Privacy Policy

This Privacy Policy explains how Quanta Educational Center (“Quanta”, “we”, “us”) collects, uses, shares, secures and retains personal data when you use quantaonline.net and our tutoring services (the “Platform”), and what rights you have over that data.

It applies to students, the parents and guardians who hold their accounts, tutors, and visitors to our website. It sits alongside our Terms of Service and Cookie Policy.

The data controller for the personal data described in this policy is:

Our offices

Where a tutor uses the Platform to teach, we remain the controller of the account, booking and session data held on our systems.

Data you give us

• Account details — name, email address, password (stored only as a salted hash), profile photo, time zone, preferred language, and for parents the student’s first name and year group.
• Learning profile — curriculum, subjects, target grades, exam dates and the goals you tell your tutor.
• Tutor onboarding data — qualifications, teaching experience, identity and right-to-work documents, background check results, and payout details.
• Content you create — messages, homework uploads, notes, quiz answers, reviews and support tickets.

Data generated by using the Platform

• Booking and progress data — sessions booked, attended and cancelled, lesson completion, quiz scores and tutor feedback.
• Session recordings — video, audio, chat and any shared screen from a live lesson, where recording is enabled and everyone present has been notified.
• Technical data — IP address, device and browser type, operating system, referring page, pages viewed and timestamps, collected through our own logs and the cookies described in the Cookie Policy.

Payment data

When you pay, our payment processors collect your card or account details directly. We never receive or store your full card number, expiry date or security code. We keep only the transaction amount and currency, date, status, card brand, last four digits, an opaque processor token, and the billing name and country needed for tax and fraud checks.

Data we do not want

Please do not send us special-category data — health, religion, ethnicity, political views — unless we specifically ask for it to arrange access accommodations, in which case we ask for your explicit consent first and store it separately with restricted access.

Quanta offers “Sign in with Google” so you can create and access your account without another password. Using it is entirely optional — email-and-password registration is always available.

The Google scopes we request

Those three scopes are the only ones we request, and the five fields above (sub, email, given_name, family_name, picture) are the only Google data we retain. We do not request access to Gmail, Drive, Calendar, Contacts, or any other Google service, and we verify that every access token presented to us was issued for the Quanta application before we act on it.

Disconnecting Google

You can revoke Quanta’s access at any time at myaccount.google.com/permissions. Revoking access stops future sign-ins through Google; set a password first so you do not lose access to your Quanta account. To delete the Google data we already hold, delete your Quanta account or email privacy@quantaonline.net.

We only process personal data where we have a lawful basis to do so. The table sets out each purpose and the basis we rely on under the GDPR and equivalent laws.

Automated decision-making

We use automated rules to score payments for fraud risk and to rank tutor search results. Neither produces a legal or similarly significant effect on you without human review — if a payment is declined by our fraud rules you can ask us to look at it again by emailing support@quantaonline.net. We do not use your data to train third-party AI models.

We do not sell personal data and we do not share it for cross-context behavioural advertising. We share it only with the categories of recipient below, each under a written contract that limits them to our instructions.

We operate from Qatar and Egypt, and our students, tutors and service providers are spread across many countries, so your data may be processed outside the country where you live. Where we move personal data out of the European Economic Area or the United Kingdom, we rely on an adequacy decision where one exists, and otherwise on the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), combined with encryption in transit and at rest. You can request a copy of the safeguards we use by emailing privacy@quantaonline.net.

Many of our students are under 18, and we design for that. A parent or legal guardian must hold the account, accept the Terms and provide consent before a child uses the Platform.

• We collect the minimum needed to teach a child: first name, year group, curriculum and progress. We do not ask children for a home address or a phone number.
• We never send marketing to a known child, and we do not profile children for advertising.
• A child’s public profile is limited to a first name and initial; full names are visible only to the tutor teaching them and to the parent on the account.
• Parents can review, correct, export or delete their child’s data, and withdraw consent, at any time by emailing privacy@quantaonline.net. Withdrawing consent closes the account.
• We do not knowingly collect data from a child under 13 without verifiable parental consent. If we discover we have, we delete it promptly.

We keep personal data only as long as we need it for the purpose we collected it, then delete or irreversibly anonymise it.

• All traffic to and from the Platform is encrypted with TLS 1.2 or above.
• Passwords are stored as salted bcrypt hashes and are never recoverable in plain text, even by us.
• Databases, file storage and session recordings are encrypted at rest, and backups are encrypted and access-controlled.
• Staff access is role-based and granted on a least-privilege, need-to-know basis, with multi-factor authentication required for administrative accounts.
• Card data never touches our servers — payment fields are hosted by our PCI-DSS Level 1 certified processors.
• We log administrative access, patch dependencies on a regular cycle, and review our controls at least annually.

If a personal data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify affected users without undue delay. To report a vulnerability, email security@quantaonline.net — we will not pursue good-faith researchers who follow responsible disclosure.

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — get a copy of the data we hold about you.
• Rectification — correct data that is wrong or incomplete.
• Erasure — ask us to delete data we no longer need to keep.
• Portability — receive your data in a structured, machine-readable format.
• Restriction and objection — pause our processing, or object to processing based on legitimate interests, including profiling.
• Withdraw consent — at any time, without affecting processing already carried out.
• Non-discrimination — we will never degrade your service because you exercised a privacy right.

How to exercise them

Many of these are self-service: your dashboard lets you edit your profile, download your data and delete your account. For anything else, email privacy@quantaonline.net. We respond within 30 days, free of charge, and may ask you to verify your identity first. If you are unhappy with our response you can complain to your local data protection authority.

If you are in California

You may request disclosure of the categories and specific pieces of personal information we collected in the last 12 months, request deletion or correction, and opt out of any sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not knowingly sell the personal information of anyone under 16. You may use an authorised agent to make a request on your behalf.

We use cookies and similar technologies to keep you signed in, remember your language, and understand how the Platform is used. Strictly necessary cookies are always on; analytics and preference cookies run only where you allow them. The full list, with purposes and lifetimes, is in our Cookie Policy. We honour Global Privacy Control signals sent by your browser.

We update this policy when our practices or the law change. The “Last updated” date at the top always reflects the current version. For material changes — a new purpose, a new category of recipient, or a change to how Google data is used — we give at least 30 days’ notice by email or in-product notice before the change takes effect, and seek fresh consent where the law requires it.

For any privacy question, request or complaint, contact us — we aim to reply within 5 business days and always within 30 days.