Who determines processing
Wolf Softworks S.R.L., company identifier 27679079, supplies TutorTrack. The supplier determines processing purposes for its accounts and service security. For learner and workspace records, the tutor or organization may be controller and the supplier processor only under an Article 28 GDPR agreement. Roles are determined per activity, not globally.
For privacy and rights requests: contact@tutortrack.ro. Registered address: Strada Lemnarilor 61, Brașov, Romania. Telephone: +40 723 612 436. No appointed data protection officer is identified; the need for appointment must be assessed under Article 37 GDPR.
Information and sources
Information may include account email and name, password and session verifiers, verification and recovery proofs, roles and invitations; learner names, guardian links, schedules, attendance, packages and manual payment records; files and export archives; support and rights requests. Information comes from you, the tutor or organization managing the workspace and service use.
Hosting and communications receive technical information such as IP addresses and request details. We do not claim infrastructure logging is absent. Where Google or Apple authentication is enabled, provider proof is verified and an identity binding retained; new accounts may use the provider-verified email. These integrations are not promised in every version.
Implemented security observation uses aggregate counts by event type, route template and 15-minute interval, without account or IP correlation in those aggregates, with a 30-day retention policy. Authentication rate limiting uses separate technical records. Actual production enablement and cleanup require separate verification.
Purposes and lawful bases
The applicable bases are Article 6(1)(b) for creating and delivering the contracting individual’s account, Article 6(1)(f) for abuse prevention and service protection subject to balancing individuals’ rights, and Article 6(1)(c) for specifically identified legal duties. A basis is not automatically applied to everyone in a workspace.
The workspace controller determines and communicates the basis for administering teaching relationships. Consent, where required for an optional feature, must be withdrawable. Account and authentication information is needed to provide access; withholding it may prevent access. Blanket consent to all processing is not requested.
Recipients, providers and transfers
Authorized people access data according to their roles: owners, tutors and linked learners or parents within permitted functions. Hosting, email, storage and backups may involve contracted providers. Disclosures to authorities may be required by law.
According to the supplier’s confirmation on 23 October 2026, server hosting, email and backups are provided by bitul.ro with data stored in Romania; no other backup provider was identified. The provider’s legal identity, processing contracts, any subprocessors and access from other countries require contractual verification. The stated storage location alone does not establish the absence of international transfers.
Retention and deletion
Export archives expire after 35 days; the product allows one successful export per account per rolling 30 days in UTC. This technical limit does not restrict statutory rights: request assistance where the app cannot satisfy a request. The local policy for complete TutorTrack-managed backups is a maximum of 30 days; external copies and production enforcement require separate verification.
Accounts, workspace records and files are kept as needed for the applicable purpose. Closing a workspace removes records and queues file cleanup; deleting an account revokes access and anonymizes some information but may preserve shared history. Support, log and provider periods must be finalized. Accounting and legal-claims exceptions need justification by document class rather than applying to every lesson or payment.
Rights, children and security
You may request access, correction, erasure, restriction, portability and objection under GDPR conditions and withdraw consent where applicable. The GDPR rights page explains requests and complaints to ANSPDCP. Do not send passwords, codes or unsolicited identity-document copies.
Children’s information requires age-appropriate notice and a lawful basis established by the controller. No solely automated decisions with legal or similarly significant effects are identified in the reviewed features. Access controls and credential protection reduce risk without guaranteeing absolute security. Operational incident and rights-handling procedures must be validated before launch.