Privacy Policy
Effective October 6, 2026
This Privacy Policy explains how Ivy Tutoring, LLC, an Arkansas limited liability company doing business as Ivy Tutoring and IvyMed (“we”, “us”, “our”), collects, uses, shares and protects personal information when you use ivymed.net, the app pages on ivytutoring.net, the IvyMed app, the Board Buddy browser extension, our tutoring sessions and group classes, and related emails and messages (the “Services”). Our Terms of Service also apply. Questions: hello@ivytutoring.net.
1. Information we collect
Information you give us
- Account details: name, email, password (stored by Firebase Authentication, never by us in plain text) or your Google / Facebook sign-in.
- Profile and enrollment: phone number, school or program, exam and exam date, goals, availability, and for students under 18 the parent or guardian’s contact details.
- Study data: questions you answer, your answers, time spent, scores (including practice-exam scores you or your tutor record), notes, flashcards and study plans.
- Payments: handled by Stripe. We receive your name, email, what you bought and payment status, never your full card number.
- Messages: what you send us or your tutor by email, text, WhatsApp, in-app chat or to an AI feature.
Information collected automatically
- Device, browser, IP address, pages and features used, and error logs, collected by our hosting and database providers to run and secure the Services.
- Cookies and local storage needed to keep you signed in and remember preferences. ivymed.net does not use advertising pixels or third-party ad trackers. ivytutoring.net uses Google Analytics to measure site traffic.
Board Buddy browser extension
If you install Board Buddy, it captures the questions you view, the answer choices, the answers you select and whether they were correct on supported third-party question banks, so it can build your personal analytics and so your tutor can see where you need help. It only runs on the supported question-bank sites, and it does not collect your passwords for those sites. If you use Board Buddy’s voice features, your voice input is processed by our AI providers to transcribe and answer it, and we may keep the audio or transcript with the interaction record. You can uninstall the extension at any time.
Session recordings
We record tutoring sessions and group classes (video, audio and chat), normally through Zoom’s cloud recording. You see a notice before you join a classroom session. Recordings are stored in our Zoom account and may be copied to our private, access-controlled cloud storage. Access is limited to the student, their tutor and Ivy Tutoring staff. We keep recordings for about 12 months, unless we need them longer for a dispute, a legal obligation or because you asked us to. Recordings of students under 18 are never published. We ask for consent before publishing any recording of anyone. Any student can ask their tutor to stop recording, or opt out of recording or publication at any time, by telling their tutor or emailing hello@ivytutoring.net; the opt-out applies from then on.
2. How we use information
- To provide the Services: accounts, question banks, analytics, study plans and calendars, tutoring, group classes and recordings.
- To match students with tutors and share what a tutor needs to teach (name, exam, goals, scores, weak areas, session notes).
- To process payments, keep records and handle disputes and chargebacks.
- To send account, schedule and billing messages, and marketing only where permitted (you can opt out at any time; reply STOP to texts).
- To secure, debug and improve the Services, and to comply with the law and enforce our Terms.
3. AI features
Several features use AI: question explanations, the AI tutor and “explain my mistake”, study plans and plan reviews, calendar assistants, and progress and weakness reports. To produce them, the relevant content — for example the question, your answer, your scores and performance summaries, and the message you typed — may be sent to our AI providers: OpenAI, Anthropic and Google (Gemini). We use these providers through their business APIs, and under their API terms they do not use that data to train their models. We send what the feature needs, not your password or payment details. AI output can be wrong; it is educational only and is not medical advice.
4. How we share information
We do not sell personal information. We share it only:
- With service providers (listed below) who process it for us under contract.
- With your tutor, and for students under 18 with the enrolling parent or guardian.
- With the payer (for example a parent) about the plan they paid for.
- For legal reasons: to comply with law or valid legal process, to protect rights and safety, or to respond to disputes and chargebacks.
- In a business transfer, such as a merger or sale of assets, subject to this Policy.
Mobile numbers and text-message opt-in consent are never shared with third parties or affiliates for their marketing.
Service providers
| Provider | What we use it for | Information involved |
|---|---|---|
| Google Firebase / Google Cloud | Sign-in (Firebase Authentication), app database (Firestore), file storage and server functions | Account details, study activity, answers, scores, plans, settings |
| Supabase | Learning-management database and Board Buddy back end | Account and enrollment details, practice activity, Board Buddy question history |
| Vercel | Website hosting and server-side code | Request data such as IP address, browser and pages requested (server logs) |
| Stripe | Payments, subscriptions and receipts | Name, email, billing details and payment history (we never see or store full card numbers) |
| Airtable | Student, family and tutor records; scheduling and session notes | Contact details, plan, tutor, sessions, attendance, session recaps and scores you report |
| n8n (self-hosted on our own server) | Automations that send emails and messages and keep our records in sync | The records above as they move between our systems |
| Zoom | Live 1-on-1 sessions and group classes, including cloud recordings | Name shown in the meeting, audio, video, chat and recordings |
| Cal.com | Booking calls and sessions | Name, email, phone and the times you book |
| Twilio | Text-message (SMS) reminders and notifications you opt in to | Phone number and message content |
| WhatsApp (Meta) | Student, parent and tutor group chats and messages | Phone number, name and messages |
| Resend and Google Workspace (Gmail) | Transactional email and support email | Email address, name and message content |
| Cloudinary | Image hosting and delivery | Images and media used in the app (normally not personal information) |
| YouTube (Google) | Embedded lesson videos | When you play an embedded video, YouTube may set its own cookies and receive your IP address under Google’s privacy policy |
| OpenAI, Anthropic and Google (Gemini) | AI features: explanations, the AI tutor, study plans, plan reviews and progress reports | Questions, your answers, scores, performance summaries and the messages you send to AI features (see “AI features” below) |
5. How long we keep information
- Account and study data: while your account is open. When you delete your account, we remove it from our live systems within 30 days; copies in backups and logs may remain for up to 90 more days before they are overwritten.
