Privacy Policy

1. Introduction

FindGrinds is operated by Matthew Callinan Keenan, a sole trader based in Ireland trading as FindGrinds ("we", "our", or "us"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform at findgrinds.ie (the "Service").

We are the data controller responsible for your personal data. For any privacy-related queries, contact us at: privacy@findgrinds.ie

2. Data We Collect

2.1 Information You Provide

• Account Information: Name, email address, password (stored only as a secure hash), account type (student/parent/tutor)
• Date of Birth (students): Used to work out whether a student is under 18, so that our child-safety protections apply
• Profile Information: Profile photo, and for tutors: bio, headline, qualifications (as entered by the tutor; we do not check them), subjects, levels, area, rates and availability
• Garda Vetting (tutors, optional): A self-declaration made at signup (not shown publicly) and, if you choose to upload one, your vetting document, which we review before showing a "Garda vetted" badge
• Parent Links: If a parent links to a student account using a code the student generates, we record that link
• Messages: Messages sent through FindGrinds between students, parents and tutors
• Session and Purchase Data: Bookings, cancellations, disputes (including any evidence you upload), reviews and ratings, and resources bought or sold
• Reports: Reports you make about messages, reviews or resources, and reports made about you
• AI Assistant Chats: Messages you type into our AI chat assistant
• Payment Information: Card and bank details are collected and held by Stripe, not by us. We keep records of payments, refunds and fees, and Stripe account and customer identifiers.
• Support: Emails you send us

2.2 Automatically Collected Data

• Technical Data: IP address (used, for example, to limit repeated requests and protect against abuse), and the basic technical information your browser sends with each request
• Analytics: If you accept analytics cookies, Google Analytics collects information such as pages visited and device and browser type
• Cookies and Local Storage: See Section 8 and our Cookie Policy

3. How We Use Your Data

We use your personal data for the following purposes:

• Service Delivery: To operate the platform, show tutor profiles, process bookings and purchases, run video sessions, and pay tutors
• Communication: To send account and booking emails (such as confirmations, reminders, cancellations and message notifications) and to respond to you
• Improvement: If you consent to analytics cookies, to understand how the site is used and improve it
• Safety: To protect students, especially those under 18, detect fraud and abuse, review reports, and enforce our Terms (see Section 3.1)
• Legal Compliance: To comply with legal obligations, such as keeping financial records

We do not currently send marketing emails. If we start to, we will only do so with your consent, and you will be able to opt out at any time.

3.1 Safety Measures Involving Messages

• Messages that tutors send to students under 18 are automatically screened for attempts to move contact off FindGrinds (for example, sharing phone numbers or social media handles, or suggesting meeting up). Flagged messages are not blocked, but they are sent to our team for review.
• Any participant in a conversation can report a message. Our team reviews reported and flagged messages, including who sent them and who received them, and may suspend accounts.
• A parent or guardian who links to a student's account can see that student's sessions, purchases, spending and conversations with tutors, and can message tutors on the student's behalf.
• Students under 18 who do not have a linked parent can only send pre-written messages until a parent links to their account.

4. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process your data based on:

• Contract: Processing necessary to provide our services to you
• Legitimate Interests: To keep the platform secure, protect children and other users (including message screening and reviewing reports), and prevent fraud
• Consent: For optional analytics cookies (and marketing, if we ever send it)
• Legal Obligation: To comply with applicable laws

5. Your Rights (GDPR)

Under GDPR, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Portability: Receive your data in a machine-readable format
• Right to Restrict Processing: Limit how we use your data
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time for consent-based processing

You can do some of this yourself in your Account Settings: download a copy of your data (a JSON file containing your profile, date of birth, tutor profile if you have one, sessions, messages you have sent, parent links, purchases, resources, Garda vetting submissions and transactions), and delete your account. For anything else, email us at privacy@findgrinds.ie. We will respond within one month.

6. Data Retention

We retain your personal data for as long as necessary to:

• Provide our services to you
• Comply with legal obligations (for example, keeping financial and tax records)
• Resolve disputes, investigate safety reports, and enforce our Terms

When you delete your account from your Account Settings, we straight away remove your name, email address, password, date of birth, profile photo, tutor profile details, Garda vetting documents and parent links, and cancel any Featured subscription. Your account is replaced by an anonymous "Deleted User" record. Records of past sessions and payments are kept in this anonymised form for financial and legal purposes. Messages you sent are kept, shown as from "Deleted User", so that the other person's conversation history stays intact and so we can investigate safety reports and disputes; their content may still contain anything you wrote in them. Resources a tutor has sold remain available to people who already bought them. Some data may also remain for a limited time in backups, and in records held by our service providers (such as Stripe) under their own legal obligations. If you want us to delete the content of your messages, contact us.

7. Data Security

We implement appropriate security measures including:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing (bcrypt)
• Card and bank details handled by Stripe rather than stored by us
• Uploaded files (such as vetting documents and paid resources) served only through time-limited links
• Access to admin tools restricted to authorised administrators
• Rate limiting on sign-in and other sensitive endpoints

No system is completely secure, but we work to protect your data and will act promptly, including notifying you and the Data Protection Commission where required, if a breach occurs.

8. Cookies

• Necessary (browser storage): We use your browser's local storage to keep you signed in, remember your cookie choices, and remember a tutor invite link you followed. These are needed for the site to work.
• Analytics (only with your consent): Google Analytics cookies, which help us understand how visitors use the site. Google Analytics is not loaded unless you accept analytics cookies.

We do not currently use advertising or marketing cookies. When you pay, you are taken to Stripe's checkout page, and during video sessions our video provider may use its own cookies or storage to run the call. You can manage your choices at any time on our Cookie Policy page or in your browser settings.

9. Third-Party Services

We use the following service providers, who process personal data on our behalf or as needed to provide their service:

• Stripe: Payment processing, tutor payouts (Stripe Connect) and tutor subscriptions. Stripe collects card details and, for tutors, identity and bank details.
• Daily.co: Video calls for online sessions. Sessions are not recorded.
• Resend: Sending account, booking and notification emails
• Railway: Hosting for our backend servers and database (EU – Amsterdam), and storage for uploaded files such as profile photos, vetting documents, dispute evidence and paid resources
• Vercel: Hosting for our website
• Anthropic: Powers our AI chat assistant. Messages you type into the assistant are sent to Anthropic to generate a reply.
• Google (Google Analytics): Website analytics, only if you accept analytics cookies

We share personal data with these providers only as needed for them to provide their services to us. We do not sell your personal data. Other users see the information you choose to put on your profile, and the information needed to arrange and deliver sessions. We may also share data where the law requires it, or where needed to protect someone's safety.

10. International Transfers

Our main database is hosted in the European Union (Amsterdam). Some of our service providers, including Anthropic (which is based in the United States), may process data outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

11. Children's Privacy

Students on FindGrinds may be under 18. Students under 18 must have the permission of a parent or guardian to use FindGrinds. We ask students for their date of birth so that extra protections apply to under-18s: tutor messages to them are screened (see Section 3.1), and until a parent or guardian links to their account they can only send pre-written messages. A linked parent or guardian can see the student's sessions, purchases, spending and conversations with tutors.

A parent or guardian can contact us at privacy@findgrinds.ie to exercise data rights on behalf of their child, or if they have any concerns about their child's data.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or a prominent notice on our website. Continued use of the Service after changes constitutes acceptance.

13. Contact Us

For privacy-related inquiries or to exercise your rights: