Privacy Policy

Last updated: 2026-04-09

MyNannyTutor ("we", "us", "our") operates the MyNannyTutor platform, an AI-powered homework tutoring service for children. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our Service.

For information specifically about how we handle children's data, please also read our Children's Privacy Policy.

1. Who We Are

MyNannyTutor is operated from Hong Kong SAR. We are the data controller responsible for your personal data.

Contact: privacy@mynannytutor.com

2. What Data We Collect

2.1 Account Information (Parents and Teachers)

• Registration data: username, email address, password (stored as a secure hash, never in plain text), account role (parent/teacher), preferred language.
• Profile data: name, salutation, country, subjects taught (teachers only).
• Authentication data: login timestamps, session tokens, Google OAuth identifiers (if you sign in with Google).

2.2 Child Account Information

When a parent creates a child profile, we collect the child's display name, age/grade level, and learning preferences. For full details on child data, see our Children's Privacy Policy.

2.3 Usage and Interaction Data

• Session data: tutoring session logs, questions asked, answers given, response times, hints provided, pedagogical strategy employed, session duration, active engagement time, interaction frequency, and session outcome metrics.
• Homework photos: images uploaded for OCR processing and AI analysis, including extracted text, question content, and problem metadata.
• Academic and performance data: per-question attempt history, accuracy rates, concept mastery scores and trajectories, mistake classifications, learning velocity, skill progression over time, and comparative performance indicators.
• Behavioural and engagement data: session timing patterns, engagement metrics, help escalation levels, work-break patterns, feature usage, and interaction patterns with the gamification system (including points, badges, streaks, rewards, team participation, and challenge performance).
• Voice and audio data: real-time voice interactions during tutoring sessions are processed for speech-to-text conversion. Audio may be temporarily processed for quality assurance, content safety, and service improvement purposes.
• Board and visual interaction data: handwriting strokes, drawn solutions, visual problem-solving steps, and board interaction patterns captured during tutoring sessions.
• Technical data: browser type, device type, IP address, operating system, referral URLs, and access timestamps.

2.4 Payment Data

Payment processing is handled by Stripe. We do not store your full credit card number, CVV, or bank account details. We receive only a transaction reference, payment status, and the last four digits of your card for display purposes.

3. How We Use Your Data

3.1 Service Delivery

3.2 Service Improvement, Research, and Technology Development

In addition to direct service delivery, we process personal data and derived usage data for the following purposes, pursuant to our legitimate interests in improving the Service, advancing educational technology, and developing our underlying intellectual property:

• Artificial intelligence and machine learning development: We use interaction data, session transcripts, pedagogical outcomes, learner response patterns, and content performance metrics to train, validate, fine-tune, calibrate, and improve machine learning models, artificial intelligence systems, natural language processing capabilities, speech and voice processing systems, and automated pedagogical decision-making algorithms that underpin the Service. This includes, without limitation, the development of adaptive learning models, content difficulty estimation systems, learner engagement prediction models, hint and instructional strategy optimisation systems, and curriculum-aligned teaching models.
• Derived analytics and computational features: We derive, compute, and maintain statistical features, aggregated metrics, performance indicators, behavioural profiles, learning velocity measurements, attention modelling parameters, and other computed attributes from raw interaction data for the purpose of powering personalisation, benchmarking, and analytical capabilities within the Service.
• Comparative and cohort analysis: We conduct longitudinal, cross-sectional, and cohort-based analysis of anonymised and aggregated learner data — including academic performance, engagement patterns, pedagogical strategy effectiveness, and curriculum progression — across demographic dimensions such as geography, grade level, curriculum framework, and subject area, for the purpose of producing educational insights, benchmarks, and quality assessments.
• Content and curriculum analysis: We analyse homework content, problem characteristics, learner interaction data, and outcome metrics to empirically assess content difficulty, identify prerequisite knowledge structures, evaluate curriculum sequencing effectiveness, and develop automated educational content generation capabilities.
• Internal research and development: We conduct ongoing internal research into educational methodology, learner behaviour, pedagogical effectiveness, human-computer interaction in educational settings, bilingual and multilingual learning patterns, and child engagement dynamics, using data collected through the Service.

3.3 Anonymised and Aggregated Data

We may create, derive, and utilise anonymised, de-identified, and aggregated datasets from the personal data and usage data collected through the Service. Such anonymised and aggregated data does not, and cannot reasonably be used to, identify any individual user or child. We may use, process, commercialise, license, publish, distribute, and otherwise exploit anonymised and aggregated data without restriction for any lawful purpose, including but not limited to:

• Development and commercialisation of educational analytics products, benchmark reports, curriculum effectiveness assessments, and difficulty indices.
• Publication of research findings, educational insights, and statistical analyses in academic, professional, or commercial contexts.
• Licensing of aggregated educational datasets, performance benchmarks, and analytical outputs to third parties, including educational institutions, curriculum developers, textbook publishers, governmental education agencies, and other commercial entities.
• Training, development, and improvement of proprietary and third-party machine learning models, artificial intelligence systems, and educational technology platforms.
• Production of publicly available or commercially distributed educational resources, problem databases, and pedagogical tools.

