Privacy policy

1. Two roles

ExplicaHub is used by organizations (tutors, tutoring centres and schools) to run their work, so we handle personal data in two roles.

As controller, for the data we need to run ExplicaHub ourselves: accounts, sign-in and security, the emails we send about your account, and your contacts with us. This policy covers that data in full.

As processor, for the data an organization keeps about its students, guardians and team. The organization is the controller of that data, and decides what it keeps and why. We process it on its behalf, under the data processing terms of our Terms of service (section 14). If you are a student, a guardian or a member of an organization's team, contact the organization first about that data. If you write to us, we pass your request on to the organization.

2. Who we are

We are the team that runs ExplicaHub.

Privacy contact: ola@explicahub.com.

3. What we collect when you use ExplicaHub

• Account: your name, email address, language and timezone; your password, stored only as an Argon2id hash, which cannot be read back; for two-factor authentication, the authenticator secret (encrypted) and your recovery codes (stored only as hashes); when you accepted our terms, and which version.
• Sign-in and security: for each signed-in device, a session with its IP address, the browser's description (user agent), when it started and when it was last used; the one-time links we email you (to confirm your email, reset your password or sign in), stored only as hashes; and our technical logs of the requests made to our servers (address, time, what was requested and the result), with tokens and passwords removed.
• Memberships: the organizations you belong to and your role in each. For tutors, the profile the organization shows: name, photo, bio, subjects, levels, working hours and video provider.
• Connected accounts, only if you connect one: the account's email address, the access tokens the provider gives us (encrypted), the list of your calendars, the busy times (start, end and title) of the calendars you choose to check, and the events and meetings we create for your lessons.
• Your contacts with us: what you write to us, and our answers.
• Error reports: when the app fails in your browser, it may send us a technical report (the error, the page and a request reference), with email addresses, tokens and anything typed in forms removed.

We do not use analytics or advertising trackers, and we do not sell personal data.

4. What organizations keep in ExplicaHub

As processor, we keep what an organization decides to keep. Typically:

• students: name, date of birth, contacts, address, school and level, photo, status, tags and custom fields, private notes, documents, and the tutors assigned;
• guardians: name, relationship, contacts, address, and the students they are linked to; families;
• lessons: dates, tutor, participants, attendance, cancellations, lesson records (topics covered, summaries, notes) and video links;
• payments: prices, what is owed, what was paid and how, packs, credits and plans. ExplicaHub does not process card or bank account details;
• team: members' names, contacts, roles, profiles and working hours;
• the change history (audit log): who changed what, and when.

The organization's own privacy information explains how it uses them.

5. Why we use your data, and on what basis

• To provide ExplicaHub: create and secure your account, sign you in, show you your organizations, send the emails the service needs, and sync the accounts you connect. Basis: performance of our contract with you (GDPR, article 6(1)(b)).
• To keep ExplicaHub secure and working: sessions and the list of your devices, limits on repeated attempts, logs, backups, error reports, and preventing abuse. Basis: our legitimate interest in a secure and reliable service (article 6(1)(f)).
• To answer and support you. Basis: performance of the contract, or our legitimate interest.
• To meet legal obligations, for example keeping accounting records or answering the authorities. Basis: legal obligation (article 6(1)(c)).

We do not send marketing emails. If we ever want to, we will ask for your consent first.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

6. Cookies and storage in your browser

ExplicaHub uses only what it needs to work, so it does not ask for consent to cookies:

• sid: your session, so that you stay signed in. It cannot be read by scripts, is sent only over secure connections, and ends when you sign out, after 14 days without use, and at the latest after 90 days;
• XSRF-TOKEN: protects what you send against cross-site request forgery;
• the browser's storage, for your preferences and work in progress on that device: the language, the last organization you opened, the calendar view, whether the side menu is collapsed, drafts of lesson records, and the steps of forms you have not finished.

You can clear them in your browser at any time. You will then have to sign in again.

7. Who we share data with

Our service providers (sub-processors), which host and run ExplicaHub for us, only as far as needed and under contracts that protect the data:

• encryption keys: Amazon Web Services (AWS Key Management Service);
• our website, explicahub.com, and the count of its visits: Cloudflare (Cloudflare Pages and Cloudflare Web Analytics), on its worldwide network (section 14).

