Privacy policy

The short version

• We collect only what we need to tutor students and run the portal.
• We never sell personal information, show ads, or use tracking cookies.
• Parents see their own children’s work. Tutors see the students they teach.
• Google Calendar is optional. We use Google data only to keep tutoring sessions in sync, and we never sell it or use it for ads.
• You can ask us to see, correct, or delete your information at any time.

What we collect

When you visit the website

The website has no analytics, ads, or tracking cookies. If you email us, we receive your email address and whatever you write. Your browser saves your language (taken from your browser settings or your choice) and your light or dark choice on your own device. The site loads its fonts from Google Fonts, so Google receives your IP address and basic browser details when a page loads.

When you refer a family

The “Refer a family” form asks for your name, your email address, whether you are a parent or a student, and the other family’s name and email address or phone number, plus their grade, subjects, and a note if you add them. Please only refer a family who knows you are sharing their details. To stop the same person sending the form again and again, we keep a scrambled (hashed) version of your IP address with the referral, never the address itself. We use a referral only to contact that family about tutoring, once, and only our administrator can see it. Each new referral is also emailed to our administrator so it can be reviewed quickly.

When you book a consultation

The “Book a free consultation” form asks for your name, your email address, and the subjects or exams you want help with. You can also add a phone number, the student’s grade, your preferred language, whether you want online or in-person lessons, the best way to reach you, and a note. To stop the same person sending the form again and again, we keep a scrambled (hashed) version of your IP address with the request, never the address itself. We use your request only to reply to you about tutoring, and only our administrator can see it. Each new request is also emailed to our administrator so it can be answered quickly.

When you write a review

We may send you a personal link to write a review. The review page asks for the name you want shown and your review, and for your permission to show both on our website. We keep a scrambled (hashed) version of the link, never the link itself, and each link works once and expires after 60 days. Your review is translated into our website's other languages by our AI service when you send it, and it appears on the website only after our administrator approves it, under the name you chose, never with an email address. Please don't include a child's full name. To change or remove a review, email us and we will take it down.

When you use the client portal

• Account details: your name, email address, password, the role you ask for (student, parent, or tutor), and the optional note you add when you sign up. Our sign-in provider stores passwords in a scrambled (hashed) form, so we never see them.
• Who is connected to whom: which students each parent and tutor is linked to, and the subject each tutor teaches.
• Schoolwork: assignments and due dates, the worksheets and files tutors attach to them, the work students turn in (formatted written answers, photos, PDFs, and notes), drafts of answers they have not submitted yet (saved to their account so they can finish on any device, and seen only by them), grades, and tutor feedback.
• Lessons: session dates and times, the place or online meeting link, the tutor’s plan, attendance, session notes, and the slides, files, and links attached to a lesson.
• Updates: messages posted in the portal.
• Profiles and photos: optional profile details, such as a student’s grade, school, interests, and how they learn best, and an optional profile photo. The student, their parents, their tutors, and our administrator can see them. Photos are stored privately, resized, and have their location data removed before they are saved. You can change or remove a photo at any time on the Profile page (a parent can do this for their child), or email us and we will remove it.
• Technical information: the portal keeps you signed in by saving a sign-in token in your browser, and it saves a few display preferences there too, such as your calendar view, sidebar layout, and which updates you have already seen. When you connect Google Calendar, the portal sets one cookie for 10 minutes that ties the connection to your browser; it is not used for tracking. Our hosting provider records basic request details, such as IP addresses, to keep the service running and secure. Our own error logs hold only error codes and record numbers, never the content of your work.

How we use it

• To run tutoring: scheduling sessions, assigning and grading homework, and sharing progress with the student and their parents.
• To draft grades: when a student turns in work, we send an AI service the assignment’s title and instructions, any worksheets attached to it, the tutor’s answer key if there is one, and the student’s typed answer and uploaded file. We do not send the student’s name or email address. The AI service writes a draft grade and comments. A tutor or our administrator looks at each draft and decides whether to release it, and students and parents see a grade only after it is released.
• To draft homework: a tutor or our administrator may send an AI service photos or documents from a lesson (such as whiteboard photos, worksheets, slides, or notes), with the subject and the student’s grade level, to draft practice problems and an answer key. Photos are made smaller and their location data is removed in the tutor’s browser. Documents are sent as they are. Both are held in our private storage only while the draft is made and are deleted right after it (or within a day if a draft is interrupted); we do not keep them unless the tutor chooses to attach them to the assignment. We ask tutors not to include students’ faces or names in these files. A tutor reviews and edits every draft before a student sees it, and only staff can see the answer key.
• To send account emails, such as confirming your email address or resetting your password.
• To keep the portal secure and to fix problems.

We do not sell personal information, use it for advertising, or share it with anyone for their own marketing.

Who can see what

• Students see their own assignments, released grades, sessions, and lesson materials, and the updates their tutor chooses to share with them.
• Parents see the same for the children linked to their account, plus every update a tutor writes about their child.
• Tutors see the students they are assigned to. A student’s tutors can see each other’s sessions and notes for that student.
• Everyone with an approved account can see the names of our tutors and administrator, and students and parents see which subject each of their tutors teaches.
• Our administrator can see everything in the portal, to approve accounts, run the service, and help with problems. Only the administrator sees referrals and consultation requests.

