Privacy Policy

1Who Is Responsible For Your Data

TMA is operated by Breezy ArtDrop Studios. When a school, academy or tutoring centre uses TMA, the institution decides what information is collected about its students, parents and staff, and why. In data protection terms the institution is the data controller and TMA is the data processor acting on its instructions.

So if you are a parent, student or member of staff, a request about your records should normally go to your institution first. We will always help, and we act directly where the request concerns the platform itself.

We handle personal data in line with the Ghana Data Protection Act, 2012 (Act 843), and apply equivalent standards for institutions and users outside Ghana.

2Information We Collect

What is collected depends on which parts of TMA your institution uses. In full, the platform can hold:

• •Account details — names, email addresses, phone numbers, and the role each person holds.
• •Institution information — name, location, subdomain, branding, and the payment details an institution publishes so families can pay it.
• •Student records — date of birth, gender, home address, nationality, admission number, class and class history, previous school, and notes the school records.
• •Guardian records — names, relationships, phone numbers, email addresses, occupation, and whether a guardian may collect a child.
• •Health information — blood group, allergies, ongoing conditions, medications, doctor and emergency contact details, where the institution chooses to record them.
• •Attendance data — daily registers, arrival and departure times, and lateness.
• •Biometric and card identifiers — where an institution uses gate readers, the identifier its device reports for a person. See the section below.
• •Academic data — lessons studied, quiz and practice answers, scores, assignments, teacher feedback and reports.
• •Financial data — invoices, payments recorded by the institution, discounts, and prepaid wallet balances for transport or feeding.
• •Staff records — job title, department, responsibilities held, attendance, and the daily reports staff file about their own work.
• •Documents — links the institution records to files it stores elsewhere, such as a birth certificate or report card. TMA stores the reference, not the file.
• •Limited technical information — device type, browser and error diagnostics, to keep the platform working.

Payment card and mobile money credentials are never collected or stored by TMA. They are entered directly into Paystack.

3Health And Biometric Information

Health details and biometric identifiers are sensitive, and the platform treats them differently from everything else:

• •Health records are visible only to institution administrators and to the child's own guardians. Teachers cannot see them.
• •TMA does not store fingerprints or fingerprint images. A gate reader keeps its own template; what TMA stores is the reference number that device reports, which is meaningless outside it.
• •Biometric attendance is optional and available only on our highest plan. An institution that does not use gate readers holds none of this data.
• •Institutions are responsible for obtaining any consent required from parents or staff before enrolling a fingerprint or card, and for explaining how it will be used.

If you would rather a child's biometric identifier were not recorded, raise it with the institution — registers can be taken by hand, and the platform fully supports that.

4How We Use Information

Information is used to deliver the service the institution has asked for. Specifically:

• •To run the portals for administrators, teachers, staff, students and parents.
• •To process admissions, place students in classes, and open their accounts.
• •To record attendance, produce registers, and report on them.
• •To raise invoices, record payments, and track what is outstanding.
• •To deliver AI-assisted lessons, practice and tutoring to students.
• •To send notifications about sessions, invoices, announcements and reports.
• •To keep the platform secure, diagnose faults, and prevent abuse.

We do not sell personal information, and we do not use children's data for advertising or profiling. Advertisements shown inside the platform are not targeted using personal information — everyone who sees a given placement sees the same advertisement.

5Artificial Intelligence

TMA uses AI to generate lessons, practice questions, quizzes and tutoring replies.

• •The lesson topic, subject and level, and a student's own messages to the AI tutor, are sent to Anthropic to produce a response. Student names are deliberately excluded from generated lessons.
• •Lesson text may be sent to ElevenLabs to be read aloud, where a student uses that feature.
• •Generated lessons are stored and reused across the platform so the same topic is not paid for twice. They contain no personal information.
• •AI output can be wrong. It supports teaching; it does not replace a teacher, and it should not be the sole basis of instruction or assessment.