For the purposes of this Section 3.3, "anonymised" means that all personally identifiable information — including but not limited to names, account identifiers, device identifiers, and any combination of attributes that could reasonably be used to re-identify an individual — has been irreversibly removed or replaced with non-reversible pseudonymous identifiers prior to processing. We apply industry-standard anonymisation techniques including, where appropriate, k-anonymity thresholds, statistical noise injection, and minimum cohort size requirements to mitigate re-identification risk.

4. Who We Share Data With

We do not sell personally identifiable data of individual users. We may share data with the following categories of recipients:

• AI and technology service providers: We utilise third-party artificial intelligence infrastructure providers, including Alibaba Cloud (DashScope), for natural language processing, voice synthesis, speech recognition, and machine learning model training and inference. Interaction data, session content, and learner inputs may be transmitted to these providers for processing in accordance with applicable data processing agreements.
• Cloud infrastructure and hosting providers: Our servers, databases, and computational infrastructure are hosted on third-party cloud platforms. These providers process data in accordance with their security and data processing obligations.
• Payment processor: Stripe processes all payment transactions on our behalf.
• Email and communications services: We use third-party services to deliver transactional, verification, and notification communications.
• Analytics and research partners: We may share anonymised, de-identified, and aggregated data (as described in Section 3.3) with research institutions, educational organisations, commercial partners, and other third parties for the purposes described therein.
• Model training infrastructure: Anonymised and de-identified training data may be processed on specialised machine learning infrastructure, including GPU compute providers, for the purpose of training, validating, and deploying artificial intelligence models.
• Affiliated entities: We may share data with our parent company, subsidiaries, affiliates, or successors-in-interest in connection with a corporate restructuring, merger, acquisition, asset sale, or similar transaction, subject to the receiving entity assuming the obligations of this Privacy Policy.
• Legal and regulatory authorities: We may disclose data where required by applicable law, regulation, legal process, court order, or governmental request, or where we reasonably believe disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of our users or the public.

5. Data Transfers

Our Service is operated from Hong Kong SAR. If you access the Service from outside Hong Kong, your data may be transferred to and processed in Hong Kong. Some of our service providers may process data in other jurisdictions. Where data is transferred internationally, we take appropriate measures to ensure your data is protected in accordance with this Privacy Policy and applicable laws.

6. Data Retention

• Account data: Retained for as long as your account is active. After account deletion, personally identifiable data is permanently removed within 30 days, subject to any legal retention requirements.
• Tutoring session data: Retained for as long as your account is active to enable progress tracking and session reports.
• Homework photos: Processed photos are retained for session reference. You may request deletion at any time.
• Payment records: Retained for 7 years as required by financial regulations.
• Child data: Subject to the retention policies described in our Children's Privacy Policy.
• Derived and anonymised data: Anonymised, de-identified, and aggregated datasets, computed features, statistical models, trained machine learning parameters, and analytical outputs derived from personal data during the period of your use of the Service are retained indefinitely and survive account deletion. Because such data cannot be used to identify any individual, it is not subject to deletion requests. Machine learning models and artificial intelligence systems that have been trained or improved using anonymised data retain their learned parameters and are not subject to reversal or unlearning upon individual account deletion.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention requirements).
• Data portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing of your data based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@mynannytutor.com. We will respond within 40 days in accordance with the Hong Kong Personal Data (Privacy) Ordinance.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Passwords are hashed using bcrypt (never stored in plain text).
• All data in transit is encrypted via HTTPS/TLS.
• Authentication uses secure, httpOnly cookies with short-lived access tokens.
• Rate limiting and account lockout protection against brute-force attacks.
• Role-based access controls ensure users can only access their own data.
• Child accounts are isolated and accessible only through the parent's account.

While we strive to protect your data, no method of transmission or storage is 100% secure. If you become aware of a security vulnerability, please contact us immediately.

9. Cookies and Tracking

We use the following types of cookies:

• Essential cookies: Required for authentication and core functionality (auth tokens, session state). These cannot be disabled.
• Functional cookies: Remember your preferences (language, theme). These enhance your experience but are not strictly necessary.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not build advertising profiles or share browsing data with advertisers.

10. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the Service. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Governing Law

This Privacy Policy is governed by the laws of the Hong Kong Special Administrative Region, including the Personal Data (Privacy) Ordinance (Cap. 486).

13. Contact Us

For privacy-related inquiries or to exercise your data rights:

• Email: privacy@mynannytutor.com
• General: support@mynannytutor.com