Privacy Policy

1. Who we are

StudyRoster is a tutoring management service operated by Tabb Labs LLC based in North Carolina, USA, at studyroster.com. This policy explains what personal information we collect from you, how we use it, and your rights with respect to that information.

2. What we collect

• Account data: the email address, name, and timezone you provide at signup.
• Payment information: handled entirely by Stripe. We never see or store your card numbers; we store only Stripe identifiers, such as a customer and subscription reference and, if you enable online invoice payments, a reference to your connected Stripe account.
• Student and session data: information you enter about your students, sessions, and notes.
• Parent contact information: parent names, emails, and phone numbers you enter so that we can send session reminders.

3. How we use it

We use the information you provide to:

• Operate the service (calendar, students, invoices, notes)
• Send session reminders to the parent contacts you enter
• Send you push notifications about your own schedule, if you opt in
• Generate and deliver invoices and collect online payments
• Communicate with you about your account and the service
• Protect the service from abuse (for example, a bot check at signup)

4. Sharing and subprocessors

We never sell your data to anyone. We use a small set of trusted service providers strictly to run StudyRoster, and we share data with them only as needed to operate the service. Your data is never sent to any advertising network, data broker, or AI service.

• Stripe: payment processing
• Resend: transactional email (session reminders, invoice delivery)
• Cloudflare R2: invoice PDF storage
• Cloudflare Turnstile: the bot check that protects signup from automated abuse
• Cloudflare Web Analytics: aggregate traffic and page-performance measurement. It is cookieless: it sets no cookie and stores no identifier on your device, and it is not used to build a profile of you or to advertise to you.
• Google: sign-in (we receive your email and profile only when you sign in with Google)
• Web push services (Apple, Google, Mozilla): deliver the reminder notifications you opt into, to your own device
• Self-managed infrastructure: the application and its database run on our own self-managed servers, reached securely through Cloudflare. We do not use a third-party cloud database or compute host.

5. Your rights (GDPR / CCPA)

Subject to applicable law, you have the right to access, correct, delete, and request portability of your personal data. To exercise any of these rights, email [email protected].

6. Deleting your account

You can delete your account at any time from Settings, or by emailing [email protected]. Deletion is permanent and cannot be undone.

What is erased: the personal data held in the account is overwritten and cannot be recovered. That includes your name, email address, password and any linked Google or Apple sign-in; your students' names, grade levels, subjects, parent names, parent email addresses and phone numbers, the addresses used as lesson locations, and the notes written about them; your invoice line-item descriptions and package names; the invoice PDF files held in our file storage; and every parent share link, session note link, payment link and pending invitation, all of which stop working immediately. Your subscription is cancelled and the account can no longer be used to sign in.

What is retained, and why: we keep the financial record of the account for legal, tax, accounting and dispute-resolution purposes, as permitted by GDPR Art. 17(3)(b) and (e). Those rows are kept and the personal data on them is erased, so what survives is the money and the timeline: invoice, session, payment and expense amounts, dates, statuses, and the relationships between them.

An important limit on that retention: the retained financial records still carry the identifiers issued by our payment processor, Stripe, because those identifiers are what make a refund, a chargeback response or a tax reconciliation possible. Stripe holds its own copy of the customer, payment and, for tutors who accept online payments, identity verification records associated with those identifiers, and retains them under its own legal obligations regardless of what we delete. Someone with access to our payment processor could therefore link a retained record back to a person. We state this plainly rather than implying that a retained record can no longer be traced to anyone.

Other copies: emails we have already delivered (reminders and invoices sent to parents) remain in the sending records held by our email provider under its own retention schedule. We also take periodic backups of our database for disaster recovery. Deletion removes the data from the live service immediately; backup copies are replaced as newer backups are taken, and we do not restore a backup in order to recover deleted personal data.

7. Cookies

We use only essential authentication and CSRF cookies. We do not use advertising or tracking cookies.

8. Contact

For privacy questions, email [email protected].

9. Changes to this policy

If we make material changes to this policy, we will notify you by email at least 30 days before they take effect.