Privacy Policy
Data Controller MB “Luxagente” Legal entity registration number: 307409593 Address: Z. Gerulaičio g. 4–34, LT-45391 Kaunas, Lithuania Email: info@luxrepetitor.ai Website: luxrepetitor.ai (hereinafter referred to as the Company, the Platform or we)
1. General Provisions
This Privacy Policy explains how MB “Luxagente” collects, uses, stores and otherwise processes personal data when you use the LuxRepetitor Platform and the services it provides. This Privacy Policy applies to all users of the Platform, including:
students;
parents and guardians;
Tutors;
representatives of legal entities;
participants in the Affiliate Programme;
registered and unregistered visitors to the website. By using the Platform, you confirm that you have read and understood this Privacy Policy. The Platform complies with:
the General Data Protection Regulation (EU) 2016/679 (GDPR);
the Law on Legal Protection of Personal Data of the Republic of Lithuania;
other applicable legislation of the European Union and the Republic of Lithuania.
2. Personal Data We Collect
We process only the personal data necessary for the operation of the Platform, the provision of services, compliance with legal obligations, security and improvement of the Platform.
2.1. Registration Data When you register on the Platform, we may collect:
first name;
surname, where applicable;
email address;
telephone number, if provided;
account identifier;
hashed password.
2.2. AI Tutor Usage Data When you use the AI Tutor, we may process:
conversation history;
questions submitted;
AI-generated responses;
learning topics;
completed tasks;
learning progress;
personalised learning recommendations;
statistics relating to the use of AI features;
the subject and year group selected by the User, where this information is provided. This data is used to ensure the operation of the AI Tutor, personalise the learning experience and improve the quality of the service.
2.3. One-to-One Lesson Data When you use the one-to-one lesson booking system, we may process:
booking information;
selected Tutor;
selected subject;
lesson dates and times;
booking status;
payment status;
lesson history;
automatically generated lesson summaries;
information required for handling disputes. The Platform processes only the data necessary for organising and administering one-to-one lessons and related Platform functions.
2.4. Payment Data We process only such payment information as is necessary for the administration of services and compliance with legal obligations. This may include:
selected plan;
subscription status;
invoice details;
payment status;
transaction identifier;
payment date. Payment card details and other payment instrument information are processed by the relevant licensed payment service providers where payment processing is performed directly by them. The Platform does not receive or store full payment card details processed directly by such providers.
2.5. Communication Data We may process:
email correspondence;
communications through the Platform’s CHAT system;
support requests;
complaints;
feedback;
other information that you voluntarily provide when communicating with us.
2.6. Technical Data We automatically collect certain technical data, which may include:
IP address;
browser type;
operating system;
device type;
login time;
session identifiers;
error logs;
statistics relating to the use of the Platform. This data is used to ensure the security, technical operation and stability of the Platform.
2.7. Cookies and Similar Technologies The Platform uses cookies and similar technologies that enable us to:
ensure the proper operation of the Platform;
remember user preferences;
analyse website traffic;
improve the user experience;
carry out marketing activities where you have given your consent. Detailed information is provided in Section 9 of this Privacy Policy.
2.8. Data Obtained from Third Parties In certain cases, we may receive personal data from third parties, for example:
licensed payment service providers;
payment administration service providers;
Affiliate Programme administration systems;
external technology and integration providers;
other service providers required for the operation of the Platform. We process such data only where there is an appropriate legal basis and only to the extent necessary for the relevant purpose.
