Privacy Policy
Last updated: 19 October 2026
Contents
- 1. Introduction
- 2. Data Controller
- 3. Data We Collect
- 4. How We Use Your Data
- 5. Legal Basis for Processing
- 6. Third-Party Services
- 7. Data Sharing and Transfers
- 8. Data Retention
- 9. Your Rights Under GDPR
- 10. Cookies
- 11. Data Security
- 12. Children's Privacy
- 13. Changes to This Policy
- 14. Contact and Complaints
1. Introduction
GrindSpot ("we", "our", "us"), operated by Softlab Software Solutions Limited, is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your personal data when you use the GrindSpot platform at grindspot.ie or the GrindSpot mobile app for iPhone, iPad and Android (together, the "Platform").
This policy is prepared in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Act 2018, and the ePrivacy Directive 2002/58/EC (as transposed into Irish law).
Please read this policy carefully. By using the Platform, you acknowledge that you have read and understood how we process your personal data as described herein.
2. Data Controller
The data controller responsible for your personal data is:
Softlab Software Solutions Limited
Kilcash, Rahara, Roscommon, F42 TW60, Ireland
Company registration no. 792876 · VAT no. IE4458879TH
Email: info@grindspot.ie
If you have any questions about how we handle your personal data, or wish to exercise your data protection rights, please contact us using the details above.
3. Data We Collect
We collect and process the following categories of personal data:
| Category | Data Collected | Source |
|---|---|---|
| Account Data | First name, last name, email address, phone number, password (stored as a bcrypt hash), date of birth (to check whether a parent or guardian must give consent), school year and subjects | Provided by you at registration |
| Profile Data | For tutors: qualifications, education, subjects taught, years of experience, location (county), bio, headline, hourly rate, profile photo, Garda vetting status | Provided by you |
| Booking Data | Session dates, times, subjects, exam levels, session type, student notes, booking status | Generated through Platform use |
| Parent or Guardian Data | For students under 16: the parent or guardian's name, email address, relationship to the student, phone number (optional), and a record of when consent was given or withdrawn. For parent accounts: the children linked to the account and lesson approvals. | Provided by the student or the parent |
| Payment Data | Transaction amounts, payment status, Stripe customer IDs, Stripe Connect account IDs. We do not store credit/debit card numbers, CVVs, or full card details. | Generated through Stripe |
| Communication Data | Messages sent between users on the Platform, contact form submissions | Provided by you |
| Usage Data | IP address, browser type and version, device type, operating system, pages visited, session duration, referral source | Collected automatically via server logs |
| Lesson Data | Lesson titles, descriptions, uploaded files, homework set, homework answers and photos or files handed in, marks and feedback, tutors' progress notes, the textbook used | Provided by users |
| Live Video Lessons | Audio, video, screen sharing and the shared whiteboard are streamed between the people in the lesson and are not recorded or stored. We keep only the time each person joined and left, to confirm that the lesson took place. | Generated during the lesson |
| Mobile App Data | A notification token for your device, the device type and operating system, and your notification preferences. The app does not use advertising identifiers, location or analytics tracking. | Collected by the app, with your permission for notifications |
4. How We Use Your Data
We use your personal data for the following purposes:
4.1 Service Delivery
- Creating and managing your user account
- Facilitating bookings between students and tutors
- Processing payments and managing tutor payouts
- Enabling communication between users via our messaging system
- Providing lesson management and progress tracking tools
4.2 Communications
- Sending booking confirmations, reminders, and updates
- Responding to your contact form enquiries and support requests
- Sending service-related notifications (e.g., new messages, booking status changes)
- Sending occasional product updates and announcements (you may opt out at any time)
4.3 Platform Improvement
- Analysing usage patterns to improve Platform functionality and user experience
- Monitoring Platform performance and diagnosing technical issues
- Conducting internal analytics and research
4.4 Safety and Compliance
- Detecting and preventing fraud, abuse, and security threats
- Enforcing our Terms of Service
- Complying with applicable legal obligations
5. Legal Basis for Processing
Under GDPR, we process your personal data on the following legal bases:
| Legal Basis | Examples |
|---|---|
| Performance of a contract (Art. 6(1)(b)) | Account creation, booking management, payment processing, tutor payouts |
| Consent (Art. 6(1)(a)) | Marketing emails, non-essential cookies (if applicable) |
| Legitimate interests (Art. 6(1)(f)) | Platform improvement, fraud prevention, analytics, customer support |
| Legal obligation (Art. 6(1)(c)) | Tax and financial record-keeping, responding to law enforcement requests |
Where we rely on consent, you may withdraw it at any time by contacting us at info@grindspot.ie or using the unsubscribe link in our emails. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
6. Third-Party Services
We use the following third-party service providers who may process your personal data on our behalf:
6.1 Stripe (Payment Processing)
Stripe, Inc. processes all payments on the Platform. When you make a payment or register as a tutor to receive payouts, your payment information is handled directly by Stripe. We do not have access to your full card details. Stripe is PCI-DSS Level 1 certified. Please refer to Stripe's Privacy Policy for details on how they handle your data.
6.2 Brevo (Email Communications)
Brevo (formerly Sendinblue) is used to send transactional emails such as booking confirmations, password reset emails, and service notifications. We share your email address and first name with Brevo solely for the purpose of delivering these communications. Please refer to Brevo's Privacy Policy for details.
