1. Who we are and what this policy covers
This is the privacy policy of the Pitazz platform, at pitazz.co. "We" and "us" mean the operator of Pitazz, whose details are in our Legal notice. We are the data controller responsible for the personal data described in this policy, within the meaning of the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Cap. 586 of the Laws of Malta).
This policy covers the Pitazz service itself: accounts, tutoring requests, quotes, matches, bookings, classes, payments, the messages we send you, and everything that happens once someone creates an account on the Platform.
2. What we collect
2.1 Account information, everyone
When you create an account, we collect your name and email address, and we record which role your account holds (Guardian or Tutor). We do not hold a password: you sign in with a link or a code that we email to you. We also collect a Maltese mobile number, which is required for everyone and confirmed by a code we text to it.
2.2 Guardians and Learners
As a Guardian, we hold your mobile number, which Pitazz alone uses to contact you about your lessons by call, text, or WhatsApp; Tutors never see it. For each Learner you post Requests for, we collect the Learner’s first name only, their level of study (for example, secondary or sixth form), their school year where the level has one, and an optional free-text note about their learning needs. For a minor Learner, we deliberately do not collect a date of birth, surname, or school name: we hold the least amount of information needed to run a lesson, not a profile of the child. If you are an adult learning for yourself, you are your own Learner record.
Each Request you post records its subject, level, school year, mode, locality, lesson type, the language you would like lessons in, the times the Learner is free, any budget you state, and your notes. Matching Tutors see those details and never the child’s name; the Tutor you are matched with reads the child’s first name. In a Class, that Tutor reads the first names of the children in it and whether each has paid; other families see how many places are taken, never names. If you change tutor on a Request and say why, your reason is read by Pitazz only.
2.3 Tutors
If you apply to tutor with Pitazz by emailing tutors@pitazz.co, we keep that email, with the subjects and levels you tell us you teach, to consider your application. As a Tutor, we collect your mobile number (required, confirmed by a texted code), the subjects, levels, lesson types, and localities you teach, your headline and bio, the languages you teach in, an optional photo (which we approve or reject before it is shown), your weekly availability, the video links you save (on your Profile or on a booked lesson), any Classes you make, and your Stripe account status, so that we know when you can be paid; we do not see your bank details, which are held by Stripe. Guardians you have quoted or are matched with see your photo, headline, first name and surname initial, your checked qualifications, the languages you teach in, your bookable times and, on a paid online lesson, your video link; a Guardian comparing quotes sees only whether your next opening falls within her stated times. Nobody else sees your profile.
If you apply to tutor in the app, we keep the link to your short introduction video with your profile. Only Pitazz sees it.
2.4 Verification evidence
Your identity is verified by Stripe, our payment processor, when you set up payouts, under Stripe’s own privacy policy, and checked by us against a photo of your identity document that you upload in the app or email to us. We compare it with your introduction video, or with you if we have met. You may cover the ID number. Documents you upload are stored privately and seen only by Pitazz. How long we keep them is in section 7. To verify a qualification or your police conduct certificate, you upload a copy in the app or email it to verification@pitazz.co, an address kept for these documents alone. We check it by hand and record in the app only what the claim resolves to (for example, "Identity verified" or "BSc Mathematics, University of Malta"), the claim type, and who checked it and when. For a police conduct certificate we record its type, its issue date and the date we checked it. The copy you send is not kept once it has been checked (Section 7). The underlying document is never displayed to anyone.
2.5 Addresses and video links
A Tutor may save video links (Google Meet, Zoom, or Microsoft Teams) in the app; a Guardian who has paid for an online lesson with him sees the link that lesson uses, from payment until 24 hours after it. No address is entered in the app: a Tutor gives us his address by email for lessons at his place, and a Guardian gives us her home address by email for a lesson at her home. We pass each on to the other side by email before the lesson, and hold them in the Pitazz mailbox while your account is active (Section 7).
2.6 Requests, quotes, matches, bookings, classes, and weekly slots
We record the details of any Request you post, any Quote a Tutor submits, the Match formed when a Quote is accepted, each Booking scheduled under a Match, each Class and the places taken in it, and each Weekly Slot, including the price, schedule, and status of each. A Quote message or a Request’s notes that carry a phone number, an email address, a link, or a social media handle are refused when sent, and a message that otherwise appears to attempt to move a conversation off the Platform is flagged for our review; this exists to protect the trust and payment protections described in our Terms of Service. We also record how each account first arrived on the Platform (for example, through a tutor’s invitation or direct sign-up), because commission sourcing depends on it. After each lesson we ask the Guardian and the Tutor whether it happened, and keep each answer, any reason given and when, with the Booking. A Guardian who rates a lesson gives us a rating and an optional comment, kept with that Booking. We show Guardians each Tutor’s average rating and how many ratings they have, once there are 3; we do not show comments, single ratings or who gave them.
