Privacy Policy

Effective Date: May 1, 2026 · Last Updated: July 1, 2026 · Version 1.3

R² Academy Tutoring ("we," "our," or "us") is committed to protecting the privacy of our clients, students, and website visitors. This Privacy Policy explains how we collect, use, store, share, and safeguard personal information, in accordance with Canadian privacy laws — including the Personal Information Protection and Electronic Documents Act (PIPEDA).

By submitting our quote form or otherwise providing personal information to us, you consent to the practices described in this Policy. If you do not agree, please do not submit information through our site.

1. Information We Collect

We only collect information that is necessary to deliver, schedule, and bill for tutoring services. Through our website, email, and direct communication, this typically includes:

Parent or guardian name, email, phone number, and mailing address
Student name, age, grade level, and academic information (subjects, current marks, goals, course codes)
Scheduling preferences (preferred days/times, expected start date, session format and location)
Information about the student's learning needs that you choose to share — including ESL status, IEP details, and diagnosed conditions (see section 3, Sensitive Information)
Records of communications between you and our team
Session recordings. Online tutoring sessions on LumenBoard are recorded — this includes the video, audio, and shared whiteboard/screen content of the session, in which your child appears and is heard. See section 4 for how we use, safeguard, and retain these recordings. (In-home sessions are not recorded.)
Billing records (sessions delivered, invoices issued, payments received)
Payment & billing information. When you place a card on file, the card details are entered into and stored directly by our payment processor, Stripe. We receive and store only the card's brand, last four digits, and expiry date, a secure token that lets us bill that card, and a record of your authorization (the date, time, and the IP address/device used to give it). We never see or store your full card number, security code (CVC), or PIN.
Technical & security information. When you use the Site, submit a form, or authorize a payment, we automatically record your IP address, browser/device type (user-agent), and timestamps, along with a record of which consent boxes you ticked and when. We use this for security, fraud prevention, rate-limiting (we limit quote-form submissions to a small number per hour from the same IP address), and to keep an internal audit trail of account and billing actions.

If you are a tutor with an account on our portal at portal.r2academytutoring.com, we additionally collect your sign-in email and password (stored as a salted hash), profile information you choose to provide (photo, biography, qualifications, criminal record check), and records of sessions you log and invoices you submit. For tax reporting (such as a T4A slip), we also collect your full legal name and mailing address and track the total fees we pay you each year. Your Social Insurance Number (SIN) is collected separately and offline only when a tax slip is required, is used solely for that purpose, and is not stored in the online portal. Tutor data is described further in the tutor agreement you sign with us.

Providing this information is voluntary, but some of it is necessary for us to match a tutor and deliver services.

2. How We Use Your Information

We use the information we collect to:

Match students with a suitable tutor
Schedule, deliver, and adjust tutoring sessions
Communicate with parents and guardians about services, scheduling, and billing
Issue invoices and maintain accounting records as required by law
Process payments, keep a card on file, issue receipts, and — where you have authorized it — automatically charge an unpaid balance after the e-Transfer grace period
Record online sessions to support student safety, maintain teaching quality, train tutors, and resolve any dispute about a session
Detect and prevent fraud, secure our systems, and enforce our Terms
Improve our services and the experience of clients on our site

We use information only for purposes that a reasonable person would consider appropriate in the context of tutoring services.

3. Sensitive Information

Some categories of information you may share with us — particularly IEP details, diagnosed conditions (e.g., ADHD, dyslexia, anxiety), and ESL status — are considered sensitive personal information under PIPEDA, especially because they relate to minors.

We treat sensitive information with extra care:

It is only viewed by the assigned tutor and the small number of administrators required to schedule sessions and manage billing.
It is never shared outside R² Academy except as required to deliver services to your child or as required by law.
You can choose not to share these details — providing them is optional, though doing so helps us match the right tutor.

By submitting information through our website, by booking a session, or by communicating with us, you consent to the collection, use, and disclosure of personal information as described in this Policy.

