1. Controller and contact
MERCURIUS 4 Kereskedelmi és Szolgáltató Betéti Társaság (Mercurius 4 Bt.). Company registration: 01-06-016739; Hungarian tax number: 28135775-2-41. Registered office: [REGISTRY ADDRESS TO BE PROVIDED AND VERIFIED]; registry court: [TO BE VERIFIED]; postal complaints address: [TO BE PROVIDED]. Contact: info@chemistrytutor.hu. Normal Hungarian VAT status is owner-declared; the registry extract and applicable tax registrations require separate verification. The company controls the digital platform’s own account, commercial, security and legal processing. Personal tuition/course providers and teachers managing their own learners require separate fact-based role assessment; earlier contract parties are not replaced.
2. Data collected
- Enquiry and enrolment details: contact name and details, role, student name, programme, level, exam year, selected online format, timetable constraints and message.
- Teaching and account data: enrolments, attendance, assignments, uploaded work, attempts, tutor feedback, messages and progress records.
- Student safety and moderation: reports about messages or users, the reason and optional details, blocks, and administrator decisions and timestamps. We may also retain the version and acceptance time of a student safety policy accepted previously. We use these to respond to abuse, protect participants and run the service safely; only authorized administrators can access reports.
- Student portal activity: the signed-in student's opened student route and its time, plus at most one activity signal per minute while the tab is visible and the student interacted recently. The tutor may use these signals and recorded exercise attempts for individual support. Signals are not exact sign-in or attendance time; they do not contain IP addresses, device identifiers or page content.
- Operations and security: consent and policy records, request reference, source page, authentication events and limited technical logs needed to prevent abuse.
- Optional analytics: after permission, Vercel Analytics, Vercel Speed Insights and first-party public-journey measurement may operate. The first-party measurement handles event type, language, route, categorical context and a hash of a random session identifier; it contains no contact details.
- Optional Google Ads measurement: after separate advertising-measurement permission, a configured Google base tag may measure visits from Google Ads and record a successfully saved enquiry as a conversion. Contact details are not sent to Google, and personalised advertising and remarketing are not used.
- Contract and accounting records: the frozen agreement text and data snapshots, the exact required declarations, email-verification and electronic-acceptance timestamps, the final PDF and its checksum, invoices, payment references, complaints and records required by law. To prevent abuse and preserve acceptance evidence, we also record a one-way pseudonymous hash of the IP address and the browser user-agent. A verification code is never stored or logged in readable form and is sent only by email.
3. Purpose and legal basis
Personal data is not sold or used to build advertising profiles. Optional choices can be changed at any time through Privacy settings in the footer; withdrawing permission does not affect core website functions.
- Steps before a contract and contract performance: responding to an enquiry, checking fit, arranging a place and timetable, teaching, assignments, feedback and account support.
- Individual teaching support: reviewing student routes and exercise attempts to plan the next lesson and targeted help. This is a teaching record connected to performing the education agreement, not advertising analytics.
- Legal obligation: invoicing, accounting, consumer complaints and lawful authority requests.
- Legitimate interests: system security, abuse prevention, necessary teaching records and legal claims, balanced against the student's rights.
- Optional analytics: Vercel audience and performance measurement, and session-deduplicated pseudonymous public-journey events, operate only after Analytics permission is given.
- Consent: optional uses where law requires it, including certain recordings or marketing communication. Consent can be refused and later withdrawn.
- Optional advertising measurement: the Google Ads base tag, technical data associated with an advertising click and the conversion event for a successfully saved enquiry may be used only after separate permission. ad_personalization always remains denied; Enhanced Conversions and remarketing are not enabled.
4. Cookies and similar technologies
The website treats localStorage, sessionStorage and IndexedDB records with the same care as cookies. Technologies needed for operation, security, sign-in, reliable form submission, student work and remembering a language explicitly selected by the user remain active.
