Privacy Policy

1. Who is responsible for your data

SmartPath-Tutor Tutorial Services is the personal information controller for the SmartPath apps and this website.

Data Protection Officer: email sptutor.ph@gmail.com with the subject “Data Privacy”. We answer within 15 working days.

When a school uses SmartPath Teacher for a class, the school also decides how class information is used for its own teaching. We process that class information for the school, under this policy.

2. What we collect

Parent or guardian: name, email address, and mobile number if you give it (for sign-in codes and plan reminders); your sign-in method (email and password, or Google); household settings and the parent PIN (stored only in scrambled, one-way form).

Each child you add: first name (a last name and nickname are optional), grade level, avatar, language choice, and the learning record — lessons opened and finished, how much of a lesson was watched, answers and scores in assessments and practice, reading accuracy, writing and tracing results, badges, tickets and streaks, and time spent. We do not ask for a child’s photo, address, school ID or birth certificate.

Teachers: name, email, school name, and the classes you create, your posts and attendance records.

Payments: plan, amount, date, method and reference. For a manual GCash, bank or cash payment you may attach a receipt screenshot so our staff can confirm it. Card and wallet details are entered only on PayMongo’s secure page; we never see or store them.

Things you send us: support messages and any images you attach; questions you ask Teacher Saje (the parent AI helper); a child’s drawings saved in the app.

Device and technical data: device type, browser, app version, and error reports needed to keep the apps working and secure.

3. Voice and the microphone

The reading activities can listen to a child read aloud, to check each word. This only happens after a tap on the microphone button, and the browser or device asks you for permission first.

The sound is turned into text by the speech service built into the device or browser — Google for Chrome and Android, Apple for Safari, iPhone and iPad — under that company’s own privacy terms. SmartPath receives only the words that were recognised and the reading score. We do not record, keep or upload your child’s voice.

You can say no to the microphone. The reading activities then work by tapping, and a grown-up can mark each word.

4. How we use it, and our lawful basis

To run the service you or your school signed up for (contract): accounts, lessons, progress, reports to parents, class features, reminders, and support.

With your consent: creating a child’s profile and processing the child’s learning data, the microphone, and optional emails such as weekly digests. You give consent when you create your account and add a child, and you can withdraw it at any time (see “Your rights”).

Legal obligations: payment and tax records, and answering lawful requests from authorities.

Legitimate interests that do not override your rights: keeping the apps secure, preventing fraud and abuse, and fixing errors.

We do not use children’s data for advertising, we do not build marketing profiles, and we do not make decisions about a child by automated means that have legal or similarly serious effects. Scores and suggestions in the app help learning; a parent or teacher always decides.

5. Children’s privacy

Only a parent or legal guardian aged 18 or older can create a family account and add a child. By adding a child you confirm you have the authority to consent for that child.

The child app has no ads, no social feed, no chat with strangers and no links out to the internet. Children cannot chat with an AI. When a child is stuck on a question, Tala may show a short hint; only the question itself is used to write it, never the child’s name or anything the child types.

A teacher can see a child only after the parent approves joining that class. Teachers see what they need to teach: the child’s name and grade, attendance, class activities and their results, and which assigned lessons are started or done.

A child who signs in on a family tablet does so through the parent’s account. Children cannot change parent settings, plans or privacy choices; those are protected by the parent PIN.

6. Who we share it with

Inside your family: every parent or guardian linked to the household sees each child’s progress and reports.

Your child’s teacher: only after you approve the class, and only the class information listed above.

Service providers that process data for us, under contracts or terms that require them to protect it: Supabase (accounts and database), Cloudflare (hosting and delivery of the apps and lessons), PayMongo (online payments), Resend (email), Semaphore (SMS sign-in codes), Google (sign-in, if you choose it), DeepSeek (writes Teacher Saje’s answers and Tala’s hints from the question text — no names or account details are sent), and Sentry (error reports, without names, emails or IP addresses, when enabled).

Authorities, only when the law requires it or to protect someone’s safety.

We never sell, rent or trade personal data, and we never share it for advertising.

7. Data stored outside the Philippines

Some of our providers store or process data outside the Philippines — for example in Singapore, the United States, and, for DeepSeek’s answers to typed questions, China. We choose providers that protect data to the standard the Data Privacy Act requires, we send each one only what its job needs, and we remain responsible for your data while they handle it.

8. How long we keep it

Account and learning data: while the account is active. If a family account is deleted, the children’s profiles and learning records are deleted from our live systems at once and from backups within 30 days.

If an account has not been used for 3 years, we may delete it, after emailing the parent at least 30 days before.

Payment records (amount, date, method, reference and the payer’s email) are kept for the period required by Philippine tax law. They contain no children’s learning data.

Support messages and questions asked to Teacher Saje: kept with your account so you can look back at them, and deleted when the account is deleted.

Class records a school needs (attendance, class activity results): for the school year and up to 1 year after, unless the school asks us to delete them sooner.

9. How we protect it

All data travels over HTTPS (TLS). Database rules (row-level security) let each account reach only its own family or class, and we test those rules automatically. Passwords and the parent PIN are stored only in one-way scrambled form. Lesson files are private and served only to signed-in subscribers. Staff access is limited to what each person’s job needs.

No system is perfectly secure. If a personal data breach could put you at risk, we will notify the National Privacy Commission and the affected families within 72 hours of learning of it, as the law requires, and tell you what we are doing about it.

10. Your rights

Under the Data Privacy Act you have the right to be informed; to access your data and your child’s; to correct it; to object to or withdraw consent for processing; to have it erased or blocked; to receive a copy in a common electronic format (data portability); to be compensated for damage caused by inaccurate or unlawfully processed data; and to file a complaint.

Most of this you can do yourself in the Parent app: see and correct each child’s details, remove a child, change email choices, and delete your account (Settings → Delete Account). For anything else, email sptutor.ph@gmail.com from the address on your account. We confirm it is you, then act within 15 working days.

Withdrawing consent for a child’s data means we stop processing it and delete the child’s profile; the child can no longer use SmartPath Tutor.

If you are not satisfied with our answer, you may complain to the National Privacy Commission (privacy.gov.ph, complaints@privacy.gov.ph).

11. Cookies and storage on your device

The apps keep your sign-in and settings in your browser’s storage, and store lesson files so they work offline. These are needed for the apps to work. We use no advertising or tracking cookies, and no analytics service. This website has no sign-in and sets no tracking cookies.

12. Changes to this policy

When we change this policy we update the version and date at the top. If the change is significant, parents and teachers are asked to read and agree to the new version the next time they open their app.

13. Contact

SmartPath-Tutor Tutorial Services — Data Protection Officer, sptutor.ph@gmail.com. To delete an account or data step by step, see smartpathtutor.ph/data-deletion.