Privacy Policy

• Organization administrators and tutors
• Parents and guardians of students
• Students, including minors under 18 in Ontario

Tutoring organizations using Math Advance remain responsible for their relationship with families and for any additional notices required by their own policies.

We do not require government ID numbers for core tutoring workflows.

• Provide tutoring operations: scheduling, curriculum, mastery, assessments, and reports
• Authenticate users and enforce role-based access, including child-mode restrictions
• Process payments and tutor payouts via Stripe when those features are enabled
• Send transactional email and push notifications you configure
• Maintain security, audit logs, and abuse prevention
• Improve reliability through error monitoring and product analytics

We do not sell personal information.

We collect and use information for identified purposes related to delivering the tutoring service, meeting contractual obligations with organizations, and complying with law. Where required, we obtain parental or guardian consent before processing a minor's information for platform use.

Primary database, authentication, and file storage are hosted in Canada (Supabase ca-central-1). Web application compute is hosted on DigitalOcean App Platform in Toronto (tor1).

Some sub-processors operate outside Canada. Those transfers are disclosed in this policy and in our sub-processor summary below.

• Supabase — database, auth, storage (Canada)
• DigitalOcean — web app and collaboration hosting (Canada)
• Stripe — payments and payouts (cross-border)
• Resend — transactional email (cross-border)
• Expo — mobile push delivery (cross-border)
• Sentry — error monitoring (cross-border)
• PostHog — product analytics (EU cloud in production)
• OpenAI / Anthropic — optional org-configured AI (United States; see below)
• Daily.co — optional built-in session video (see below)

When an organization enables optional AI features, staff only (tutors and administrators) may use AI to draft progress reports, suggest practice skills, or suggest feedback on open-ended responses. Students and parents do not interact with AI directly and do not receive AI output until a tutor or administrator reviews and publishes it.

The organization chooses the AI provider, supplies its own API key, and pays the provider directly. Depending on the feature, limited student information (such as first name, grade level, mastery summaries, or an open-ended response) may be sent to that provider. Prompts are designed not to include email, full legal names, dates of birth, home addresses, or answer keys.

AI providers may process data in the United States. This is a cross-border transfer under PIPEDA. An organization administrator must acknowledge this in Admin → AI Settings before AI features run. AI output is always a draft until a human publishes or confirms it.

When built-in video is enabled, online sessions may use Daily.co for audio and video. Rooms are configured with recording disabled. Where supported, rooms use Canadian geo preference; residual routing through United States infrastructure may occur. When built-in video is off, tutors may paste an external Zoom, Google Meet, or Teams link.

We retain information while an account or organization is active and as needed for billing, security, and legal obligations. Organizations and individuals may request deletion subject to applicable law and legitimate retention needs. Contact us at [email protected].

• Encryption in transit (TLS)
• Role-based access with row-level security in Postgres
• Service-role keys never shipped to browsers or mobile apps
• Audit logging for sensitive actions
• Short-lived signed URLs for private storage objects

Math Advance is designed for tutoring organizations serving school-age students. Student accounts for minors require guardian linkage and consent workflows. Child-mode sessions restrict access to adult-only surfaces such as billing and administrative messaging.

Subject to applicable law, you may request access, correction, or deletion of personal information, and withdraw consent where consent is the basis for processing. Contact [email protected]. Organizations may also initiate tenant-level requests through support.

We will update this policy and revise the effective date when material changes occur. Significant changes affecting minors' data or new cross-border sub-processors will be communicated through appropriate notices where required.

EduMatrix Canada
Ontario, Canada
Email: [email protected]