AI Tutor

GDPR overview

There is no mention of the GDPR anywhere on the site. Across every page and document collected, the words GDPR, data processing agreement, sub-processor and CCPA do not appear once. No EU representative under Article 27 is designated and no Data Protection Officer is named. The compliance framework is entirely American: a FERPA declaration stating that AI Tutor holds no student education records, and a DIIT declaration covering the New York City Department of Education vendor process, including a security questionnaire reviewed through Panorays. Users are offered data access and account deletion through Settings, fulfilled within 24 to 48 hours, and a Privacy Officer is reachable by email and phone. The privacy policy, last updated 31 March 2023, warns that data may be transferred outside the user's jurisdiction to countries with different protection laws.

Who owns the data?

The terms state that you keep ownership of whatever you post or upload. That ownership is heavily qualified by the licence you grant in return: non-exclusive, transferable, sub-licensable, royalty-free and worldwide, covering use, copying, modification, derivative works, distribution, public display and exploitation in any manner, in all formats and channels now known or later devised, including on third-party sites, without further notice, consent or payment. Everything the platform itself provides belongs to the publisher or its licensors. The compliance declaration narrows the practical stakes: only a name and an email address are said to be collected and stored.

Reuse rights

Users may reuse their own content freely: ownership is expressly retained, and nothing in the terms makes the publisher's permission a condition of reusing what you uploaded or what a model produced for you. The restriction runs the other way. Use of the service itself is contractually limited to personal and educational purposes, and platform content such as text, graphics, logos, images and software may not be reproduced, modified or redistributed without prior written consent. In practice you keep your material while granting the publisher a broad parallel right to exploit it, and you may not repackage the service.

Data retention & training

Hosting summary

No hosting country or region is published, and no jurisdiction is named for data storage. What the compliance declaration does disclose is the technology stack: Next.js, Firebase, Supabase, MongoDB and Python. Each database is described with its protections. Firebase relies on Google Cloud encryption, with AES-256 at rest and TLS in transit, Firebase Security Rules and Firebase Authentication. Supabase is configured with Row Level Security policies, TLS in transit, AES-256 at rest and multi-factor authentication. MongoDB uses Field Level Encryption, role-based access control and operation auditing. The publisher states that its cloud infrastructure undergoes regular security assessments, that the Department of Education cloud review has been completed, and that patches are kept current. No formal sub-processor list is published. The front-end IP resolves in the United States but is flagged as anycast, so it indicates a content delivery network rather than a storage location. The privacy policy adds that data may be transferred outside the user's jurisdiction.