Privacy Policy

1. Who is responsible for your data

• Parent and student data: the tutor or tutoring centre that teaches you decides what data is collected and for what purpose, so the Tutor is the data controller (collector). The Platform provides the system on the Tutor's behalf as a data processor, processes data only as far as needed to provide the service, and does not use it for its own purposes.
• Account data of Tutors and their members (finance staff, teachers): collected by the Platform, which is the data controller.
• Parents add the Tutor's own LINE Official Account as a friend; the Tutor is the data controller of the LINE userIds under that account.

2. What data we collect (data minimisation)

We collect only the fields needed for scheduling, deducting lessons, payments and contact, and we do not collect national ID numbers. Optional fields such as date of birth and address are stored only when the Tutor or the student fills them in.

• Students: name, grade, notes written by the Tutor; optional phone, email, address and date of birth (for contact and calculating age); and whether the student is an adult learner. Adult learners link LINE themselves and are treated like the parent fields.
• Parents: how they wish to be addressed, relationship to the student, mobile number (entered by the Tutor or during online sign-up), and LINE userId (see section 3).
• Lesson records: timetable, lessons and attendance, leave requests and the rule decision at the time, make-up vouchers, and the lesson ledger.
• Payment records: lesson packages, payment requests, payment method and result, bank transfer reports (last five digits of the account, amount, transfer date, optional screenshot), and receipts. The Platform never handles card numbers; card, ATM and convenience-store payment data are processed by the Tutor's own payment provider.
• Online sign-up / trial class: student name, grade, how the parent wishes to be addressed (or the student, for adult learners), phone number and message; to prevent abuse we also store an irreversible hash of the IP address.
• Tutor accounts: email, sign-in method (Google, LINE, or email and password), display name, subject, plan and subscription records. With email and password, Supabase stores only an irreversible hash of the password; we cannot read it. When you sign in with LINE, we obtain your display name, profile picture and email from LINE with your consent; the email is used to create your account and send account notices. Tutors' payment provider keys, bank accounts and LINE Official Account keys are stored encrypted, decrypted only by the server when needed, with access logged; bank accounts show only their last five digits on screen.

3. How LINE userIds are used

A LINE userId differs by provider, so the same parent has two in 課包:

• The userId on the Tutor's Official Account: obtained when a parent adds the Tutor's Official Account as a friend, and used only for that Tutor's Official Account to reply with or push notices such as leave results, renewals, payments and lesson reminders.
• The userId on the 課包 LIFF app: obtained when a parent opens a 課包 page inside LINE, and used only to verify identity so that parents see only the data of the students linked to them.

LINE userIds are not used for advertising or marketing, are not given to other Tutors, and do not appear in data exported by Tutors. Messages are sent from the Tutor's own Official Account, and the Tutor pays LINE directly for messaging.

4. Purposes and scope of use

Arranging lessons and lesson reminders, deciding leave and lesson deductions under the Tutor's rules, renewal and payment notices, bank transfer reconciliation, issuing receipts, answering support questions, and keeping the system secure and preventing abuse. Data is used in Taiwan and in the locations of the service providers listed in section 5, for the periods set out in section 6. We do not sell personal data, and we do not use parent or student data for the Platform's own marketing.

5. Service providers we use

• Supabase (database, file storage and sign-in) and Zeabur (hosting): storing and running the service.
• LINE (Messaging API, LINE Login, LIFF): sending notices and verifying parents' identity.
• ECPay and NewebPay: the Tutor's own payment stores, which process parents' payments; the subscription fee the Platform charges Tutors is processed by Creem.
• Creem: the merchant of record for the Platform's subscription fees, which processes Tutors' card payments, tax and receipts; the Platform never stores Tutors' card numbers.
• Google reCAPTCHA: preventing abuse of online sign-up. Sentry: error monitoring. Google Analytics: on the public pages of our website (home, features, pricing, who it's for, guides, etc.) it uses cookies to measure anonymous browsing statistics so we can improve the website; it is not loaded in the Tutor dashboard, parents' LINE pages or Tutors' enrolment pages, and you can refuse it through your browser settings or the opt-out add-on provided by Google. Meta Pixel and ad measurement: the same public pages also load the Meta Pixel to measure our ads; when a Tutor signs up, starts a subscription or completes a payment, we send that event with the ad click identifier and a hashed (SHA-256) email to Google and Meta to measure ad conversions. No student or parent data is sent. Email and SMS providers (when enabled by the Tutor): sending system notices.

These providers may process data only as far as needed to provide their services.

6. Retention periods

• While the Tutor's account exists, data is kept until the Tutor deletes the record or deletes the account.
• Bank transfer screenshots are deleted automatically after 6 months; reconciliation results such as the reported last five digits and amount remain in the payment records.
• Online sign-up data is kept for the period stated on the sign-up form, or until the Tutor deletes it.
• When a Tutor deletes their account, all student, parent, lesson and payment data, transfer screenshots and avatars are deleted immediately, leaving only a deletion record without personal data (time and number of records); copies in system backups are overwritten when the backup cycle ends.

7. Your rights: access, export, correction and deletion

Under Article 3 of the Personal Data Protection Act (PDPA) of Taiwan, you may request to inquire about, review, or obtain copies of your personal data, to supplement or correct it, to stop its collection, processing or use, or to delete it.

• Parents: in LINE, open the "Contact tutor" page and choose "Unlink / delete my data" to immediately delete your LINE link, how you are addressed and your phone number (for one tutor or for all tutors). Students' lesson and payment records are kept by the Tutor; please ask the Tutor directly to correct or delete them. The Tutor can permanently delete all of that student's data in the system.
• Tutors: in "Settings › Data export and deletion" you can download all your data (as a JSON file) or permanently delete your account; individual students can be permanently deleted on the student edit page.

Without the necessary data (for example, the student's name), scheduling and payment features cannot be used.

8. Security measures

Data is isolated per Tutor account (database row-level security), and finance members can access only payment and reconciliation data; all connections are encrypted; keys and bank accounts are stored with envelope encryption; transfer screenshots are kept in private storage and shown to that Tutor and their finance staff only through short-lived links.

9. Changes to this policy

When this policy changes, we update the date on this page, and major changes are announced in the Tutor dashboard. For the rules on using the service, see the Terms of Service.