1. Who we are

CANtutor Tutoring & Enrichment (“CANtutor”, “we”, “us”) provides tutoring and enrichment programs for students in Grades 1–12, delivered online, in students’ homes, and at partner library locations in the Greater Toronto Area.

We are the organization responsible for the personal information described in this policy. For any privacy question or request, contact us at info@cantutor.ca or +1 437-438-2944.

2. What we collect

We only collect information you give us directly. Specifically:

Program registration

Parent or guardian name
Student name and grade level
Email address and phone number
Home address
Program selected, class format, class frequency, and payment plan
Preferred library location and suggested days and times, where applicable
Any additional notes or learning goals you choose to write in the form

Contact form

Your name, email address, subject, and message

Referral program

Your name, email address, phone number, and address
Information about your student that you provide
Email addresses of friends you choose to invite. We use these only to send a single invitation message on your behalf. We do not add them to a mailing list, and we do not use them for any other purpose. Please only enter an address if you have that person’s permission.

Staff and tutor accounts

Name, email address, and role
A cryptographic hash of the account password. We never store, and cannot recover, the password itself.
Scheduled shift details, including assigned student and subject

Technical information

Standard server logs containing the request method, the page path, the response status, and the IP address of the request. We deliberately exclude query strings, request bodies, and cookie headers from our logs so that personal details do not end up there.

We do not use analytics, advertising, or tracking tools. There is no Google Analytics, no advertising pixel, and no third-party behavioural tracking on this site.

3. Children's information

Our programs are designed for students in Grades 1–12, and many of our students are children. We take this seriously.

Registration is intended to be completed by a parent or legal guardian, not by a child. Our forms ask for the parent or guardian’s name and contact details.
The only information we hold about a student is what a parent or guardian provides during registration: name, grade level, program, and any learning notes they choose to add. We do not ask children to create accounts on this website.
We do not knowingly collect personal information directly from a child without parental consent. If you believe a child has submitted information to us, contact info@cantutor.ca and we will delete it.
A parent or guardian may review, correct, or request deletion of their child’s information at any time using the contact details above.

4. Why we use your information

We use personal information only for the following purposes:

To set up, schedule, and deliver the tutoring program you chose
To process your payment and manage your subscription
To contact you about your registration, scheduling, or a question you sent us
To issue and validate referral discount codes
To let our tutors see the shifts assigned to them
To keep the service secure, for example, detecting and slowing down repeated failed sign-in attempts
To meet our legal, tax, and accounting obligations

We do not sell personal information. We do not rent, trade, or share it for anyone else’s marketing.

5. Payments

Payments are processed by Stripe, Inc. When you check out, you are taken to a payment page hosted by Stripe and you enter your card details there.

Your card number never touches CANtutor’s servers and we never see or store it. We receive only a payment confirmation, a subscription identifier, and the email address associated with the checkout. Stripe’s handling of your payment data is governed by the Stripe Privacy Policy.

6. Who we share it with

We share personal information only with the service providers needed to run the business, and only to the extent each one needs it:

Stripe: payment processing and subscription billing.
Resend: sending transactional email such as registration confirmations and referral codes.
Railway: hosting for our application server and database.
Vercel: hosting and content delivery for this website.
Google Fonts: the site loads its typeface from Google’s font service, which receives your IP address as part of that request.
OpenStreetMap: our Locations page loads map tiles from OpenStreetMap, which receives your IP address as part of that request.

We may also disclose information where we are legally required to do so, or where it is necessary to protect the safety of a student, our staff, or the public.

7. Where your information is stored

Our database and application servers are operated by Railway, and this website is served by Vercel. Our payment and email providers are based in the United States. This means your personal information may be stored or processed outside Canada, and may be accessible to courts, law enforcement, or national security authorities in those jurisdictions.

We use providers that offer contractual protections comparable to the standard required under Canadian privacy law, and we require them to use your information only to provide the service to us.

8. How long we keep it

Registration and billing records: kept for as long as you are a customer, and afterwards for as long as we are required to keep financial records for tax and accounting purposes (generally seven years in Canada).
Contact form messages: kept until the enquiry is resolved and then deleted during routine cleanup.
Referral records: kept while the discount code is valid and for a reasonable period afterwards to prevent abuse.
Sign-in sessions: expire automatically after eight hours and are then purged from the database.
Server logs: retained on a short rolling window by our hosting provider.

9. How we protect it

Our safeguards include:

All traffic to this site and to our API is encrypted with HTTPS, and HTTP Strict Transport Security is enforced.
Staff passwords are stored only as bcrypt hashes with a per-password salt.
Staff sessions use signed, HttpOnly, Secure cookies that JavaScript cannot read, and are re-issued on sign-in.
Rate limiting on sign-in and on every public form, to blunt brute-force and abuse.
Role-based access control: administrative data is reachable only by an authenticated administrator, and a tutor can see only their own shifts.
A strict Content Security Policy and a full set of browser security headers.
Credentials and API keys are held as server-side environment variables. They are never included in the website code delivered to your browser and are never written to our logs.

No system can be guaranteed perfectly secure, but we work to keep these controls current. If we become aware of a breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law.

10. Cookies, analytics and local storage

When you first visit, a banner asks which optional cookies you allow. You can change your choice at any time with the “Cookie Settings” link in the footer.

Essential: cantutor_consent remembers your cookie choice for 12 months, and cantutor.sid is a session cookie set only after a staff member signs in. Without analytics consent we still count page visits anonymously (the page and time only, no identifier that follows you).
Analytics (optional): a random visitor ID kept in your browser’s local storage, and a per-tab session ID, so we can see which pages and buttons are useful and which marketing channels bring families to us. This data is first-party: it is stored on CANtutor’s own servers, is not sold or shared, and we never store your raw IP address (only a one-way hash used to limit abuse). If you later fill in one of our forms, the visitor ID is linked to that request so our team can see which pages you viewed before contacting us.
Marketing (optional): Google Ads cookies that measure which of our ads lead to a booked consultation. Under Google Consent Mode these are not set unless you allow them.
Local storage: also remembers whether you have dismissed our offers, so we do not show you the same popup repeatedly.

Marketing email. We only send tips and updates if you tick the (unticked by default) consent box on one of our forms, as Canada’s Anti-Spam Legislation (CASL) requires. Every message includes an unsubscribe link, and you can also unsubscribe by emailing info@cantutor.ca.

11. Your rights and choices

You may ask us to:

Tell you what personal information we hold about you or your child
Correct anything that is inaccurate or incomplete
Delete information we no longer need to keep for a legal or accounting reason
Provide a copy of the information you gave us
Withdraw consent, subject to legal and contractual limits

Email info@cantutor.ca and we will respond within 30 days. We may need to verify your identity before releasing information, particularly for a request about a child.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or your provincial privacy regulator.

12. Changes to this policy

If we change this policy we will update the “last updated” date at the top of this page. If the change is significant, we will notify registered families by email.

13. Contact us

Questions about this policy, or about how we handle your information:

See also our Terms of Service and our Accessibility Statement.