Tuto Privacy Policy

The data controller for the Tuto peer-to-peer skill marketplace application is:

BurmCorp Labs UG (haftungsbeschränkt)
Kollwitzstraße 76
10435 Berlin
Germany

Represented by: Nils Torben Burmeister
Phone: +49 30 20009797
Email: legal@burmcorp.com

Register: Amtsgericht Charlottenburg, HRB 285559 B · VAT ID: DE463621479

Website: https://burmcorp.com · Product: https://burmcorp.com/en/labs/tuto

Tuto is a marketplace application for Apple platforms and related backend services we operate. This policy explains which personal data we process, for which purposes, legal bases under the EU GDPR (DSGVO), retention, and your rights.

We do not sell your personal data. We do not use lesson content or chat for third-party advertising profiles.

Depending on how you use Tuto, we may process:

• Account data — email, display name, password hash (email registration), Sign in with Apple subject identifier, profile fields (bio, city, website, public profile flag), teacher status and skill/offer text, optional verification documents you upload for teacher checks.
• Catalog & discovery — saved teachers, search queries, category interests you set, approximate map coordinates of teachers you view (from their public profile), device locale/timezone as needed to show slots.
• Bookings — who booked whom, offer reference, start/end times, format (online/on-site), price, status lifecycle (requested, confirmed, completed, cancelled, declined), notes.
• Payments — Stripe PaymentIntent identifiers and client secrets for checkout; payment status events via Stripe webhooks. Card details are processed by Stripe, not stored on our servers as full PAN data.
• Chat — messages between learners and teachers in conversations opened for coordination.
• Reviews & ratings — stars and optional text after completed bookings; aggregates on teacher profiles.
• Notifications — in-app notification records; optional push tokens if you enable notifications.
• Gifts — voucher purchase metadata, payment status (pending until paid), redeem codes once activated.
• Technical data — IP address, request logs, app version, device type, correlation IDs for security and debugging.
• Support — content of emails or messages you send to us.

We process data to:

• provide the marketplace (accounts, catalog, bookings, chat, reviews) — Art. 6(1)(b) GDPR;
• process payments and gifts via Stripe — Art. 6(1)(b) GDPR;
• send transactional notices (booking requests, confirmations) in-app and, when configured, by email/push — Art. 6(1)(b) or (f) GDPR;
• secure the service, prevent fraud/abuse, run teacher verification — Art. 6(1)(f) GDPR;
• comply with legal obligations (tax, accounting, requests of authorities) — Art. 6(1)(c) GDPR;
• improve the product in aggregate where compatible with law — Art. 6(1)(f) GDPR.

Where we rely on consent (e.g. optional push, location for “nearby”), you may withdraw it in system or app settings without affecting prior lawful processing.

We use Stripe (Stripe Payments Europe, Ltd. / affiliates) as payment processor for card payments and related marketplace features (including PaymentIntents and Connect-style platform fees when configured). Stripe processes payment data under its own privacy terms. We store payment intent IDs and status needed to match bookings and gifts; we do not store full card numbers on Tuto servers.

Webhook events (e.g. payment succeeded) update booking payment state and may activate gift vouchers that stay non-redeemable until paid.

If you use Sign in with Apple, Apple processes authentication under Apple’s terms; we receive a stable subject identifier and, if you share them, email/name. Email/password accounts store a one-way password hash. Refresh tokens are stored hashed. Password-reset tokens are short-lived and single-use.

Teacher public profiles may include location labels and coordinates you publish as a teacher. Learners may use map views (MapKit / Apple Maps) to explore nearby teachers. Device location permission is optional; without it, discovery still works from catalog data. Directions open in Apple Maps when you choose route.

We use infrastructure and service providers (hosting, databases, object storage if used, email delivery when configured, error monitoring as configured) as processors under Art. 28 GDPR where they process personal data on our behalf. Where data is transferred outside the EEA, we use appropriate safeguards (e.g. Standard Contractual Clauses) as required.

Account and booking data are kept while your account is active and as needed to provide the service, resolve disputes, and meet legal duties (including commercial and tax retention). You may delete your account in the app; we remove or anonymise personal data and related marketplace rows within a reasonable period unless longer retention is required by law or for legal claims. Server logs are retained for a short operational period.

Under the GDPR you have rights including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where processing is based on consent. Contact legal@burmcorp.com.

You may also delete your account in the app (Profile → Delete account).

You may lodge a complaint with a supervisory authority. The competent authority for our company is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
https://www.datenschutz-berlin.de

Tuto is not directed at children under 16. We do not knowingly create accounts for children under 16. If you believe a child has provided us personal data, contact us and we will take appropriate steps.

For the BurmCorp website and general company processing, see the company privacy policy and imprint.

This Tuto policy applies specifically to the Tuto application and related product surfaces (including this Labs product page).

We may update this policy to reflect product or legal changes. The current version is always available at this URL. The date of the last update is noted at the top of this page.