Privacy Policy

This privacy notice for TutorVault, operated by Pounding Water ('we', 'us', or 'our'), describes how and why we collect, store, use, and protect your information when you use our AI-powered educational tutoring platform ('Services').

Questions or concerns? Contact us at [email protected].

1. What Data We Collect

Account Information

• For B2B institutional accounts: institution name, administrator name, email, phone number
• For B2B student accounts: student name, school-assigned roll number, activation PIN (no email required)
• For B2C individual accounts: name, email address

Uploaded Educational Materials

• Textbooks, syllabi, lecture notes, and book screenshots uploaded by teachers or individual users
• OCR-processed text extracted from uploaded images
• Vector embeddings generated from processed materials

Usage Data

• Questions asked to the AI tutor and responses generated
• Session duration and feature usage analytics
• Device information, browser type, and IP address

2. How We Use Your Data

• AI Tutoring: Your uploaded materials are used exclusively to generate curriculum-locked AI responses for your institution or personal account. Materials are never used to train external AI models.
• Service Delivery: Account information is used to authenticate users, manage subscriptions, and deliver the tutoring platform.
• Analytics: Aggregated, anonymized usage data helps us improve the platform. Individual student interactions are never shared with third parties.
• Communication: Contact information is used for support, billing, and important service updates.

3. Data Isolation & Multi-Tenant Security

TutorVault implements strict multi-tenant data isolation:

• Schema-per-tenant architecture: Each institution's data (materials, student records, chat history) lives in an isolated database schema. There is zero cross-tenant data access.
• Vector store isolation: Embeddings and vector indexes are partitioned per institution. One school's materials can never appear in another school's AI responses.
• No shared training: Your data is never used to improve AI responses for other institutions or to fine-tune public models.

4. Third-Party Services

We use the following third-party AI inference providers:

• Groq: Zero Data Retention (ZDR) policy — your prompts and responses are not stored or used for training.
• Together.ai: Zero Data Retention (ZDR) policy — input data is processed and immediately discarded.
• Local Ollama inference: For standard queries, AI processing happens entirely on our infrastructure with no external data transmission.

We do not sell, rent, or share your personal information or educational data with any third party for marketing or advertising purposes.

5. Student Privacy

• No student email required: B2B student accounts use institution-assigned School ID + Roll Number + Activation PIN. No personal email collection from minors.
• FERPA considerations: We act as a "school official" under institutional contracts, processing student education records solely for the institution's legitimate educational purposes.
• Minimal data collection: We collect only the data necessary to provide the tutoring service. No behavioral profiling, no ad targeting, no social features.
• Parental/institutional control: Institutions control what materials are available and can deactivate student accounts at any time.

6. Data Retention & Deletion

• Active account data is retained for the duration of the subscription.
• Upon contract termination, institutional data (materials, student records, chat history) is deleted within 30 days.
• B2C users can request data deletion at any time by contacting [email protected].
• Anonymized, aggregated analytics may be retained for service improvement.

7. Data Security

• All data in transit is encrypted via TLS 1.3.
• Data at rest is encrypted using industry-standard AES-256 encryption.
• Database access is restricted to authorized personnel with role-based access controls.
• Regular security audits and vulnerability assessments are conducted.
• Infrastructure is hosted on secure servers with SOC 2 compliant hosting providers.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Request deletion of your personal information
• Object to or restrict processing of your data
• Data portability (receive your data in a structured format)

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

9. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email to account administrators or posted prominently on our platform. Continued use of the Services after changes constitutes acceptance of the updated policy.

10. Contact Us

For privacy-related inquiries:

TutorVault (operated by Pounding Water)
Email: [email protected]
Phone: +9779861523737
Kathmandu, Nepal