2.9. Google Calendar Integration (Optional) The User may voluntarily connect their Google Calendar to the Platform through the relevant calendar settings in their account. Connecting Google Calendar is optional. The Platform and its core services can be used without connecting Google Calendar. Where the User enables the integration and grants the relevant permissions through Google’s authorisation interface, the Platform may process:
the email address associated with the connected Google account;
authorisation and access data, including access and/or refresh tokens where technically required to maintain the integration;
information indicating whether calendar synchronisation is enabled;
identifiers of Google Calendar events created by the Platform where necessary to update or manage the same events. This data is used solely to provide and maintain the Google Calendar integration, including creating and updating upcoming LuxRepetitor lesson events in the User’s calendar and, in the case of Tutors, synchronising teaching availability configured through the Platform in accordance with the functionality selected by the User. We do not import the contents of the User’s existing Google Calendar into the Platform. Authorisation data required for the integration is stored on the Platform’s servers using appropriate technical and organisational security measures and is not made available to other Platform users. Personal data obtained through the Google Calendar integration:
is not sold;
is not used for advertising;
is not used for advertising profiling;
is not used to train or improve general-purpose artificial intelligence or machine-learning models. The Platform sends to Google only the data necessary to provide the calendar synchronisation functionality selected by the User. The User may disable synchronisation or disconnect Google Calendar at any time through the Platform. When the integration is disconnected, authorisation data stored by the Platform that is no longer necessary to provide the integration is deleted, revoked or otherwise rendered unusable, as technically appropriate. Previously created events may remain in the User’s Google Calendar after disconnection unless the User deletes them from Google Calendar or they are removed through Platform functionality where such functionality is available. The Platform’s use and transfer of information received through Google Workspace API permissions will comply with applicable Google user data requirements, including applicable Limited Use requirements.
3. Purposes and Legal Bases for Processing Personal Data
We process personal data only where we have a lawful basis for doing so under the GDPR.
3.1. Entering into and Performing a Contract Article 6(1)(b) of the GDPR Personal data is processed where necessary in order to:
create and administer a User account;
provide access to the AI Tutor;
organise one-to-one lessons;
administer bookings;
administer payments;
generate lesson summaries;
provide Platform functionality requested by the User;
provide and maintain optional functionality activated by the User, including Google Calendar integration. Where the User voluntarily activates an optional Platform feature, the data necessary to provide that requested feature may be processed as part of providing the relevant Platform service.
3.2. Compliance with a Legal Obligation Article 6(1)(c) of the GDPR Personal data is processed in order to:
comply with accounting requirements;
comply with tax obligations;
retain accounting documents;
respond to lawful requests from public authorities;
comply with other requirements established by applicable law.
3.3. Legitimate Interests Article 6(1)(f) of the GDPR Where permitted by law and where our interests are not overridden by the rights and freedoms of the data subject, we may process personal data in order to:
protect the Platform against fraud and abuse;
ensure the security of information systems;
analyse the operation of the Platform;
handle disputes;
ensure quality control;
improve the operation of the AI Tutor and learning recommendations;
improve Platform functionality and service quality. Where possible, anonymised, aggregated or appropriately pseudonymised data is used for statistical, analytical and improvement purposes. Personal data obtained through the Google Calendar integration is not used to train or improve general-purpose artificial intelligence or machine-learning models.
3.4. Consent Article 6(1)(a) of the GDPR We process personal data on the basis of your consent where consent is required, including for:
sending newsletters;
using analytical cookies where consent is required;
using marketing cookies;
sending promotional offers;
other processing activities for which consent is required by applicable law. You may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the consent was withdrawn. Permissions granted through an external service, including Google’s authorisation interface, enable the technical operation of the selected integration and do not constitute consent to unrelated processing of personal data.
4. Who We May Share Your Personal Data With
We do not sell your personal data or share it with third parties for their own marketing purposes. Your personal data may only be shared where this is necessary for the operation of the Platform, provision of a service requested by the User, compliance with legal obligations or protection of legitimate interests.
4.1. Payment Service Providers We use licensed payment service providers and related payment infrastructure to administer payments. Depending on the service used, personal data may be shared with:
OPAY;
ComplyPay;
banks;
other licensed payment institutions or payment service providers. These service providers process personal data as independent data controllers or data processors, as applicable, in accordance with the relevant legal arrangements and their respective privacy policies.