6.3 Expo (Mobile App Notifications)
When you allow notifications in the GrindSpot app, notifications (for example a new message or a lesson reminder) are delivered through Expo's push service, operated by 650 Industries, Inc. (USA), which passes them to Apple Push Notification service or Google Firebase Cloud Messaging. These services receive your device's notification token and the text of the notification, and nothing else about your account. Please refer to Expo's Privacy Policy.
6.4 Live Video Lessons
Live lessons run on a video server operated for GrindSpot, not on a public video service. Entry to each lesson is limited to the people booked into it. Lessons are not recorded.
6.5 Google Analytics (Website Only, With Consent)
If you accept analytics cookies on grindspot.ie, Google Analytics 4 (Google Ireland Limited) measures how the website is used, for example which pages are visited. It is not loaded unless you agree, and it is not used in the mobile app. You can change your choice at any time from the cookie banner.
6.6 Cloudflare (Security and Delivery)
Cloudflare, Inc. protects the website from attacks and delivers its pages quickly. It processes technical data such as IP addresses for this purpose only.
6.7 Hosting Provider
Our Platform is hosted on servers located within the European Economic Area (EEA). Your data is stored on these servers and is subject to the security measures described in this policy.
All third-party providers are bound by data processing agreements and are required to process your data only as instructed by us and in compliance with GDPR.
7. Data Sharing and Transfers
We do not sell, rent, or trade your personal data to third parties.
We may share limited personal data in the following circumstances:
- Between users: When a booking is made, we share relevant information (name, session details) between the student and tutor to facilitate the lesson.
- Service providers: With trusted third-party providers (Stripe, Brevo, Expo, Google, Cloudflare) as described above, under data processing agreements.
- Parents and guardians: A linked parent or guardian can see their child's lessons, payments, homework titles, due dates and marks, and what tutors write after a lesson. They cannot read the child's private messages or the child's own answers.
- Legal requirements: If required by law, regulation, court order, or governmental request, we may disclose your data to the relevant authority.
- Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction. We will notify you of any such transfer.
International Transfers
Some of our third-party providers (e.g., Stripe, Expo and Cloudflare) may transfer data outside the EEA. Where this occurs, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or the provider's participation in an approved certification framework.
8. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:
| Data Type | Retention Period |
|---|---|
| Account data | For the duration of your account, plus 30 days after deletion request |
| Booking and lesson data | 6 years after the session date (for tax and legal compliance) |
| Payment transaction records | 6 years (Irish Revenue requirements) |
| Messages | For the duration of both users' accounts |
| Contact form submissions | 2 years from submission |
| Server logs and usage data | 12 months |
After the retention period expires, data is securely deleted or anonymised. You may request earlier deletion of your data by contacting us, subject to our legal obligations to retain certain records.
9. Your Rights Under GDPR
As a data subject under GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): You have the right to request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): You have the right to request correction of any inaccurate or incomplete personal data.
- Right to erasure (Art. 17): You have the right to request deletion of your personal data where there is no compelling reason for continued processing ("right to be forgotten").
- Right to restrict processing (Art. 18): You have the right to request that we restrict the processing of your personal data in certain circumstances.
- Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another data controller.
- Right to object (Art. 21): You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
You can delete your account at any time from the mobile app (Account, then Delete account) or by emailing us. To exercise any of these rights, please contact us at info@grindspot.ie. We will respond to your request within 30 days as required by GDPR. We may request verification of your identity before processing your request.
If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Data Protection Commission (DPC) of Ireland:
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Website: www.dataprotection.ie
Phone: +353 (0)1 765 0100 / 1800 437 737
10. Cookies
We use a limited number of essential cookies to ensure the Platform functions correctly. These include session cookies (for authentication) and CSRF protection tokens.
With your consent only, we use Google Analytics cookies on the website to understand how it is used (see section 6.5). We do not use advertising cookies. The mobile app does not use cookies for tracking.
For full details on the cookies we use and how to manage them, please refer to our Cookie Policy.
11. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
- Encryption: Passwords are stored using bcrypt hashing. All data is transmitted over HTTPS/TLS.
- CSRF protection: All forms are protected with CSRF tokens to prevent cross-site request forgery.
- Access controls: Access to personal data is restricted to authorised personnel on a need-to-know basis.
- Payment security: All payment data is handled by Stripe, which is PCI-DSS Level 1 certified. We never store full card details.
- Regular updates: We maintain and regularly update our software and server infrastructure to address security vulnerabilities.
While we take reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
12. Children's Privacy
GrindSpot is used by secondary school students, so we take particular care with children's data.
- Students aged 13 to 17 can have their own account, but they cannot book a lesson or message a tutor until a parent or guardian has given consent. We ask for the parent or guardian's email address at registration and send them a request to approve.
- Children under 13 cannot create their own account. They use GrindSpot through a parent's account, and the parent books, pays and can join the lesson on the child's behalf.
- A parent or guardian can withdraw consent at any time from their account, which stops new bookings and messages.
- Tutors see only what they need to teach: the student's first name, school year, subjects, and the parent's first name. They never receive a parent's email address or phone number.
If you believe we hold a child's data without the right consent, please contact us at info@grindspot.ie and we will act on it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify registered users via email
- Post a prominent notice on the Platform
We encourage you to review this policy periodically.
14. Contact and Complaints
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Softlab Software Solutions Limited
Kilcash, Rahara, Roscommon, F42 TW60, Ireland
Company registration no. 792876 · VAT no. IE4458879TH
Email: info@grindspot.ie
Web: grindspot.ie
You also have the right to lodge a complaint with the Irish Data Protection Commission at any time (see Section 9 above for contact details).