6Who We Share Information With

Within your institution, information is shared between connected accounts as the service requires — a parent sees their own child's records, a teacher sees the students they teach, an administrator sees the institution.

Institutions cannot see one another's data. That separation is enforced by the database itself, not only by the interface.

We use the following providers to run the platform. Each sees only what its function requires:

• •Supabase — database and authentication hosting.
• •Vercel — application hosting and delivery.
• •Cloudflare — domain and network protection.
• •Paystack, via Breezy ArtDrop Studios — subscription payments.
• •Anthropic — AI lesson, quiz and tutoring generation.
• •ElevenLabs — text-to-speech, where used.
• •Sentry — error diagnostics, configured to exclude names, contact details, health data, request contents and screen recordings.
• •Resend — transactional email.
• •WhatsApp (Meta) — where an institution chooses to send messages that way.
• •Microsoft Clarity — anonymised usage analytics on our public marketing pages.

We may disclose information where the law requires it, or to protect the safety of a child or another person.

7School Fees And Payments

Subscription payments from institutions to TMA are processed by Paystack under the Breezy ArtDrop Studios merchant account. Card and mobile money details are entered into Paystack's PCI-DSS environment and never reach our servers.

School fees are different. When a parent pays their child's school, that money goes directly to the institution using the institution's own payment details. TMA does not receive, hold or transmit school fees — we record what the institution tells us has been paid.

8How Long We Keep Information

While an institution's subscription is active, its records are kept so the institution has a continuous history — school records are expected to outlast a single term.

• •Rejected and withdrawn admission applications are kept, because institutions are asked to account for admission decisions.
• •Financial records are kept for as long as accounting and tax obligations require.
• •Raw gate-scan events are kept alongside the daily attendance summary, so a disputed record can be checked.
• •If a subscription ends, an institution may request an export of its data. We keep it for 90 days so it can be recovered, then delete it, unless the law requires otherwise.

9Your Rights

You may ask to see the personal information held about you, to have it corrected, or to have it deleted.

• •Students, parents and staff should contact their institution, which controls those records and can correct most of them immediately.
• •Institution administrators — and anyone whose request concerns the platform itself — can contact us using the details below, or through our Account Deletion page.
• •You can object to health or biometric information being recorded. Speak to your institution: the platform works without either.

We respond within 30 days, and we do not charge for a request.

10Children's Privacy

TMA is used by children, and most of the records it holds are about children. Student accounts are created by the institution as part of enrolment, normally with a parent or guardian involved.

• •We collect children's information only to deliver the educational service the institution has asked for.
• •We do not advertise to children on the basis of their personal information, and we do not build marketing profiles.
• •A parent or guardian may ask their institution to see, correct or remove their child's records at any time.
• •Tools that would record what is on a student's screen are switched off across the platform.

11Security

Data is stored on managed cloud infrastructure, encrypted in transit and at rest.

• •Access is enforced at the database level, so a request for another institution's data is refused by the database rather than merely hidden by the interface.
• •Health records, financial records and staff reports are restricted further, to the roles that need them.
• •Gate device keys are stored as one-way hashes and displayed only once, so a stored key cannot be read back and reused.
• •Passwords are stored hashed by our authentication provider. We never see them, and we will never ask you for one.

No system is perfectly secure. If a breach affects your information we will notify the affected institution, and the Data Protection Commission where required, without undue delay.

12Changes To This Policy

We may update this policy as the platform changes. When a change is material — particularly one affecting children's, health or biometric data — we will revise the date above and notify institutions through the platform.

13Contact

For privacy questions or data requests, contact support@tutoringmanager.com. For payment queries you may also contact Paystack at support.paystack.com.

If you are in Ghana and are not satisfied with our response, you may complain to the Data Protection Commission of Ghana.

Questions? Get in touch

For any questions about this privacy policy, reach our team through any of the channels below.