Privacy policy

1. Who is the data controller

Data controller: [COMPANY NAME], [LEGAL FORM], registration code [REGISTRATION CODE], registered address [ADDRESS].

Contact for all data protection questions: info@korepas.lt.

2. What data we process, why and on what basis

• Account. Email, full name, password (stored only in encrypted form), account type (parent or tutor), language, and the date and version of the terms you accepted. Purpose: create your account and let you sign in. Basis: performance of a contract (GDPR Art. 6(1)(b)).
• Child profiles. The child's first name, date of birth and grade, entered by the parent or guardian. Purpose: match and run lessons and apply age rules (children under 14 have no account of their own). Basis: performance of a contract; the data is provided by the parent (guardian).
• Orders and payments. Packages, lesson times and status, amounts, payment and payout identifiers. We never see or store card details: Stripe handles them. Basis: performance of a contract; legal obligation to keep accounting records (Art. 6(1)(c)).
• Tutor application and verification. Public name, description, subjects, price, languages, and identity, education and criminal-record certificate documents. Purpose: verify tutors and protect children. Basis: legitimate interest in child safety (Art. 6(1)(f)). Only Korepas administrators review the documents; they are kept in private storage and opened only for a short time.
• Notes, messages and files. A tutor's private notes about a student (visible only to that tutor), a parent's private notes (visible only to that parent), messages between a family and a tutor (visible only to the two of them) and files shared for lessons. Platform administrators cannot see these notes or messages through the administration tools. Basis: performance of a contract.
• Reviews and reports. Reviews after a completed lesson are shown publicly as "Family", without a name. Reports about misconduct or a profile are read only by administrators. Basis: legitimate interest in the safety and quality of the Platform; legal obligations.
• Technical data. IP address, browser and device information, request logs. Purpose: security, debugging, abuse prevention. Basis: legitimate interest.
• Correspondence with us. Your emails to info@korepas.lt and our replies. Basis: legitimate interest in answering; contract where needed to perform it.
• Tutors' tax data. Place of residence, date of birth, tax identification number, VAT code and payout amounts, for platform operator reports to the tax authority (EU Directive 2021/514, "DAC7", and the Lithuanian laws implementing it). Basis: legal obligation.

We do not sell data and do not send direct marketing without consent.

3. Who receives your data

• Supabase – database, sign-in and file storage. Data centre in Ireland (EU).
• Vercel – website hosting and request logs.
• Stripe Payments Europe, Ltd. – payments and tutor payouts. Stripe acts as an independent controller for payment, identity-verification and fraud-prevention data under its own policy.
• Hostinger – domain and email services.
• Tutors see only the data of the families and children they have bookings with (the child's first name, grade, lesson times, messages). Families see a tutor's public profile.
• Public authorities – where the law requires it (for example the tax administration, courts, law enforcement).

Before we start using new providers (for video lessons, email or SMS) we will add them to this list.

4. Transfers outside the EU / EEA

Some providers are US companies. We transfer data to them on the basis of the European Commission's standard contractual clauses and/or the EU-US Data Privacy Framework where the provider participates. The main database is in Ireland.

5. How long we keep data

• Account data – while the account is active. After a request to delete the account we delete or anonymise the data within 30 days, except what the law requires us to keep.
• Accounting and payment records – as long as the law requires (usually up to 10 years).
• Tutor verification documents – while the profile is active and for up to 12 months afterwards, so that we can prove a check was done or defend legal interests.
• Notes, messages and files – while the account exists; they are deleted when the account is deleted.
• Reports about violations – up to 3 years after the case is closed, or longer while a dispute or investigation is ongoing.
• Technical logs – briefly, usually up to 30 days.

6. Your rights

• to know what data we hold about you and receive a copy;
• to have inaccurate data corrected;
• to have data erased (the "right to be forgotten") when there is no reason to keep it;
• to restrict processing or object to it where the basis is legitimate interest;
• to receive the data you gave us in a portable form where we process it under a contract;
• to withdraw consent at any time where processing is based on consent.

Send requests to info@korepas.lt. We reply within one month; we may ask you to confirm your identity.

If you believe we process your data improperly you have the right to complain to the State Data Protection Inspectorate (vdai.lrv.lt). Please write to us first so we can put it right.

7. Children's data

Child profiles are created and managed by parents or guardians, who confirm they are entitled to do so. Children under 14 have no account of their own. Student accounts for teenagers aged 14 and over are not available yet; we will update this policy when they are.

We ask only for what lessons need: first name, date of birth and grade. We do not ask for addresses or photos.

8. Data security

We transfer data over encrypted connections (HTTPS). Passwords are never stored in plain text. Private notes, messages and documents are protected so other users cannot see them (access rules are enforced inside the database itself), and verification documents are kept in private storage. We will report data breaches to the authorities and, where the law requires, to you.

9. Automated decisions

We do not make decisions with legal effects on you solely by automated means. You can sort tutors by rating or price.

10. Changes to this policy

If we make significant changes we will tell you by email or on the Platform at least 15 days before they take effect.