Marketing communications (CASL): we will only send you commercial electronic messages — such as newsletters, promotions, or service announcements that are not strictly transactional — if you have given express consent (e.g., by ticking a separate marketing-opt-in box on a form). Every commercial email we send will identify us, give a valid contact address, and include a one-click unsubscribe link, in accordance with Canada's Anti-Spam Legislation (CASL). Until we have published a mailing address for this purpose, we do not send commercial marketing emails. Transactional emails — quote confirmations, scheduling messages, invoices, receipts, payment authorizations, and password resets — are sent without a separate opt-in because they are necessary to deliver the service you requested.

How to withdraw consent: you may withdraw consent at any time by emailing admin@r2academytutoring.com. We will confirm receipt within 5 business days and complete your withdrawal request within 30 days, subject to legal or accounting obligations that require us to retain certain records (see section 8, Data Retention).

Recording of online sessions: all online tutoring sessions on LumenBoard are recorded — including video, audio, and the shared whiteboard — as a standard safety, quality-assurance, and tutor-training measure, and to help resolve any dispute about a session. By booking an online session you consent, on behalf of yourself and your child, to this recording. Recordings are stored securely on the LumenBoard platform, are accessible only to the small number of authorized R² Academy staff and the assigned tutor who need them, are never used in public-facing or marketing material without the separate written consent described above, and are retained and then securely deleted in accordance with section 8. In-home and community sessions are not recorded. You may ask about, or request deletion of, a recording at any time by emailing admin@r2academytutoring.com, subject to the retention limits in section 8.

We do not sell, rent, or trade your personal information.

To run the business and deliver services, we share limited information with the following categories of third parties. Each is contractually obligated to handle data securely and use it only for the purpose we engage them for:

Web hosting & database: Hostinger International Ltd. — stores quote-form submissions, account records, and email service for r2academytutoring.com.
Online session platform: LumenBoard (lumenboard.net) — the virtual classroom platform used to deliver online tutoring sessions and to record and securely store those sessions (video, audio, and shared whiteboard). LumenBoard is operated by the same owner as R² Academy Tutoring, and session recordings held there remain under R² Academy's accountability as described in this Policy.
Email delivery: Hostinger SMTP and PHPMailer — sends transactional emails (quote confirmations, invoices, receipts) to you.
Payment processing: Stripe (Stripe Payments Canada, Ltd. and Stripe, Inc.) — securely stores your card on file and processes card payments and your card-on-file authorization. Stripe is PCI-DSS Level 1 certified and handles your full card details under its own privacy policy (stripe.com/privacy); R² Academy never receives them.
Website analytics: Google Analytics 4 (Google LLC) and Microsoft Clarity (Microsoft Corporation) — help us understand how visitors use our website (pages viewed, general device and location information, and which link or form was used) so we can improve it. See section 10, Cookies & Website Data for details. We do not use these tools for advertising or retargeting.
Assigned tutors: independent contractors engaged by R² Academy under a written agreement that requires them to keep your information confidential. To prepare for and deliver sessions, the tutor assigned to a student can see that student's learning profile (subjects, grade, goals, and any IEP, ESL, or diagnosed-condition details you chose to share), the session logistics (format/mode, how soon you want to start, session length, and frequency), and the parent/guardian's contact details and address. Tutors see this only for their own assigned students.

We may also disclose information if compelled by law (e.g., a court order) or to protect our legal rights.

6. Where Your Information Is Stored

Personal information collected through our website is stored on servers operated by our hosting provider, Hostinger. Your data may be stored or processed outside Canada, including in Hostinger's data centers in the United States, Europe, or other regions. While stored outside Canada, the data may be subject to the laws of those jurisdictions, including lawful access by foreign authorities. We have selected a provider with industry-standard security practices.

Your card-on-file information and card-payment records are stored and processed by Stripe, primarily in the United States, under Stripe's own security safeguards and privacy policy. As above, that data may be subject to the laws of the jurisdictions where Stripe operates.

