Privacy Policy

The data controller responsible for your personal data is IsaStudyzone (a Dutch sole proprietorship / eenmanszaak), Karel Doormanlaan 121, 2283 AK Rijswijk, The Netherlands. You can contact us about your personal data or this policy at isastudyzone@gmail.com. We have not appointed a Data Protection Officer; the contact above handles all privacy matters.

We collect the following categories of personal data:

• Account data: your name and email address, a hashed password, and — when you sign in with Google — the profile information Google shares with us.
• Profile data you publish: photo, bio, languages, WhatsApp/phone number, and introduction or work showcase videos.
• Marketplace content: skill listings, wanted bounties, reviews, learning interests, and any text or media you post.
• Booking and messaging data: learner name and email, session date, time and format, provider earnings and customer price, and the contents of your conversations.
• Invoice data: learner name and email, amounts, service fee, total, the educator's payment link, and generated invoice PDFs.
• Tutor-matching data: name, email, phone, education level, subjects, goals, preferred dates and contact method (collected in tutor requests and tutor applications).
• Report data: the subject, details, reporter email and any names you include when you submit a report.
• Technical and usage data: limited device and usage information needed to run and secure the service, and the authentication cookies/tokens that keep you signed in.

• To provide the marketplace and your account (create listings, bookings, messages and invoices) — performance of a contract (Art. 6(1)(b)) and steps at your request before a contract.
• To process payments: invoices and payment links are shared so the learner can pay the educator. The platform itself does not handle card data — performance of a contract.
• To match learners with educators (tutor requests, bounties) — legitimate interests in operating the marketplace (Art. 6(1)(f)), balanced so it meets your expectations.
• To send transactional emails (booking, message and invoice notifications) — legitimate interests and contract.
• To summarise tutor requests with AI and to power in-app assistants that read your own records — legitimate interests in efficient support, with appropriate data minimisation.
• To contact you via WhatsApp when you choose that contact method — consent (Art. 6(1)(a)), given when you select it; you can withdraw it at any time.
• To secure, administer and improve the platform, and meet legal and accounting obligations — legitimate interests and legal obligation (Art. 6(1)(c)).

We use artificial intelligence to summarise new tutor-matching requests (so our team can follow up quickly) and to power in-app assistants that answer your questions using your own bookings, invoices, reviews and listings. These AI providers act as our processors. We do not use automated decision-making or profiling that produces legal or similarly significant effects about you.

We share personal data with the following categories of recipients:

• Other users: information you publish (listings, reviews, bounties) and the booking/messaging data needed for a session are visible to the relevant other party.
• Our hosting and platform provider, Base44, which stores and processes data on our behalf under a data-processing arrangement.
• AI providers that summarise tutor requests and power assistants.
• Google, for sign-in.
• WhatsApp / Meta, only when you initiate a WhatsApp contact with us.
• Educators' own payment providers (e.g. Stripe, PayPal): when you pay an invoice you leave our platform and pay via the educator's link; that provider processes your payment data under its own terms.

We do not sell your personal data.

Some of the processors listed above are located outside the European Union / European Economic Area (for example hosting, sign-in and AI providers). We rely on Standard Contractual Clauses adopted by the European Commission, or on an adequacy decision where one covers the recipient country, and we assess each transfer to ensure appropriate safeguards are in place.

We keep your data only as long as needed for the purposes described:

• Account data: while your account is active, and for a short period after deletion to allow recovery, unless a legal obligation requires longer.
• Booking and invoice records: up to 7 years, to meet tax and accounting obligations.
• Messages: until a conversation is closed, plus 6 months.
• Tutor-matching data: until the request is resolved, plus 3 months.
• Marketplace content and reports: while the related listing or report is relevant, then removed on request or when no longer needed.

You can request earlier deletion (see Your rights), subject to legal retention duties.

Under the GDPR you have the right to:

• Access your personal data and receive a copy (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase your data ("right to be forgotten") (Art. 17);
• Restrict processing (Art. 18);
• Receive your data in a portable format (Art. 20);
• Object to processing based on legitimate interests (Art. 21);
• Withdraw consent at any time, without affecting processing already carried out.

To exercise these rights, contact us at isastudyzone@gmail.com. We will respond within one month. If you are not satisfied with our response, you may lodge a complaint with your supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Providing account and booking data is necessary to use the marketplace; if you do not provide it, you cannot book, list or message. Profile, media and contact-method data is optional.

The marketplace is intended for adults. Where a parent or guardian arranges tutoring for a minor, the account holder is the parent or guardian, who consents to the processing of the child's data (name, education level, subjects and goals) for the purpose of matching and delivering sessions. Parents or guardians may exercise data-subject rights on behalf of the child by contacting us.

See our Cookie Policy for details on the cookies we use and how to control them, including how to withdraw consent.

We may update this policy. The "Last updated" date above reflects the current version. Material changes will be indicated on the platform or by notice where appropriate.