Privacy Policy — Tutors
Effective date: 5 September 2026 Last updated: 5 September 2026
This policy explains how SMSO Education Ltd ("SMSO Education", "we", "us") handles your personal data as a tutor. A separate policy covers parents and their children.
It also explains your responsibilities toward the student data you can see — see section 9.
1. Who we are
SMSO Education Ltd is the data controller for the personal data described here.
| Registered address | Suite 66, The Wenta Business Centre 1A Electric Ave Enfield Middlesex EN3 7XU |
| Contact for privacy questions | Son Nguyen info@smsoeducation.com |
| Data protection contact | Son Nguyen info@smsoeducation.com |
2. What this policy covers
The same policy covers both ways you can reach your SMSO account. They share one account and one database, but they do not collect identical technical data, so the tables below mark which applies where.
| Label | Service |
|---|---|
| Web | The SMSO tutor dashboard in a web browser |
| App | The SMSO Tutor mobile app for iOS and Android |
Where a row is marked Both, it applies however you sign in.
3. What we collect
Account and identity — Both
- Your name, email address and phone number
- Login credentials for the tutor account
- Your profile details, subjects and qualifications
Teaching activity — Both
- Classes and students assigned to you
- Lesson schedules, attendance you record, and lesson status
- Your availability and scheduling preferences
- Reschedule and cancellation requests you raise, including reasons
- Study reports and feedback you write about students
- Homework you set and lesson notes you record
Performance and engagement — Both
- Counts of lessons taught, cancelled and rescheduled
- Whether reports were submitted within the reporting window
- Emergency and short-notice request counts, used to apply scheduling policy
Pay — Both
- Payroll periods, payroll lines and calculated totals
- Rates applied to your lessons
Technical data
| Data | Where |
|---|---|
| Server logs: IP address, request time, pages or endpoints requested | Both |
| Browser type and version | Web |
A session cookie (smso_access_token) and a language cookie (NEXT_LOCALE) | Web |
| Product analytics and session replay (see section 6) | Web only |
| Device identifier, generated by the app to register your device | App |
| Firebase push notification token | App |
| Device platform (iOS or Android) and app version | App |
The mobile app contains no analytics or tracking SDKs. We do not collect advertising identifiers, we do not track you across other apps or websites, and we do not use your data for advertising.
4. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Assigning classes and managing the timetable | Performance of a contract |
| Calculating and paying what you are owed | Performance of a contract; legal obligation |
| Delivering push notifications to your device | Performance of a contract; consent for the device permission |
| Applying scheduling and cancellation policy | Legitimate interests |
| Reviewing teaching quality and report timeliness | Legitimate interests |
| Tax, payroll and statutory records | Legal obligation |
| Securing accounts and investigating misuse | Legitimate interests |
| Improving the web dashboard through analytics | Consent, where required |
A note on performance data. We count your cancellations, short-notice changes and late reports, and these figures inform scheduling decisions and reviews. This is human-reviewed; we do not make decisions producing legal or similarly significant effects about you by automated means alone. If you believe a figure is wrong, contact info@smsoeducation.com and we will look into it.
5. Who we share it with
We do not sell personal data. We share it with service providers who process it on our behalf, under contract:
| Provider | What they process | Where |
|---|---|---|
| NocoDB (self-hosted by SMSO) | Account, teaching, report and payroll records | Both |
| n8n (self-hosted by SMSO) | Recipient email address and message content | Both |
| Microsoft Clarity | Usage and session-replay data | Web only |
| Google — Firebase Cloud Messaging | Push token, device identifier, notification content | App only |
| Hien Le & Co Ltd | Payment details | Both |
We may also disclose data where required by law, or to establish or defend legal claims.
Where your data is held: the United Kingdom — our application servers and database run in Vultr's London region. Microsoft Clarity and Google process data outside this location; those transfers rely on the UK Extension to the EU–US Data Privacy Framework, which both Microsoft and Google are certified under.