7. Data Protection

We take reasonable physical, organizational, and technical steps to protect your personal information, including:

HTTPS/SSL on every page of the site
Database access restricted to authorized administrators with strong, rotated passwords
CSRF protection, rate limiting, and server-side validation on every form submission
Restricted access to records on a need-to-know basis

While we strive to protect your data, no method of transmission over the internet or method of electronic storage is 100% secure. See section 11, Data Breach Notification for what we do if something goes wrong.

8. Data Retention

We retain personal information only as long as necessary to deliver services and meet legal, accounting, and administrative requirements. Specifically:

Quote requests that do not result in an engagement: deleted after 24 months from the date of submission.
Active client records and billing data: retained for 7 years after the end of the engagement, in accordance with Canada Revenue Agency record-keeping requirements.
Tutor invoices and contractor records: retained for 7 years, also per CRA requirements.
Sensitive information (IEP, diagnoses, ESL): deleted promptly after the engagement ends, unless retention is required for billing dispute resolution.
Online session recordings: retained for 12 months after the session, then securely deleted — unless a recording is needed longer to resolve a safety concern or a billing dispute, in which case it is kept only until that matter is resolved.
Payment authorizations & card-on-file tokens: kept while your account is active, and removed when you withdraw authorization, remove your card, or close your account. Transaction and receipt records are retained for 7 years per CRA requirements. You can remove your card or withdraw auto-charge authorization at any time by emailing admin@r2academytutoring.com.
Quote-form submissions (including the IP address and browser information recorded with them) follow the 24-month deletion rule above where they do not lead to an engagement.

When information is no longer required, it is securely deleted or anonymized.

9. Children's Information

Our services are directed to parents and guardians, not directly to children. When we collect information about a student under the age of 18, we do so with the explicit consent of the parent or guardian, and we treat that information with the protections described in this Policy and the additional safeguards in section 3. Parents and guardians may request access to, correction of, or deletion of their child's information at any time using the contact information at the bottom of this page.

10. Cookies & Website Data

Our website uses minimal browser storage:

Local storage for partially completed quote forms, so you can pick up where you left off. This stays in your own browser, is never sent to us until you submit, and is cleared automatically after about 3 days, when you submit, or when you choose "start over."
A CSRF session cookie to protect form submissions from cross-site request forgery.
Stripe — when you reach a page where you enter or confirm a card, that page loads Stripe's secure payment library (Stripe.js) directly from Stripe, which may set its own cookies for fraud prevention. These are governed by Stripe's privacy policy.
Google Analytics 4 and Microsoft Clarity — set cookies and similar browser storage so we can understand website traffic and how visitors use the site (e.g., which pages are viewed, how the quote form is used, and general device and location information). Neither is configured for cross-site advertising or retargeting. You can opt out using your browser's cookie settings or a tracking-prevention extension; the site remains fully usable without them.

We also log your IP address on the server when you submit a form, solely for security and to limit abuse (rate-limiting) — not for advertising. We do not use cookies or these analytics tools for advertising, retargeting, or cross-site tracking. Our website fonts are served from our own servers, so loading a page does not share your IP address with an outside font provider.

11. Your Rights Under PIPEDA

Subject to limited exceptions in law, you have the right to:

Access the personal information we hold about you
Correct information that is inaccurate or out of date
Withdraw consent for the use or disclosure of your information
Request deletion of your information, subject to our retention obligations
Complain to us, or to the Office of the Privacy Commissioner of Canada

To make a request, email admin@r2academytutoring.com. We will respond within 30 days. If we cannot fulfill your request, we will explain why. Where a request concerns payment-card data, part of it may need to be carried out through our payment processor, Stripe, since your full card details are held by Stripe and not by us.

12. Data Breach Notification

If a breach of security safeguards results in a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required under PIPEDA. We will keep records of any breach for at least 24 months, regardless of whether notification was required.

13. Updates to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "Last Updated" date. Material changes will be communicated by email to active clients before they take effect.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact:

R² Academy Tutoring — Privacy Concerns
Email: admin@r2academytutoring.com

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada. Ontario residents may also contact the Information and Privacy Commissioner of Ontario for guidance, although PIPEDA is the primary federal statute that applies to our private-sector activity.

Read our Terms & Conditions →

↑ Back to top