The chemistrytutor-consent-v1 localStorage record stores the selected categories, policy version and timestamp; it contains no unique visitor identifier. The choice is valid for 180 days or until a material policy change. Corrupt or expired data causes every optional category to fail closed.
Vercel Analytics, Vercel Speed Insights, chemistrytutor-marketing-session-v1 and chemistrytutor-marketing-attribution-v1 operate only after Analytics permission. Before permission, no marketing session identifier is created and no optional analytics request is sent.
The Google Ads base tag may load only after separate Advertising measurement permission and only when a genuine AW identifier has been configured for this website. No optional measurement is sent before permission or after withdrawal. A successfully saved enquiry may send one conversion event without contact or Enhanced Conversions data; ad_personalization always remains denied. Refusal does not prevent navigation, forms or sign-in.
5. Students who are minors
A parent or legal representative is normally the primary contact. The enquiry form does not require a student's precise home address or make a personal phone number or email compulsory. Age-appropriate information and the necessary parental or representative permission are used for communication, recording and publication.
6. Recordings, student work and AI support
A lesson is recorded only after clear advance information and the necessary permissions. Access is restricted to the relevant student or cohort for a limited period; recordings are not published.
If AI helps prepare a first feedback draft, only the minimum task content is used, direct contact data is excluded and human tutor review can be requested. Protected official papers or mark schemes are not sent without permission.
7. Processors and international transfers
Hosting, database, authentication, email, optional analytics, Google Ads and AI providers may include Supabase, Vercel (hosting and optional analytics), Resend, Google Ads and OpenAI. The Google Ads base tag may load only after separate advertising-measurement permission; contact details and Enhanced Conversions data are not sent. Access is limited to what each provider needs, under contractual privacy and security duties.
Where a provider processes data outside the European Economic Area, an appropriate GDPR transfer mechanism and supplementary safeguards are used where required.
8. Retention and security
Data is kept only for the period needed for the stated purpose, agreed account access, legal claims and Hungarian accounting or statutory obligations. The unreadable verification-code records used for contract acceptance may be deleted after a shorter security period, set to 30 days by default once the contract reaches a terminal state. This does not shorten the statutory retention of the agreement, final PDF, accepted declarations or audit trail. Hashed-session public funnel events that contain no contact details are kept for no more than 400 days. Access controls, logs, encrypted connections and restricted permissions are used. Incidents are assessed and reported as required by law.
9. Your rights
Subject to the legal conditions, you may request information, access, correction, deletion, restriction and portability, or object to processing based on legitimate interests. Consent may be withdrawn at any time. Identity or representative authority may need to be verified.
A complaint may be filed with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), and judicial remedies remain available.
10. Official legal sources
11. Android and iOS WebView
Mobile WebView displays the web account, materials and learner interface. Web-service processing also applies through the app. Optional web measurement is disabled for recognised Android and iOS app identifiers.
Native app source is not present in this repository. Actual permissions, local storage, backups, SDKs, file pickers and store privacy declarations require a separate audit of each app. Android-specific claims are not automatically extended to iOS.
Configured push uses optional device permission and account-bound registration. Server code encrypts tokens, revokes bindings on sign-out and limits message content. FCM/APNs roles and actual scheduling of the 90-day server cleanup require verification with deployed apps. Uninstalling does not delete the server account.
Web Stripe Checkout is not automatic approval for in-app digital purchases. Recognised WebView checkout is disabled until separately approved. App-store rules remain a launch dependency.
12. Account and data deletion requests
A student or their legal representative may request deletion of the ChemistryTutor Android app and web student account, together with associated personal data, by emailing info@chemistrytutor.hu. The account email address is enough to start the request; do not send a password or sensitive student documents. A request can be made without the app or signing in.
We acknowledge the request and, after verifying authority, delete or anonymise the account and associated student data without undue delay. If records must be retained to meet a legal duty such as accounting, or to handle a legal claim, our response explains the reason and expected retention period. Uninstalling the app alone does not delete the server-side account.