6. Analytics (web only)
The web dashboard uses Microsoft Clarity to understand how the site is used. Clarity records usage data and can replay a reconstruction of your session — pages viewed, clicks, scrolling and mouse movement.
Because those sessions display student information, we treat these recordings as sensitive and restrict access to them. You can opt out using your browser's Do Not Track setting or a tracker-blocking extension, and you may contact info@smsoeducation.com to ask us to exclude your account.
The mobile app has no analytics or session replay.
7. Cookies and on-device storage
Web — cookies
| Cookie | Purpose | Type |
|---|---|---|
smso_access_token | Keeps you signed in | Strictly necessary |
NEXT_LOCALE | Remembers your language | Functional |
Strictly necessary cookies cannot be disabled without breaking sign-in. Cookies set by Microsoft Clarity are described in section 6.
App — on-device storage
The mobile app uses no cookies. It stores:
| Stored | Where | Purpose |
|---|---|---|
| Sign-in tokens | iOS Keychain / Android Keystore | Keeps you signed in securely |
| App preferences and pending notification state | App-local storage | Makes the app work |
This data stays on your device and is removed when you sign out or uninstall the app. Push notifications require permission, which you grant when asked and can revoke at any time in your device settings.
8. How long we keep it
| Record | Retention |
|---|---|
| Account and profile | While your account is active, and for 24 months after your last lesson |
| Teaching, lesson and report records | 24 months after the last lesson. Attendance and lesson details that support an invoice or a payment are kept with that record |
| Payroll and tax records | 6 years from the end of the tax year they relate to |
| Server and access logs | 90 days |
| Push token and device identifier | Until you sign out, uninstall, or disable notifications |
| After you stop tutoring with us | Records are deleted on the schedule above. Payroll and tax records are kept for the full 6 years tax law requires, then deleted |
Payroll and tax records are kept for the statutory period even after you stop working with us.
9. Student data you access
Through the dashboard and the app you can see personal data about students, most of whom are children. You are acting on our behalf when you do, and you must:
- Access only the students assigned to you, and only for teaching purposes
- Keep what you see confidential, and never share it outside SMSO's systems
- Avoid copying student data to personal devices, notes or messaging apps, and avoid screenshotting student records
- Write study reports professionally, recording what is relevant to learning
- Keep your device locked and your account credentials to yourself
- Report any suspected data breach or lost device to info@smsoeducation.com immediately
Misusing student data may lead to loss of access and termination of your engagement, in addition to any legal consequences.
10. Your rights
Subject to UK data protection law (the UK GDPR and the Data Protection Act 2018), you may:
- Access the personal data we hold about you
- Correct data that is inaccurate or incomplete
- Delete data where we no longer have grounds to keep it
- Restrict or object to certain processing, including processing based on our legitimate interests
- Port your data to another provider in a machine-readable format
- Withdraw consent where processing relies on it
- Complain to a supervisory authority — the Information Commissioner's Office (ICO), at ico.org.uk or 0303 123 1113
These rights apply to your own data. They do not extend to student records, which belong to the families concerned.
To exercise any of these, email info@smsoeducation.com. We respond within one month; for complex requests we may extend this by up to two further months and will tell you if we do.
11. Security
We protect data with encrypted connections, authenticated sessions, role-based access controls that limit you to your assigned students, and restricted administrative access. On mobile, sign-in tokens are held in the device's hardware-backed secure storage. No system is perfectly secure, but we review these controls regularly. If a breach affects your data, we will notify you and the relevant authority as the law requires.
12. Changes
We may update this policy. Material changes will be notified in the app, on the web dashboard, or by email before they take effect. The date at the top always reflects the current version.
13. Contact
Questions, requests or complaints: info@smsoeducation.com SMSO Education Ltd, Suite 66, The Wenta Business Centre, 1A Electric Ave, Enfield, Middlesex, EN3 7XU