold
We hold data about two groups of people:
- Parents and guardians, who hold the account.
- Children, who take the classes but never hold an account.
Only a parent or guardian may create an account and add a child. By adding a child you confirm you have parental responsibility for them.
3. What we collect, and why
From parents
| What | Why |
|---|---|
| Name, email, phone | To run your account, confirm classes and reply to you |
| Password | Stored only as an encrypted hash — we never see it |
| Timezone | So class times display correctly for you |
| Bookings and session history | To provide the classes you paid for |
| Messages you send us | To answer them |
About children
| What | Why |
|---|---|
| First name only | So the tutor can greet them properly |
| Age and school year | To match the right tutor and pitch the class correctly |
| An avatar emoji you pick | Cosmetic, chosen by your child |
| Notes you choose to add | Only what you tell us, e.g. "goes quiet when corrected" |
| Tutor's written notes after a class | So you can see how it went |
We deliberately do not collect a child's surname, address, photograph, school name, date of birth, or any device identifier. We do not build advertising profiles of children, and we never will.
4. What we do not do
- We do not record classes.
- We do not sell, rent or share your data with data brokers.
- We do not run advertising or social-media tracking pixels.
- Tutors are not given your contact details, and may not contact your child directly.
5. Cookies and analytics
We use one strictly necessary cookie to keep you logged in. That's it — no advertising cookies, so no cookie banner is needed.
If we use analytics, we use a privacy-preserving tool that sets no cookies and does not track individuals across sites. It tells us how many people visited a page, not who they were.
6. Who else touches your data
We use a small number of processors, each bound by contract:
| Who | What for |
|---|---|
| Supabase | Database and account hosting |
| Netlify | Website hosting |
| Stripe | Card payments — Stripe handles card details entirely; we never see or store them |
| [YOUR VIDEO PROVIDER] | The live class itself |
| Resend | Sending booking confirmations and class reminders |
Some of these process data outside your country. Where that happens, transfers are covered by standard contractual clauses or an equivalent safeguard.
7. How long we keep things
- Account and children's profiles — while your account is open, then deleted within 30 days of closure.
- Class history and tutor notes — 2 years, so you can look back at progress.
- Payment records — 7 years, because tax law requires it.
- Enquiries — 12 months if they don't become an account.
8. Your rights
You can ask us to show you, correct, export or delete the data we hold about you and your children, and to stop using it for a particular purpose. Just email us — we'll respond within 30 days, and we won't ask you to justify the request.
You can do much of this yourself: edit or remove a child from your dashboard at any time, which deletes their profile immediately.
If you think we've handled your data badly, please tell us first — but you also have the right to complain to your data protection regulator ([e.g. the ICO in the UK]).
9. Keeping data safe
- All traffic is encrypted in transit (HTTPS).
- Database access is restricted per-account by row-level security, so one family's data cannot be read by another.
- Passwords are hashed, never stored in readable form.
- Staff access is limited to those who need it to run classes.
If a breach ever occurs that puts you at risk, we will tell you and the regulator within 72 hours of becoming aware of it.
10. Safeguarding overrides privacy
If a tutor or member of staff becomes seriously concerned about a child's safety, we may share what we know with the appropriate authorities — with or without consent. This is the one circumstance in which we will disclose information about a child without asking you first, and we would not apologise for it.
11. Changes to this policy
If we change anything that materially affects you, we'll email account holders rather than quietly updating this page.
Questions about any of this? Ask us — a person will answer.