4.2. Information Technology Service Providers For the operation of the Platform, we may use third-party services such as:
server hosting services;
cloud computing services;
database services;
email delivery services;
analytics systems;
technical maintenance services. Such service providers process only the data necessary to provide the relevant services. Where required by the GDPR, data processing agreements are entered into with personal data processors, or other appropriate safeguards required by applicable law are implemented.
4.3. Artificial Intelligence Service Providers In order to ensure the operation of the AI Tutor and other AI-supported Platform functions, some information provided by the User may be shared with artificial intelligence technology providers. Such data may be used for:
generating responses;
completing learning tasks;
preparing learning recommendations;
generating other AI-supported outputs or functions available through the Platform. The Platform seeks to share only the data necessary to process the relevant request and to avoid sharing excessive personal data. The handling of personal data by such providers is subject to the relevant contractual arrangements, provider terms and applicable data protection law. Data obtained through Google Calendar integration is not provided to AI service providers for the purpose of training or improving general-purpose artificial intelligence or machine-learning models.
4.4. Tutors When a User books a one-to-one lesson, only the data necessary to organise and provide the lesson is shared with the selected Tutor. This may include:
first name;
booking information;
selected subject;
communications through the Platform’s CHAT system;
other information that the User provides directly to the Tutor. Tutors undertake to use the personal data received solely for the purpose of providing one-to-one tutoring services and related legitimate purposes and to comply with applicable personal data protection requirements.
4.5. Google Calendar Integration Where the User voluntarily connects Google Calendar, data necessary to provide the selected calendar functionality may be transmitted to and processed by Google. Such data may include information necessary to create, update or synchronise LuxRepetitor-related calendar events. Google Calendar integration is optional and is activated only after the User chooses to connect the relevant Google account and grants the required permissions. The Platform limits the data transmitted through the integration to what is necessary to provide the calendar functionality requested by the User. The use of information received through Google Workspace API permissions is subject to applicable Google user data requirements, including applicable Limited Use requirements.
4.6. Public Authorities Where required by law, personal data may be disclosed to:
courts;
law enforcement authorities;
the State Tax Inspectorate;
the State Data Protection Inspectorate;
other competent authorities. Personal data is disclosed only to the extent required by applicable law or by lawful requests from competent authorities.
5. How Long We Retain Your Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected, to provide our services, comply with applicable legal obligations or establish, exercise or defend legal claims. The following retention periods generally apply: Account and registration data – for as long as the User’s account remains active or until the account is deleted, except where certain data must be retained for a longer period under applicable law or for the establishment, exercise or defence of legal claims. AI Tutor conversation and learning history – for as long as the User’s account remains active or until the User initiates deletion of the relevant data or account, subject to any applicable legal retention requirements. One-to-one lesson booking history – for up to 1 year from the completion, cancellation or other closure of the relevant lesson or booking. Platform CHAT history – for up to 6 months from the last relevant communication. Customer support requests – for up to 1 year from the date on which the request is resolved. Information relating to disputes, complaints and legal claims – for as long as necessary to handle the relevant dispute, complaint or legal claim and, where appropriate, for the establishment, exercise or defence of legal claims. The Platform’s internal period for submitting certain lesson-related disputes may be 48 hours where provided by the applicable Platform terms. This 48-hour period is an internal dispute procedure and does not mean that all lesson-related personal data is automatically deleted after 48 hours. Accounting, invoicing and payment documents – for the mandatory retention period prescribed by applicable law. Technical and security data – for as long as necessary to ensure the security and technical stability of the Platform and to identify and resolve technical issues, but generally for no longer than 12 months, except where longer retention is necessary to investigate a security incident or for the establishment, exercise or defence of legal claims. Google Calendar integration data – for as long as the User uses the integration and the relevant data remains necessary to provide it. When the User disconnects Google Calendar, authorisation data that is no longer required is deleted, revoked or rendered unusable as technically appropriate. Associated integration metadata, including linked account information and Platform-created event identifiers, is deleted when it is no longer necessary for the integration, unless a longer retention period is required by applicable law or for the establishment, exercise or defence of legal claims. Previously created events may remain in the User’s Google Calendar after the integration is disconnected, because those events are stored within the User’s Google service. The User may delete such events directly in Google Calendar, or they may be removed through Platform functionality where such functionality is available. Once the applicable retention periods have expired, personal data is deleted or anonymised, except where it must be retained for a longer period under applicable law or for the establishment, exercise or defence of legal claims. Where the same personal data is processed for several different purposes, it may be retained until the longest justified or legally required retention period applicable to the relevant processing purpose has expired.
