1. Preview and connected modes
When Supabase is not configured, account forms do not submit credentials. Demo bookings store a random reference, sample tutor ID, subject, UTC time, and selected timezone in this browser’s local storage. The student dashboard has a control to clear these records. Country and currency selections remain in memory for the current visit.
2. Supabase account data
When configured, Supabase processes your email, authentication credentials, session information, and optional name and account preference. Demo trial requests are stored under your account ID. Row Level Security is designed to restrict requests to their owner. Passwords are handled by Supabase Auth and are never stored in our application tables.
3. Cookies and local storage
Supabase uses essential session cookies when connected. Demo request storage is used only for the preview booking experience. This MVP includes no advertising trackers, analytics scripts, or payment collection. Hosting providers may process standard request logs.
4. Contact forms
The support form currently validates inputs on your device and demonstrates a completion state. It does not transmit or store the message. Do not enter sensitive personal data into a preview form.
5. Children and safeguarding
Account creation is intended for adults or a parent or guardian managing a student’s participation. Child privacy and consent procedures must be reviewed for every supported market before serving minors.
6. Retention, access, and deletion
Browser-only demo requests can be cleared from the student dashboard or browser settings. A verified support channel and account deletion process must be provided before live user onboarding. For development accounts, the project operator can handle verified data requests through Supabase administration.
7. Before launch
Publish the controller’s identity and privacy contact, define retention schedules, review processor agreements and cross-border transfers, and implement access and deletion workflows. Final rights and lawful bases must reflect the actual service and jurisdictions.