Privacy Policy

YourFavTeacher operates an educational discovery and platform service that connects students, parents, tutors, and educational businesses, and provides supporting digital tools such as messaging, requests, profiles, educational materials, and AI-assisted features.

For the purposes of applicable data protection law, YourFavTeacher is generally the controller of the personal data processed to operate the platform, except where another party independently determines the purposes and means of processing for its own activity.

The controller can be contacted for privacy matters at support@yourfavteacher.gr. If additional registered-business contact details become applicable, they will be added to this notice without delay.

• Account data: email address, authentication identifiers, account role, provider metadata, and account status information.
• Profile data: name, public-facing identity, biography, subjects, levels, languages, teaching modes, pricing, availability, location, service areas, trust indicators, and uploaded profile media.
• Communications data: messages, contact workflow events, tutor proposals, request submissions, support contacts, and moderation-related communications.
• Content data: lesson requests, tutoring materials, notes, files, profile photos, images, descriptions, and any other content uploaded or published through the platform.
• Billing and transaction data: subscription state, plan status, invoices, credit events, billing customer identifiers, and payment event metadata where billing is enabled.
• Technical and usage data: IP address, browser/device information, logs, cookies or similar technologies, page views, interaction events, and approximate location inferred from technical data.
• Safety and moderation data: verification submissions, review decisions, automated safety outcomes, moderation notes, and abuse-prevention signals.

• Directly from you when you register, log in, edit your profile, publish content, upload files, contact support, or otherwise use the platform.
• Automatically from your device and browser when you use the website or app features.
• From integrated service providers such as authentication, storage, analytics, payment, messaging, or email systems.
• From other users where your interaction on the platform necessarily creates shared records, such as messages, requests, reviews, reports, or moderation escalations.

• To provide and maintain the service, including accounts, profiles, discovery, search, filters, public pages, requests, messaging, and educational content workflows.
• To personalise the platform, including language, recommendations, role-specific dashboard behaviour, and discovery surfaces.
• To moderate content, review safety issues, prevent fraud, detect abuse, and enforce platform rules.
• To manage subscriptions, plans, credits, manual beta grants, support, operational communications, and account administration.
• To improve product quality, analytics, performance, reliability, and platform security.
• To comply with legal obligations, resolve disputes, respond to lawful requests, and protect users, the platform, and third parties.

Where GDPR or equivalent law applies, we rely on one or more of the following legal bases: performance of a contract or pre-contractual steps, consent where specifically requested, legitimate interests such as safety, fraud prevention, moderation, product improvement, and platform integrity, and compliance with legal obligations.

Where processing relies on legitimate interests, we aim to balance those interests against the rights and freedoms of users and to apply safeguards appropriate to the nature of the data and the service.

Some information is private by default, while some information is public by design. Public tutor and business profiles may display identity, headline, biography, subjects, prices, locations, service areas, languages, badges, ratings, profile media, and related public profile information.

Private or restricted information may include account credentials, hidden moderation data, internal review notes, payment metadata, contact details that are not yet unlocked, and content that has not been approved or published.

• Service providers and processors: core providers may include Vercel for hosting and consent-based performance analytics, Supabase for database/authentication/storage, Cloudflare for anti-abuse checks, OpenAI for enabled AI and moderation functions, email infrastructure for transactional messages and support, LiveKit for enabled online-classroom functions, and Stripe where billing is enabled.
• Other users: where platform design requires visibility, such as public tutor profiles, visible requests, or message threads between participants.
• Professional advisers: lawyers, accountants, auditors, insurers, and other advisers where reasonably necessary.
• Authorities or third parties: where required by law, court order, legal process, fraud prevention, safety obligations, or protection of rights.
• Business transitions: where necessary in connection with restructuring, sale, merger, financing, or acquisition, subject to appropriate safeguards.

We may use automated systems and AI-assisted tools to assess profile photos, files, materials, safety risks, content policy issues, fraud indicators, and abuse signals. These systems may support moderation, ranking, publishing decisions, or internal review workflows.

Automated systems can be imperfect. Final actions may be supplemented by human review, and some decisions may be reconsidered following internal review or a support request.

We do not intend to make a decision producing legal or similarly significant effects solely through automated processing. You may request human review of a material moderation or verification outcome by contacting support.

We use cookies, local storage, session tokens, and similar technologies for essential functionality such as authentication, account persistence, security, and user preferences. We may also use privacy-aware analytics and performance measurement tools to understand usage patterns and improve the platform.

Blocking or restricting cookies may affect platform functionality. Where consent is required for non-essential technologies, we aim to handle those technologies accordingly.

We retain personal data for as long as reasonably necessary to provide the service, maintain platform records, resolve disputes, enforce our rules, comply with legal obligations, and protect the platform and its users.

Retention periods may differ by data type. For example, account data, moderation records, billing records, and legal compliance records may be retained longer than routine browsing or transient technical logs. Some data may remain in backups or archived systems for a limited period after deletion requests, subject to applicable safeguards.

Signed-in activity-session telemetry is designed to redact IP, user-agent, device, and path details after 30 days and delete those session rows after 180 days. Other security, moderation, transaction, and communication records follow necessity, fraud-prevention, dispute, and legal-retention criteria.

Our providers or infrastructure may process data outside Greece or the EEA. Where required, transfers rely on an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary safeguards where appropriate. You may contact us for information about the applicable safeguard.

We use technical and organisational measures designed to protect personal data, including role-based access controls, transport security, logging, restricted operational access, and other reasonable safeguards appropriate to the nature of the platform.

No internet or storage system is perfectly secure, so we cannot guarantee absolute security. Users should also take reasonable steps to protect their accounts and devices.

• The right to request access to personal data we hold about you.
• The right to request correction of inaccurate or incomplete data.
• The right to request deletion in certain circumstances.
• The right to object to certain processing or request restriction of processing where applicable.
• The right to data portability where applicable.
• The right to withdraw consent where processing is based on consent.
• The right to lodge a complaint with a competent supervisory authority.
• The right to request human intervention where Article 22 GDPR applies to a solely automated decision with legal or similarly significant effects.

The platform may be used in educational contexts involving minors, but parents and legal guardians remain responsible for supervising minors and for decisions relating to account use, bookings, communications, lessons, and disclosure of personal data. Where consent is the legal basis for an information-society service offered directly to a child in Greece, a user below 15 requires consent or authorisation from the holder of parental responsibility.

If you believe that personal data of a child has been used in a way that is unlawful or inappropriate, contact us promptly.

The platform may integrate or link to third-party services, websites, or tools. Their privacy practices are governed by their own policies, and we are not responsible for how those third parties independently process data.

We may update this Privacy Policy from time to time to reflect legal, operational, or product changes. Where appropriate, we may notify users through the platform, by email, or by another reasonable method.

For privacy rights requests, data protection questions, or related support, contact support@yourfavteacher.gr. We normally respond to valid rights requests within one month, subject to the extensions and exceptions permitted by law.

You may also lodge a complaint with the Hellenic Data Protection Authority at https://www.dpa.gr if you believe your data-protection rights have been infringed.