2.7 Payments
Payments, refunds, and Tutor payouts are processed by Stripe. We do not store your full card number or bank account details; these are held directly by Stripe under its own security standards, and a Tutor’s payout account is set up through Stripe’s own identity checks. We hold a financial ledger recording the monetary movements themselves (amounts charged, commission taken, refunds issued, payouts made) but not your payment instrument details.
2.8 Messages we send you
We keep a record of every notice we send you in the app and by email, and of every sign-in link or code and texted code, so that we can see what you were told and when.
2.9 Notes we keep
An internal audit log records administrative actions and status changes for accountability; it is not visible to other users. It includes our note, when a late cancellation or a no-show is excused, that a reason was accepted. We do not ask for proof and we do not record what the reason was, so that no health information about a parent or a child is held; the note is shown to nobody.
2.10 Technical and log data
Like almost every website and application, our hosting and infrastructure providers keep standard server logs (including IP addresses) for security and reliability.
3. Why we use your data, and on what legal basis
| What we do | Data involved | Legal basis (GDPR Art. 6) |
|---|---|---|
| Operate your account and let you post or respond to Requests | Account data; Request, Quote, Match, Booking, and Class records | Performance of a contract with you: Art. 6(1)(b) |
| Verify a Tutor’s identity and check qualifications | Verification evidence, claim records | Performance of a contract, and our legitimate interest in platform trust and safety: Art. 6(1)(b), (f) |
| Consider an application to tutor | Your email and what it says | Steps you ask us to take before a contract: Art. 6(1)(b) |
| Take payment for a Booking, make refunds, and pay Tutors | Ledger records; payment details held by Stripe | Performance of a contract: Art. 6(1)(b) |
| Send you notices about your Requests, Quotes, lessons, cancellations, moved lessons, refunds, Weekly Slots, Classes, and payouts, in the app and by email, within about a minute of the event | Email, name, the record concerned | Performance of a contract: Art. 6(1)(b) |
| Sign you in, and confirm your mobile number, by emailed link or code and by texted code | Email, mobile number | Performance of a contract: Art. 6(1)(b) |
| Confirm that a lesson happened | Your answer and any reason | Performance of a contract: Art. 6(1)(b) |
| Answer your questions about a lesson by call, text, or WhatsApp | Mobile number, email, Booking records | Performance of a contract: Art. 6(1)(b) |
| Collect ratings of Tutors, and show each Tutor's average to Guardians | Your rating and comment | Legitimate interests (helping families choose a Tutor): Art. 6(1)(f) |
| Pass on where a lesson happens | Video links saved in the app; addresses held in our mailbox | Performance of a contract: Art. 6(1)(b) |
| Send optional marketing or launch updates | Email, name | Your consent: Art. 6(1)(a) |
| Refuse or flag messages that attempt to share contact details | Message content | Our legitimate interest in protecting the trust and payment mechanisms of the Platform: Art. 6(1)(f) |
| Record that a reason for a late cancellation or no-show was accepted | Audit log entry, without the reason | Performance of a contract, and our legitimate interest in applying the cancellation terms fairly: Art. 6(1)(b), (f) |
| Keep the Platform secure and prevent fraud or abuse | Log data, audit log, account activity | Our legitimate interest in protecting the service and our users: Art. 6(1)(f) |
| Keep financial and tax records | Ledger entries | Compliance with Maltese legal obligations: Art. 6(1)(c) |
| Share information with tax authorities where the law requires it | The information the law asks for | Compliance with a legal obligation: Art. 6(1)(c) |
| Investigate a safeguarding report | Relevant account, message, and booking data | Our legitimate interest in the safety of Learners, particularly minors, and, where applicable, a legal obligation: Art. 6(1)(f), (c) |
You can withdraw consent for marketing at any time by emailing hello@pitazz.co or using the unsubscribe link in any marketing email; this does not affect the lawfulness of anything done before you withdrew it. We do not use your data for automated decision-making that produces legal or similarly significant effects about you: the matching logic that shows a Request to eligible Tutors filters by subject, level, and mode; it does not decide who you must work with, and both Guardians and Tutors retain the final choice over any Quote or Match.
4. Special care around minors’ data
Where a Learner is a minor, the contracting party is always the Guardian, not the child, and we deliberately hold the minimum information needed to run a lesson: a first name, a level, a school year where the level has one, and any note the Guardian chooses to add. We do not collect a minor’s date of birth, surname, school name, or any other identifying detail beyond what is described above. A Request is shown to matching Tutors without the child’s name; the child’s first name is visible only to the Tutor the Guardian is matched with, for the purpose of that Match, and, in a Class, to the Tutor running it.
