Privacy policy

This policy explains how Chalkful handles personal data. Chalkful is operated from Germany, so the EU General Data Protection Regulation (GDPR) applies, regardless of where our users are located.

Controller

Aaron Hein, Buchwiesenstraße 23, 54313 Zemmer-Rodt, Germany. Contact: aaron@chalkful.app.

What we collect

• Tutor account data you provide: email address, name, time zone, hourly rate, booking link, and availability.
• Data you enter about students and parents: names, parent email/phone, subject, grade level, session details and notes. You enter this in your role as the tutor and are responsible for having the authority to do so.
• Billing data: invoices and payment status. Card payments are handled by Stripe; we do not store card numbers.
• Technical data: authentication cookies needed to keep you logged in.

Why we use it and legal bases

• To provide the service to you (Art. 6(1)(b) GDPR — contract).
• To send transactional emails such as login links, invoices and session reminders (Art. 6(1)(b) and 6(1)(f) — legitimate interests).
• To keep the service secure and working (Art. 6(1)(f) — legitimate interests).

Processors we use

We share data only with service providers that process it on our behalf:

• Supabase — database, authentication and storage.
• Vercel — application hosting.
• Stripe — payment processing.
• Resend — sending transactional email.

Some of these providers may process data in the United States. Where that happens, transfers are based on appropriate safeguards such as the EU Standard Contractual Clauses.

Children's data

Chalkful is a tool for tutors and is not directed to children. Children do not create accounts or use Chalkful directly. A tutor may enter information about a student who is a minor; the tutor is responsible for obtaining any necessary parental consent. We process this information only to provide the service to the tutor.

Retention

We keep your data while your account is active. You can delete your data or ask us to delete it; we will do so unless we must retain certain records (for example, invoices) to meet legal obligations.

Your rights

Under the GDPR you have the right to access, correct, delete, restrict or port your data, and to object to certain processing. From Settings → Your data you can download all your data as a file and permanently delete your account yourself. For anything else, contact aaron@chalkful.app. You may also lodge a complaint with a data protection authority.

Changes

We may update this policy; we will change the date above when we do.