Privacy Policy

This privacy notice for TutorVault, operated by Pounding Water ('we', 'us', or 'our'), describes how we handle information when an educational institution uses our AI-powered learning platform ('Services') for its students and staff.

TutorVault is an institutional platform. A college or university provides the academic materials it is authorized to use; TutorVault's AI transforms those materials into a learning environment for that institution's students. The institution is responsible for its own academic program and for the materials it provides.

Questions or concerns? Contact us at connect@tutorvault.io.

1. Roles

• The institution decides what academic materials to provide, which students and staff may access the platform, and the purpose for which the materials are used. The institution directs this use.
• TutorVault processes the materials and operates the platform to provide the agreed service, under its agreement with the institution.

The precise legal characterisation of each party's role (for example, controller vs. processor under an applicable data-protection law) is defined in the institutional agreement and should be confirmed with legal counsel for the relevant jurisdiction.

2. What We Handle

Institution-provided materials

• Course outlines, syllabi, learning objectives, lecture notes, reading lists, and other academic materials the institution is authorized to provide
• Text extracted from uploaded documents and images, and embeddings generated from it
• AI-generated learning content derived from those materials

Account & access data

• Institution and administrator details (name, email, phone)
• Staff accounts created by email invitation
• Student accounts joined via an institution-issued PIN code (no student email required)

Usage data

• Questions asked to the AI and the responses generated
• Learning progress, quiz attempts, and evaluation scores
• Session and feature-usage analytics, device and browser information, and IP address

3. How Materials Are Used

• To provide the service: materials an institution provides are processed to generate its structured courses, explanations, examples, quizzes, and revision resources, and to deliver them to that institution's authorized users.
• Access control & non-publication: content built from an institution's materials is configured as institution-private. It is not published to the public TutorVault catalogue simply because we processed it, and it is not made available to other institutions' users.
• Analytics: aggregated, de-identified usage data helps us operate and improve the platform.
• Communication: administrator contact details are used for support, billing, and service updates.

We do not sell institution materials, student data, or staff data, and we do not share them with third parties for marketing or advertising.

4. Storage & Processing

To provide the service, TutorVault stores and processes the materials an institution provides and the content generated from them on its infrastructure and through the service providers it uses to operate the platform (such as hosting and AI inference providers).

We provide access control and non-publication of institution-private content. We do not claim that the content never leaves TutorVault's systems or that TutorVault can never access it — providing the service necessarily involves storing and processing it. How storage and processing are handled for a given institution is defined in that institution's agreement.

Specific storage locations, retention periods, sub-processors, and any data-transfer safeguards are set out in the institutional agreement and its data-processing terms, which should be reviewed by legal counsel.

5. Student & Staff Access

• The institution controls access. Students join via an institution-issued PIN code; staff are added by email invitation. The institution decides who is authorized.
• No student email required. Student accounts do not require a personal email address.
• Access removal. When a student or staff member leaves or is no longer authorized, their access can be removed according to the institution's policies.
• Minimal collection. We collect only what is needed to provide the learning service — no ad targeting and no behavioural profiling for advertising.

6. Retention & Deletion

• Institution data is retained for the duration of the institution's subscription.
• On termination, institution materials, generated content, and student and staff records are deleted or returned as set out in the institutional agreement.
• Aggregated, de-identified analytics may be retained for service improvement.
• Access and deletion requests from individuals are handled together with the institution, since the institution directs the use of the data.

7. Security

• Data in transit is encrypted in transit using current TLS.
• Access to institution data is restricted to authorized personnel.
• Each institution's content is kept logically separated from other institutions' content.
• No security system is perfect; we work to reduce risk but cannot guarantee absolute security.

8. Your Rights

Depending on the applicable law, individuals may have rights to access, correct, delete, or restrict the processing of their personal data, or to data portability. Because the institution directs how its students' and staff's data is used, requests are generally made through the institution, and we will support the institution in responding.

To raise a request, contact connect@tutorvault.io or your institution's administrator.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to institution administrators and posted on this page. Continued use of the Services after an update constitutes acceptance of the revised policy.

10. Contact Us

For privacy-related inquiries:

TutorVault (operated by Pounding Water)
Email: connect@tutorvault.io
Phone: +9779861523737
Kathmandu, Nepal