5. Where your data lives
The Platform’s data is stored in the European Union (Frankfurt, Germany). We use service providers to run Pitazz: for hosting and the database, for payments and payouts (Stripe), for sending email and text messages, and for our own mailboxes. If we message you on WhatsApp, that message passes through WhatsApp. These providers act on our instructions and may not use your data for their own purposes.
Some providers may process data outside the European Economic Area, including in the United States. Those transfers are protected by the safeguards the GDPR requires. A list of our current providers is available on request at hello@pitazz.co.
6. Who we share it with
We do not sell your personal data, and we never will. We do not share it with advertisers, data brokers, or any third party for their own use. Data is shared only:
- With the service providers described in Section 5, acting on our instructions, to run the Platform.
- Between a Guardian and the Tutors she has quotes from or is matched with, to the extent described in Section 2: a Tutor sees a Request’s details and, once matched, the Learner’s first name; a Guardian sees the Tutor’s profile and checked claims, and the languages he teaches in. Contact details are never shared between a Guardian and a Tutor; Pitazz passes on where a lesson happens (for an online lesson, the Tutor’s video link on the paid lesson), and nothing else.
- With public authorities, if the law obliges us to disclose something, or to protect the safety of a Learner where we reasonably believe there is a safeguarding concern.
- With a professional adviser (such as our accountant or lawyer) bound by confidentiality, where necessary for tax, legal, or regulatory compliance.
We share information with tax authorities where the law requires it.
7. How long we keep it
We keep personal data only as long as we need it for the purpose we collected it for.
- Account, request, quote, booking and class data: while your account is active, and afterwards as needed to resolve an open booking, a dispute or a legal obligation.
- Financial records: 10 years, as Maltese record-keeping rules require.
- Documents you send us for verification: only as long as we need to check them, unless the law requires us to keep them longer. We keep a record of what was checked and when.
- An application to tutor that is not accepted: up to 6 months after we answer it.
8. Your rights, and how erasure works here
Under the GDPR you have the right to access the personal data we hold about you, to have it corrected if it is wrong, to have it erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time where consent is the basis for what we do.
Because Pitazz keeps a financial ledger that Maltese law requires us to retain for 10 years, a request to erase your account works a specific way: we pseudonymise your personal details in place (your name is replaced with a token, your email with a placeholder, your phone number is removed, your photo is deleted, and any address or video link we hold for you is deleted), while the underlying ledger entries and completed bookings are kept under that pseudonymous reference, so that our financial records stay intact without your identifying details attached to them. This lets us satisfy both your erasure rights and our legal record-keeping duty at the same time. Two records are kept as they are: our internal activity log, which can show the name or email an action concerned, and our copies of Stripe’s payment messages, which can show a payer’s name and email. We keep them for security and for our financial records, and nobody else can see them.
To exercise any of these rights, email hello@pitazz.co from the address on your account (or tell us the details you signed up with, so that we can find your account). We will respond within one month, and there is no charge.
9. Complaints
If you believe we have handled your data unlawfully, you have the right to lodge a complaint with Malta’s supervisory authority, the Information and Data Protection Commissioner (IDPC), at idpc.org.mt. We would also welcome the chance to resolve any concern directly at hello@pitazz.co.
10. Cookies, analytics, and the installed app
The Platform uses only the cookies or local storage strictly necessary to keep you signed in and to operate core functionality. We do not run advertising pixels or analytics scripts that track you across other websites, and the installable version of the app sends no push notifications. If this changes (for example, if we introduce product analytics), we will update this policy and, where the technology requires it, ask for your consent first.
If you came through one of our ads or links, we note which one when you join, so we know which ads work. We use no cookies or tracking pixels for this.
11. Security
We take reasonable technical and organisational measures to protect your data, including encrypted storage and transport, access controls limiting who can view verification evidence and payment data, and an internal audit log of administrative actions. No system is completely secure, and we cannot guarantee absolute security, but we monitor and improve these measures on an ongoing basis.
12. Children
Accounts are held only by adults: parents and guardians, adult learners, and tutors. We do not knowingly collect an account directly from a person under 18; a minor is represented on the Platform only as a Learner record linked to their Guardian’s account, with the minimal data described in Section 4. If you believe a minor has created an account directly, email us and we will investigate and remove it.
13. Changes to this policy
If what we collect or how we use it changes (for example, when new features such as tutor subscriptions or prepaid credits launch), we will update this page and change the effective date at the top. For any significant change affecting data you have already given us, we will email you before it takes effect.
14. Contact
Questions, requests, or anything unclear: hello@pitazz.co.