Privacy Policy

The data controller is Ibex. Questions, access requests, or complaints: hello@byigit.dev.

Students under 18 do not hold accounts, cannot log in, and cannot be contacted directly through the platform outside of a confirmed lesson's logistics. All student data (name, birth year, school, curriculum, learning notes) is entered and controlled by the parent or legal guardian's account and is visible only to that guardian, the specific tutor assigned to a confirmed lesson, and Ibex staff for safeguarding or support purposes. A tutor sees a student's first name and relevant academic context only once a booking is confirmed with that tutor — never before, and never for bookings involving other tutors.

• Guardian accounts: name, email, password (stored hashed, never in plain text), preferred language.
• Student records: name, birth year, school, curriculum, and any notes the guardian chooses to add — entered by the guardian, never by the student.
• Tutor accounts: name (or the public display name a tutor chooses), email, subjects taught, rates, self-reported education and experience, and a bio the tutor writes themselves.
• Booking and lesson data: requested and confirmed lesson times, subjects, messages exchanged as part of a request, and the rate agreed at booking time.
• Billing data: invoices and payment status. Ibex does not store full card numbers; payment processing (once enabled) is handled by a third-party payment provider under its own security standards.
• An audit log of account and booking state changes (who approved, forwarded, accepted, or cancelled what, and when) — kept for dispute resolution, fraud prevention, and safeguarding review. This log cannot be edited or deleted, including by Ibex staff.

Processing guardian, student, and tutor data is necessary to perform the tutoring-booking contract you enter into by using Ibex (GDPR Art. 6(1)(b) / KVKK Art. 5). Safeguarding-related processing (the audit log, tutor review) is based on our legitimate interest in protecting minors on the platform (GDPR Art. 6(1)(f)), balanced against your rights. Where we are not relying on contract or legitimate interest, we ask for explicit consent (GDPR Art. 6(1)(a) / KVKK Art. 5/2).

We do not sell personal data. Data is shared only with: (a) the specific tutor or guardian counterpart in a confirmed booking, limited to what that booking requires; (b) infrastructure providers who process data on our behalf under contract — currently Supabase (database and authentication, hosted in Frankfurt, Germany) and Resend (transactional email delivery); (c) a payment provider, once online payment is enabled, for processing transactions only; (d) authorities, if legally required to do so.

Guardian, student, tutor, and booking data is stored in Supabase's Frankfurt (Germany) data center. Nightly encrypted backups are retained on our own server for 14 days for disaster recovery only, and are not used for any other purpose.

Account and booking data is kept for as long as the account is active, plus a limited period afterward to meet invoicing and tax record-keeping obligations (typically up to 10 years for financial records, as required by German and Turkish law). Audit log entries are retained indefinitely as an immutable record. You can request deletion of your account's personal data at any time; financial records that must be retained by law will be retained in de-identified form where possible.

Under GDPR and/or KVKK, you can ask us to:

• show you what data we hold about you (access);
• correct inaccurate data (rectification);
• delete your data, subject to legal retention requirements (erasure);
• give you your data in a portable format, or restrict or object to certain processing.

To exercise any of these, email hello@byigit.dev. We will respond within one month. If you are unsatisfied with our response, you may complain to your local data protection authority (in Germany, your state's Datenschutzbeauftragte; in Turkey, the Kişisel Verileri Koruma Kurumu — KVKK Kurumu).

Ibex uses only the cookies strictly necessary to keep you signed in and to remember your language preference. We do not use advertising or third-party tracking cookies.

If we materially change how we handle your data, we will notify registered accounts by email before the change takes effect.