The database itself enforces these limits, not just the screens.

Google Calendar

Connecting Google Calendar is optional. Everything in the portal works without it.

Tutors

Our administrator also teaches some students, and counts as a tutor in this section.

When a tutor turns on Google Calendar sync, the portal asks Google for permission to:

• see the tutor’s Google email address;
• create a calendar in the tutor’s Google account, named “VP Education sessions”, and add, change, and remove events in the calendars the portal created only;
• view the events on the tutor’s calendars, read-only.

We use these permissions only to:

• Keep sessions in step. The tutor’s portal sessions and the “VP Education sessions” calendar stay the same in both directions. Each event carries the session’s subject, the student’s name, the time, the place or meeting link, the tutor’s plan, and a link back to the portal. A move or cancellation in either place updates the other, and an event the tutor creates in that calendar with a student invited becomes a portal session.
• Show the tutor their own schedule. The tutor’s personal events appear next to their sessions, and the portal warns them when a new session would overlap one. Private events show only as “Busy”. Personal events are read when the tutor opens their calendar, are shown only to that tutor, and are never saved in our database.

Session details that sync from a tutor’s “VP Education sessions” calendar become ordinary portal sessions, so the people who can see that student’s sessions (described above) can see them.

To keep the sync running, we store the tutor’s Google email address, the permissions they granted, a Google refresh token (the credential that lets the portal reach the calendar without asking again) that we encrypt before saving, the ID of the “VP Education sessions” calendar, and the details Google uses to notify the portal when that calendar changes. Each synced session also keeps its Google event ID and link. Turning the sync switch off pauses syncing but keeps the connection so it can be turned back on. Disconnecting removes it.

Students

A student who chooses “Get Google Calendar invites” shares only their Google email address with us. We add that address as a guest on their sessions, so Google sends them invitations and updates, and their tutor sees the address as a guest on the event. We cannot see or change anything in a student’s calendar. Parents are never invited.

Disconnecting

Tutors and students can disconnect Google Calendar in the portal at any time. We then delete the stored connection and refresh token. For tutors we also ask Google to cancel our access, and students are taken off their upcoming invitations. Events already in a tutor’s “VP Education sessions” calendar stay there until the tutor deletes them. You can also remove our access from your Google Account at myaccount.google.com/permissions.

Limited Use

VP Education Group’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we do not use Google user data for advertising, we do not sell it, we do not send it to the AI service we use for draft grades, and we do not use it to train AI models. Apart from synced session details, which become portal sessions as described above, no one at VP Education Group reads Google user data unless you ask us to help with a problem, or it is needed for security or to comply with the law. A tutor’s personal events and Google tokens are never shown to anyone else.

Companies that help us

We use a few service providers to run the website and the portal. They handle information only to provide their service to us.

• Supabase: the database, file storage, sign-in, and account emails.
• Vercel: hosting for the website and the portal.
• Resend: sends our administrator an email with the details of each new referral, consultation request, and review.
• jsDelivr: delivers a code library that portal pages load, so it receives your IP address and basic browser details.
• Anthropic: the AI service that writes draft grades from the work students turn in, drafts homework from the lesson photos and documents tutors send, and translates reviews into the website's languages.
• Google: Google Calendar for people who connect it, and the fonts on our website and portal pages.

We may also share information if the law requires it, or to protect the safety of our students and tutors.

Children’s privacy

Most of our students are children. We approve every portal account by hand before it can see anything. For a student under 13, we approve the account only after confirming with the student’s parent or guardian. A parent can ask at any time to see, correct, or delete their child’s information. We collect only what tutoring needs, and we never use children’s information for advertising.

How long we keep it

We keep account information and schoolwork while the account is open, so students and parents can look back on past work. If you ask us to delete an account, we delete the account and its work, grades, sessions, uploaded files, and stored Google connection within 30 days, unless the law requires us to keep something. Calendar events already copied into a tutor’s Google Calendar, and invitations Google already sent, stay in Google, where the tutor or student controls them. Copies in our providers’ backups are removed on their regular schedule. We delete a referral once we have contacted the family and it is no longer needed, or sooner if the referrer or the family asks. We delete a consultation request once we have replied and it is no longer needed, or sooner if you ask.

How we protect it

• Every page and connection is encrypted (HTTPS).
• The database checks who is asking before it returns anything, so each person sees only what their role allows.
• Links to files stop working after 10 minutes.
• Google tokens are encrypted before they are saved.

No system is perfectly secure, but we work to protect your information, and we will tell you if a breach affects it.

Your choices

• To see, correct, or delete your information, or your child’s, email us.
• You can disconnect Google Calendar at any time from the portal calendar.
• You can clear the language and theme choices by clearing this site’s data in your browser.

We do not sell or share personal information as California law defines those terms.

Changes to this policy

If we change this policy, we will update the date at the top. If a change affects how we use your information, we will tell account holders by email or in the portal before it takes effect.

Contact us

VP Education Group, San Gabriel Valley, California
vbmgroupsllc@gmail.com