Privacy policy

Who we are

Lecto is a service for private tutors: schedule, payment tracking and messages to parents. It is run by Vitalie Driga (private individual), Republic of Moldova. For any question about data, write to hello@lecto.md.

Whose data, and who is responsible

We process the tutor's own data (account and settings) as the controller, to run the service.

Students' and parents' data is entered by the tutor. The tutor is responsible for it; Lecto stores and processes it on the tutor's behalf and only to run the service. The tutor must have the right to enter this data and to message parents — for example, their consent. Students are often minors: enter only what lessons require.

What we keep

• Tutor: name, email, password (hashed only) or Google sign-in, time zone, currency, language, settings, and the Telegram chat with our bot if you connect it.
• Sign-in: sessions with IP address and browser details — to keep you signed in and to spot suspicious sign-ins.
• Students: name, lesson price, notes, schedule, lessons and their status, lesson notes.
• Parents and other contacts: name, role, email, message language, and the Telegram chat with our bot if connected.
• Money: payments, lesson packages, charges and adjustments — amounts and dates.
• Parent page: personal links and one-time sign-in codes (hashed only), the parent's actions — cancellations, reschedule requests, payment reports.
• Notification log: what we sent, to whom and when.

We do not store payment cards and do not take payments — lesson fees go to the tutor directly.

Why

• To keep the schedule, mark lessons and calculate balances.
• To send lesson reminders, package alerts and the monthly report to parents whose notifications the tutor turned on.
• To tell the tutor about parents' actions.
• To give a parent access to their page.
• To protect accounts and the service from abuse.

We do not sell data, show ads or use the data for anything else.

Who we share it with

Only those the service cannot work without:

• Hosting, where the database lives and the service runs: IPHOST (iphost.md), Republic of Moldova. Moldova is outside the EU: for users in the EU this is a transfer of data outside the Union, and we protect the data as the GDPR requires.
• Resend (resend.com) — to deliver emails (reminders, sign-in codes, password resets). Emails are sent from its EU servers; the company is registered in the USA.
• Cloudflare — the domain's DNS, forwarding of emails to hello@lecto.md and storage of database backups.
• Telegram — the text of messages, if you or a parent connected the bot.
• Google — if you sign in with a Google account.

Data may also be disclosed to a public authority where the law requires it.

Cookies and browser storage

We use only necessary cookies: the tutor's session and the parent page session (up to 180 days). The browser also keeps your chosen language and theme. No analytics or advertising cookies. Fonts are served from our own servers.

How long we keep it

For as long as the tutor's account exists. Deleted students and contacts are removed with their data; payment records stay in a student's history while the student exists. Sign-in codes work for 10 minutes; parent page links until the tutor revokes them. You can delete your account in the settings: the data is erased at once and disappears from backups within 14 days.

Your rights

You can find out what data we hold about you, correct it, get a copy, restrict processing or have it deleted. Tutors can change and delete students' and contacts' data in the app themselves. Parents can most easily ask their tutor, or write to us at hello@lecto.md — we reply within 30 days. You can also complain to the data protection authority in your country.

Security

Connections are encrypted (HTTPS); passwords, links and codes are stored only as hashes; only the account owner, and the service itself to run, can access the data.

Changes

If this policy changes, we update this page and the date above, and tell tutors about important changes in advance.