Privacy policy
This policy explains what tutor.fish does with personal information: yours as a business using it, and your customers’ when they book with you. It is written to be read, not to be survived.
Who we are
tutor.fish is operated by Cloud WiFi Limited (13521157), 19 Shanklin Road, London, N8 8TJ. For questions about this policy or your data, contact [email protected].
Two roles matter here, and they are different. For your business account — your name, email, and billing — we are the data controller. For your customers’ booking data, you are the controller and we are your processor: we hold and process it to run your bookings, on your instructions.
What we collect
Your business account: your name, email address, phone number, business name, and the settings you configure (services, hours, staff, tables, areas).
Your customers’ bookings: the name they give, their WhatsApp number and/or email address, the booking itself (date, time, party size or service, any note they add), and the delivery record of each notification we send them.
Technical: server logs including IP address and browser user-agent, kept for security and debugging.
Payments: your subscription status and billing history. Card details are handled entirely by Stripe and never reach our servers.
What we do not collect
We run no third-party analytics and no advertising trackers — no Google Analytics, no Meta pixel, no session recording — on the marketing pages, the booking pages, or the dashboard. The only cookie we set is the session cookie that keeps you logged in.
We do not sell personal information, and we do not share it with anyone for their own marketing.
Why we process it
To provide the service you signed up for (performance of a contract): taking bookings, sending confirmations and reminders, and running your account.
To send transactional messages on your behalf over WhatsApp and email — these are service messages about a specific booking, not marketing.
To keep the service secure, prevent abuse and fraud, and meet our legal and accounting obligations (legitimate interests and legal obligation).
Text messages
Where a booking page offers it, your customer can ask us to text them about their booking. They get a confirmation, a reminder before it, and a note if it changes or is cancelled. Nothing else — we do not send marketing texts, and you cannot send them through us.
How they opt in. The consent box sits on your booking page, unticked, and reads “Yes, send me text (SMS) and WhatsApp messages about this booking from tutor.fish”, with “Booking confirmations, reminders and changes only — up to about 3 messages per booking. Msg & data rates may apply. Reply STOP to cancel, HELP for help. Optional: you can complete your booking without this.” beneath it. Your customer ticks it themselves, and can book perfectly well without it. Consent is given per booking, so it never goes stale, and we never take numbers from a list you upload or from anywhere else.
Who is asking. That consent is collected by tutor.fish on our own booking form — not by you and passed to us. For the text messages specifically we are the controller: we hold the consent, we honour the opt-out, and we answer for it. Your customers’ booking data stays exactly as described above.
Stopping them. Your customer replies STOP and we stop — immediately, and for good on that number until they reply START. HELP returns our contact details. It is enforced before a message is sent, so a text to an opted-out number never leaves, including one you triggered.
How often. Frequency follows the bookings your customer makes: typically up to three messages per booking — the confirmation, the reminder, and a change or cancellation notice if one happens. We do not send anything else.
We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.
Message and data rates may apply. That is between your customer and their mobile carrier; we do not charge them for texts, and carriers are not liable for delayed or undelivered messages. The full programme terms are in our SMS terms.
Who we share it with
Meta Platforms — WhatsApp messages are delivered through the WhatsApp Business Platform, so a recipient’s number and the message content pass through Meta.
Twilio — delivers the text messages, so a recipient’s number and the message content pass through it. No mobile information is shared with third parties or affiliates for marketing or promotional purposes, and text-messaging opt-in data and consent are never shared with anyone.
Our email provider — used to deliver confirmations, reminders and account email.
Stripe — subscription billing and card processing.
Cloudflare and our hosting provider — the service runs on servers in Ireland (AWS eu-west-1) and is fronted by Cloudflare.
Each of these processes data on our instructions under its own contract. We add processors only where the service needs one. The full, current list — what each one does, where it operates, and the safeguard for any transfer — is on our sub-processors page.
Where it is held, and for how long
Data is stored in Ireland (AWS eu-west-1). Where a processor operates outside your country, transfers rely on that provider’s standard contractual clauses or equivalent safeguards.
Booking records are kept while your account is active, because they are your business records. Notification delivery logs are kept so both you and we can prove what was sent to whom. You can export your bookings and your customer list at any time (see below), and we recommend doing so before you close your account. To close your account and have its data deleted or anonymised, email [email protected].
Your rights, and your customers’ rights
Under the GDPR and South Africa’s POPIA you can request access to your personal information, correction, erasure, restriction, portability, or object to processing. To exercise any of these, email [email protected].
If one of your customers asks you to erase their data, you can do it yourself: Dashboard → Settings → Data → “Guest data deletion request”. Enter the email address or WhatsApp number they booked with and choose Anonymise. Their name, phone number and email are irreversibly overwritten across their bookings; the booking itself remains as an anonymous record so your historical reporting stays intact.
You can also export your bookings and customer list as CSV at any time from the same screen.
You have the right to complain to your data-protection regulator — the Information Regulator in South Africa, or your national supervisory authority in the EU/UK.
Security
Traffic is encrypted in transit. Access to production data is limited to the people who operate the service. Every tenant’s data is isolated at the query level, so one business can never read another’s bookings.
If a breach affects your personal information, we will notify you and the relevant regulator as the law requires.
Changes
If this policy changes materially we will say so on this page and, for significant changes, by email. The date at the top always reflects the current version.