- Session recordings: about 12 months (see above).
- Payment, purchase and tax records: up to 7 years, as tax and accounting law requires.
- Tutoring records (sessions, attendance, recaps, communications): for the length of your plan and up to 3 years after, for records and disputes.
We may keep information longer when the law requires it or to resolve a dispute.
6. Security
We use encryption in transit, access controls, per-user database security rules and limited staff access. No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a breach that affects you, we will notify you as the law requires.
7. Children and students under 18
Children under 13 may not use the Services without verifiable consent from a parent or guardian, and we do not knowingly collect personal information from a child under 13 without it. Services for students aged 13 to 17 must be purchased by, and used with the permission of, a parent or legal guardian, who can review or delete the student’s information by contacting us. If you believe a child under 13 gave us information without that consent, email hello@ivytutoring.net and we will delete it.
8. Your choices and rights
- Delete your account: signed in, go to Settings → Delete my account. It deletes your login and study data right away.
- Other requests (copy, correction, deleting specific data, recordings): use the privacy request form or email hello@ivytutoring.net.
- Marketing: use the unsubscribe link in any marketing email, or reply STOP to texts.
Deleting an account does not cancel or refund past purchases (all purchases are final under our Terms); an active subscription is set to stop renewing.
9. California privacy rights (CCPA / CPRA)
If you are a California resident, this section applies to you in addition to the rest of this Policy.
Personal information we collected in the last 12 months
| Category | Examples | Business purposes |
|---|---|---|
| Identifiers | Name, email, phone number, account ID, IP address | Accounts, delivering the Services, communication, security |
| Customer records (Cal. Civ. Code §1798.80(e)) | Name, contact details, billing details | Payments, scheduling, support |
| Protected classification characteristics | Age or date of birth (to confirm eligibility or a parent’s consent) | Eligibility and parental consent |
| Commercial information | Plans purchased, payment and subscription history | Fulfilling purchases, records, disputes |
| Internet or network activity | Pages and features used, device and browser data, logs | Operating, securing and improving the Services |
| Audio, electronic and visual information | Session recordings, Board Buddy voice input | Live tutoring, student review, quality and records |
| Education information | Questions answered, answers, scores, exam dates, study plans, session notes | Personalized studying, tutoring, progress reports |
| Inferences | Weak and strong topics, predicted readiness | Personalizing study plans and tutoring |
| Sensitive personal information | Account login (email and password) | Signing you in only; we do not use sensitive information to infer characteristics about you |
Sources: you, your parent or guardian or the person who paid, your tutor, your devices, and Board Buddy on supported question banks. Disclosures: each category may be disclosed to the service providers above for the business purposes listed. Retention periods are in Section 5.
No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising (ivymed.net has no advertising pixels). We have not done so in the past 12 months, and we do not knowingly sell or share the information of consumers under 16. We do not use or disclose sensitive personal information for purposes that would give you a right to limit it.
Your rights
- Know / access: the categories and specific pieces of personal information we hold about you, its sources, purposes and who we disclose it to.
- Delete personal information we collected from you, subject to legal exceptions (for example payment records).
- Correct inaccurate personal information.
- Opt out of sale or sharing, and limit use of sensitive personal information. We do neither, but you may still submit a request and we will honor it, including browser opt-out preference signals such as Global Privacy Control.
- Non-discrimination: we will not deny service, charge different prices or provide a different quality of service because you exercised these rights.
How to submit a request
Use the privacy request form or email hello@ivytutoring.net. We will confirm receipt within 10 business days and respond within 45 days (we may extend once by 45 days and will tell you if we do). To protect you, we verify your identity by confirming you control the email on the account, and we may ask for more information for requests for specific pieces of information. Authorized agents may submit a request for you with your signed permission; we may ask you to verify your identity with us directly and to confirm you gave the agent permission. A parent or guardian may submit requests for a child.
10. Other U.S. state privacy rights
Depending on where you live (for example Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws), you may have rights to access, correct, delete and get a portable copy of your personal information, and to opt out of targeted advertising, sale and certain profiling. We do not sell personal information or use it for targeted advertising or for profiling that produces legal or similarly significant effects. Submit requests the same way as above. If we deny your request, you may appeal by replying to our decision or emailing hello@ivytutoring.net with “Appeal” in the subject; we will answer within the time your state’s law requires, and if you are not satisfied you may contact your state attorney general.
11. Where information is processed
We are based in the United States, and our providers process information in the United States and other countries. By using the Services from outside the U.S., you understand your information will be processed in the U.S., where data-protection laws may differ from yours.
12. Changes
We may update this Policy. We will change the effective date above and, for material changes, notify you by email or in the app before they take effect.
13. Contact
Ivy Tutoring, LLC (Arkansas) — privacy questions and requests: hello@ivytutoring.net. Account support: support@ivymed.net.