Digital purchase, guardian approval and withdrawal – supplement
Sandbox working draft · Version: 2026-10-16-sandbox-v4-direct-manual
Controller and legal bases
MERCURIUS 4 Kereskedelmi és Szolgáltató Betéti Társaság (Mercurius 4 Bt.). Company registration: 01-06-016739; Hungarian tax number: 28135775-2-41. Registered office: [REGISTRY ADDRESS TO BE PROVIDED AND VERIFIED]; registry court: [TO BE VERIFIED]; postal complaints address: [TO BE PROVIDED]. Contact: info@chemistrytutor.hu. Normal Hungarian VAT status is owner-declared; the registry extract and applicable tax registrations require separate verification. The company controls the platform’s own account, commercial, security and legal processing. Personal tuition/course providers and teachers managing their own students require separate fact-based controller/processor assessment; roles are not finally determined by this draft.
Minors and tracking
Only necessary age bands and parent verification/representation evidence are collected, without full birth dates or identity documents. A hashed expiring invitation links an independently verified adult buyer to the learner. The learner email or answers are not sent as Stripe metadata. Optional analytics and advertising are off by default, separately controlled and never part of purchase consent. GDPR Article 8 consent rules are separate from contractual capacity; child optional tracking needs a specific launch review.
Tax and invoicing data
Free registration does not request a general age band or birth date. Simplifying the interface neither deletes nor overrides a previously known minor status. Where representation is needed, we process the invited representative’s email, verified account, declaration and evidence of the single-use expiring token. Learner emails and answers are not placed in Stripe metadata. Email ownership alone does not prove a family relationship. Unknown age is not verified adulthood. GDPR Article 8 consent and optional measurement are handled separately; the optional 16-or-over measurement declaration is not the adult eligibility condition for a paid contract.
Processors and AI
Supabase provides Auth, database, storage and functions; Vercel hosts the app and necessary logs; Resend delivers transactional mail; Stripe processes payments, sometimes as independent controller; OpenAI may process configured teacher grading task/answer text. The worker filters direct identifiers, but free text can contain personal information: complete anonymity is not promised. Teachers review suggestions; no solely automated decision with legal effect is promised. Optional Vercel/Google analytics/advertising follow the separate cookie controls. Exact provider entities, regions, subprocessors, DPAs and safeguards for possible non-EEA transfers must be approved before launch. Teacher/controller roles for private students require a separate DPA review.
Retention and rights
Keep contract, payment, complaint and security evidence only for the applicable statutory/claims periods; exact corporate accounting/tax retention, deletion jobs and backup lifecycle require approval. Withdrawal does not automatically delete learning history. Access tokens expire and only hashes are stored in the database. Request access, correction, applicable deletion, restriction, portability or objection via info@chemistrytutor.hu; consent can be withdrawn. Responses generally take one month, subject to lawful notified extensions. Complaints may be lodged with NAIH (https://www.naih.hu) and competent courts. RLS, server checks, signed webhooks, token hashing and administrator MFA protect access. This supplements the existing learning/course privacy notice. The company manually issues official invoices using NAV Online Invoicing. Restricted bookkeeping stores necessary buyer name, email, address and tax identifiers from verified Stripe payments separately from learner identity. Administrative supplements and changes are audited separately. Test payments create clearly labelled non-fiscal test tasks only. No data is sent to Billingo, Számlázz.hu or an automatic NAV API.
Teacher processing and mobile scope
Where a teacher determines purposes for their private students, the platform may process student records under that teacher’s documented instructions; the Article 28 DPA is a separately identified draft pending role/legal approval. The platform’s own billing and security purposes remain separate. Android WebView behaviour is described only where evidenced by this repository. iOS permissions, storage, tracking, purchases and store declarations require an actual app audit; Android assertions are not copied to iOS. Push requires optional device permission; configured FCM/APNs delivery, encrypted device tokens and generic notification content follow the actual implementation. Provider entities, DPAs, transfer safeguards, per-category retention/deletion and backup procedures require launch approval; no unimplemented automatic deletion or anonymity is promised.