Google, Microsoft and Zoom, only when you connect an account, and only what the connection needs: the lessons we add to your calendar (the service, the time, the place or the video link, and, if you choose so in the sync settings, the students' names and, for Google, the families' email addresses as guests), and the meetings we create. These companies act as independent controllers under their own privacy policies.

The organizations you belong to: their owner and team see your name, role and profile, as their roles allow.

Visitors of a public booking page, if you publish one: what the page shows.

Authorities, when the law requires it.

8. Transfers outside the European Economic Area

We choose providers that keep the data in the European Economic Area. When data leaves it, for example when you connect a Google, Microsoft or Zoom account, we transfer it only to a country covered by an adequacy decision of the European Commission (such as the United States, for companies certified under the EU-U.S. Data Privacy Framework), or under the European Commission's standard contractual clauses with the additional measures they require.

9. How long we keep data

• Account: while your account exists. If you ask us to delete it, we do so within 30 days, except what the law requires us to keep.
• Sessions: they end after 14 days without use, and at the latest after 90 days. Ended sessions are deleted every day.
• One-time links (email confirmation, password reset, sign-in): they expire, and expired ones are deleted every day.
• Connected accounts: until you disconnect them. The tokens are then deleted, and so are the busy times imported from that account.
• Backups: encrypted, and kept away from our servers. We keep the last 7 daily backups, and older copies are removed from the backup storage within 30 days. Data deleted from ExplicaHub therefore disappears from the backups within about 37 days.
• Organization data: for as long as the organization uses ExplicaHub, as the organization decides. When an organization closes, we delete its data once the 30 days it has to ask for a copy have passed (Terms of service, section 11), and it then disappears from the backups as they expire.

10. Security

• Every connection is encrypted (HTTPS).
• Passwords are stored as Argon2id hashes, and sessions, one-time links and recovery codes as hashes.
• Authenticator secrets and connected-account tokens are encrypted, with keys kept in a key management service.
• Each organization's data is kept apart by the database itself (row-level security), in addition to the app's own checks.
• Two-factor authentication is available for every account.
• Backups are encrypted and stored with a different provider from our servers.
• The one-time codes in email links are removed from the address bar and from our logs.
• Only the people who need it to run the service have access to our servers.

11. Your rights

Under the GDPR, you have the right to:

• access your personal data and get a copy of it;
• have it corrected;
• have it deleted;
• restrict its use, or object to it, in particular where we rely on our legitimate interests;
• receive the data you gave us in a machine-readable format, and have it sent to another controller;
• withdraw a consent at any time, where we rely on consent.

You can see and correct most of your account in the app, under My account. For anything else, write to ola@explicahub.com. We answer within one month, and we may ask you to confirm who you are.

For the data an organization keeps about you (section 4), contact that organization: it decides on the request, and we help it.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt), or to the authority of the country of the European Union where you live or work.

12. Children

Staff accounts are for people aged 18 or over. Organizations may keep data about students who are children, and may give them a login. The organization is responsible for informing their parents or guardians and, where the law requires it, for obtaining their consent; in Portugal, before giving a login to a child under 13. We use children's data only to provide the service to the organization, never for marketing or profiling. A public booking page never shows data about students.

13. Changes to this policy

When we change this policy, we publish the new version here with its date, and we tell you about important changes by email or in the app before they apply.

14. Our website

The website explicahub.com presents the service. It is hosted by Cloudflare (Cloudflare Pages), which, like any server, receives the IP address and the browser of each visitor so that it can deliver the pages.

• The website sets no cookies, stores nothing in your browser, and has no advertising or tracking tools.
• We count visits with Cloudflare Web Analytics, without cookies: the page viewed, the page you came from, the country, the browser, the type of device and how long the page took to open. It builds no profile of anyone and does not follow a person from one site to another.
• The website has no forms. To ask for a demo, its button takes you to the service's own form, and what you write there is handled as this policy describes.

We do this on the basis of our legitimate interest in keeping the website available and secure and in knowing which pages are read.

15. Contact

Write to us at ola@explicahub.com.