Privacy Policy

1. Who We Are

Avora Learning Co., Ltd. (“Avora Learning”, “we”, “us”, or “our”) operates an online tutoring platform serving students and families in Thailand and internationally. Our registered office is in Bangkok, Thailand.

For privacy questions, please contact us at privacy@avoralearning.com.

2. Data We Collect

Account information

When you create a parent or student account, we collect your name, email address, country, and role (parent, student, or teacher). We also collect profile information you choose to add, such as grade level, subject interests, and learning goals.

Session and learning data

We collect records of tutoring sessions, session notes, progress scores, quiz results, attendance, and teacher wrap-up reports. This data is used to generate learning plans and progress reports.

Communications

If you contact us or send messages through the platform, we retain those communications to support your account and resolve queries.

Payment information

Payment processing is handled by Stripe. We do not store full card numbers or CVV codes. We receive and retain a transaction record, subscription status, and billing history.

Usage data

We collect standard server log data including IP address, browser type, pages visited, and device type for security and performance purposes.

3. Children's Data and Parental Consent

Our service is designed for use by students, many of whom are under 18. We comply with Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and take the privacy of children seriously.

Student accounts for children under 18 must be created or authorised by a parent or guardian. By creating an account for a child, the parent or guardian confirms they have the authority to provide this consent.

We collect only the minimum data necessary to deliver the tutoring service. We do not sell, rent, or share children's personal data with third parties for marketing purposes.

Parents may request to review, correct, or delete their child's data at any time by contacting us at privacy@avoralearning.com.

4. Session Recordings

Live tutoring sessions may be recorded with the consent of all participants. Recordings are stored securely and are accessible only to the student, parent, and their assigned teacher.

Recordings are retained for 90 days from the session date and then permanently deleted, unless you request earlier deletion.

You may opt out of session recording at any time by notifying your teacher or contacting support before a session begins.

5. How We Use Your Data

• To create and manage your account and your child's learning profile
• To deliver personalised tutoring sessions and AI-powered learning paths
• To generate weekly progress reports for parents
• To process payments and manage subscriptions
• To send service emails (session reminders, weekly reports, account notices)
• To improve our platform, fix bugs, and analyse usage patterns
• To comply with legal obligations under Thai law

We do not use your data for automated decision-making that produces legal or similarly significant effects without a human review step.

6. Third-Party Services

We use the following third-party services to operate the platform:

• Supabase — database, authentication, and file storage (data processed in EU or US data centres under standard contractual clauses)
• Stripe — payment processing (PCI DSS compliant; data governed by Stripe's privacy policy)
• Resend — transactional email delivery (email content and recipient addresses shared as necessary for delivery)
• Vercel — application hosting and edge functions (logs retained per Vercel's data retention policy)

We enter into data processing agreements with each provider and require them to process data only on our instructions.

7. Data Retention

We retain your account data for as long as your account is active. If you close your account, we will delete personal data within 90 days, except where we are required to retain it for legal or financial compliance purposes (for example, payment records required under Thai accounting law).

Session recordings are deleted after 90 days. Progress data may be retained for up to 3 years after account closure in an anonymised form for service improvement purposes.

8. Your Data Rights

Under Thailand's PDPA and applicable law, you have the right to:

• Access a copy of the personal data we hold about you or your child
• Correct inaccurate or incomplete data
• Delete your data (subject to legal retention obligations)
• Object to certain types of processing
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
• Complain to the Office of the Personal Data Protection Committee (PDPC) if you believe your rights have been violated

To exercise any of these rights, email us at privacy@avoralearning.com. We will respond within 30 days.

9. Security

We use industry-standard security measures including HTTPS encryption, server-side authentication, role-based access controls, and regular security reviews. No system is perfectly secure; if you suspect unauthorised access to your account, contact us immediately.

10. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you by email or by displaying a notice in the platform at least 14 days before the change takes effect. Continued use of the service after that date constitutes acceptance of the updated policy.

11. Contact

For privacy questions or data requests:

Avora Learning Co., Ltd.
Bangkok, Thailand
Email: privacy@avoralearning.com