Privacy policy

Draft version 2026-11-draft. This draft is being reviewed by a lawyer before CLG works with families outside Australia.

• CLG keeps your name, school, year level and notes about your learning, so your tutor can help you.
• Your parent or carer usually gives us this information and agrees for you. We ask them again every year.
• Only you, your parent or carer, your tutor and a few CLG staff can see it.
• We never sell it, never use it for ads and never share it to make money.
• You can ask us to show you, fix or delete it. Ask your parent or carer, or email us.
• If something worries you, tell a parent, a teacher or CLG. You can also call Kids Helpline on 1800 55 1800.

CLG Tutoring (Confidently Learn Grow), South Australia. CLG's privacy officer is the owner, Carla. Contact her through Your privacy in the app. CLG follows the Australian Privacy Act in full, even though small businesses can be exempt.

• Parents and adult learners: name, email, phone, address for in-person sessions, payment arrangements and invoices. To provide and bill for support.
• Students: name, date of birth, state, school, year level, subjects, goals, session notes, progress and work samples, and any learning needs you choose to share. To match a suitable tutor and teach well.
• Tutors and staff: contact details, child safety checks and their expiry dates, subjects, availability, pay rates and hours. To meet child safety law and pay staff.
• Security records: sign-in times, failed sign-ins and an activity log of who changed what (not the content). To keep accounts safe and investigate problems.
• Location: only tutors, only when signing on to an in-person session, asked each time. Only the result (at the session or not) is kept. Students' location is never tracked.

The legal reasons: to carry out our agreement with you, to meet legal duties (such as child safety, tax and pay law), and your consent (for children's information and for news emails). Where a parent gives us a child's information, we tell the child through this notice and through their parent.

• Sell or rent information, or use it for advertising or profiling.
• Send news or offers unless you turn them on in Your privacy. Session, invoice and safety messages always come.
• Let tutors see students they don't teach, or parents see other families.
• Let tutors and children message each other privately. Contact goes through CLG and the family.

• Pausing support when a payment is overdue. The app pauses a family's sessions when Stripe reports an overdue payment, and restarts them when it is paid. CLG staff can review and override a pause: ask through Your privacy or contact CLG.
• Suggesting tutors. The app lists tutors who hold the right child safety checks, subjects and times. A CLG staff member always makes the final match.
• Deleting old records on the timetable below.

The app's information is stored in Sydney, Australia, encrypted while stored and while travelling. Some services CLG uses are based overseas. Each has a contract that requires it to protect the information.

• Supabase: Stores the app's information and files. Sydney, Australia.
• Vercel: Runs the app's web pages. Sydney, Australia (company in the United States).
• Resend: Sends the app's emails (your email address and the short message only). United States.
• Stripe: Takes payments (card or bank details go straight to Stripe; CLG never sees them). Australia and the United States.
• Xero: Invoices and accounts (names, emails, invoice lines). Australia, New Zealand and the United States.
• Microsoft 365: Teams links for online sessions, and CLG's email. Australia.

For families in the UK or EU, information sent outside those places is protected by the services' standard contract clauses. CLG will tell you before any new overseas service is used for your information.

• Student records: 2 years after the last session or enrolment, then deleted automatically.
• Accounts never used: 12 months after the last sign-in.
• Invoices and payment records: 7 years (tax law).
• Tutor records and child safety checks: 7 years after the tutor leaves.
• The activity log, privacy requests and breach records: 7 years.
• Failed sign-in records: 90 days.

Wherever you live, you can:

• download your information, and your children's, at any time from Your privacy;
• ask to see anything else we hold, and to fix anything that is wrong;
• ask us to delete information (some records must be kept by law, such as invoices);
• object to, or ask us to limit, a use of your information;
• withdraw a consent at any time (this does not undo what was done before);
• complain to CLG, and then to a privacy regulator.

Send any of these through Your privacy. CLG replies within 28 days. If a request is complex we may need longer; we will tell you why before the 28 days end.

If information is lost or seen by someone who shouldn't see it, CLG acts straight away to contain it, decides within 72 hr whether serious harm is likely, and if so tells the people affected and the privacy regulator.

• Australia: Office of the Australian Information Commissioner
• New Zealand: Office of the Privacy Commissioner
• United Kingdom: Information Commissioner's Office
• European Union: the data protection authority in your country
• Canada: Office of the Privacy Commissioner of Canada
• United States: Federal Trade Commission or your state attorney general