6. Your Rights
Under the GDPR, subject to the conditions and limitations established by applicable law, you have the right to:
receive information about the processing of your personal data;
access your personal data;
request the rectification of inaccurate personal data;
request the deletion of personal data (the “right to be forgotten”);
restrict the processing of your personal data;
object to processing where the processing is based on legitimate interests;
receive personal data you have provided to us in a structured, commonly used and machine-readable format where the right to data portability applies;
withdraw your consent at any time where processing is based on consent;
lodge a complaint with the State Data Protection Inspectorate. If you wish to exercise your rights, you may contact us by email at info@luxrepetitor.ai. A registered User may also initiate account deletion directly on the Platform by selecting: Account → Security → Delete account Account deletion does not mean that data or documents which the Company is required to retain under applicable law, or which are necessary for the establishment, exercise or defence of legal claims, are deleted immediately. Disconnecting Google Calendar is separate from deleting a Platform account. The User may disable or disconnect the Google Calendar integration through the relevant Platform settings. We will respond to requests within the time limits prescribed by applicable law.
7. Personal Data Security
The Platform implements appropriate organisational and technical security measures designed to protect personal data against:
unauthorised access;
loss;
destruction;
alteration;
unlawful disclosure. The measures used may include:
SSL/TLS encryption;
access control mechanisms;
password hashing;
backup systems;
access logging;
security monitoring;
restricted access to authorisation credentials and integration data. Despite the measures implemented, no information system can guarantee absolute security. Users must also protect their login details and must not disclose them to third parties.
8. Transfers of Personal Data Outside the European Economic Area
Some technologies or service providers used by the Platform may process personal data outside the European Economic Area (EEA). In such cases, the Platform ensures that personal data is transferred in accordance with the requirements of the GDPR and, where required, subject to an appropriate transfer mechanism or safeguard, such as:
an applicable European Commission adequacy decision;
Standard Contractual Clauses (SCCs);
other safeguards or transfer mechanisms permitted under applicable law. When selecting service providers, the Platform seeks to ensure that personal data is processed in accordance with applicable data protection requirements and subject to appropriate organisational and technical safeguards.
9. Cookie Policy
9.1. What Are Cookies? Cookies are small text files stored on the User’s computer, telephone or other device when they visit the Platform. Cookies enable the Platform to:
function properly;
recognise a logged-in User;
save the User’s settings;
ensure the security of the Platform;
analyse the use of the Platform;
improve Platform functionality.
9.2. What Cookies Do We Use? The following categories of cookies may be used on the Platform. Strictly Necessary Cookies These cookies are necessary for the proper operation of the Platform. They are used for:
logging into an account;
User authentication;
maintaining a session;
ensuring security;
the booking process;
payment administration. Without these cookies, the Platform would not be able to function properly. The User’s consent is not required for strictly necessary cookies. Functional Cookies These cookies enable the Platform to remember the User’s preferences. For example:
language;
login status;
selected theme;
most recent AI Tutor settings;
other individual settings. Analytics Cookies Analytics cookies help us understand how the Platform is used. They may be used to collect information about:
the number of visits;
the most popular pages;
use of the AI Tutor;
the most frequently used features;
booking statistics;
technical errors. This data is used to analyse and improve the Platform. Analytics cookies are used only with the User’s consent where such consent is required by applicable law. Marketing Cookies Where marketing tools are used on the Platform, marketing cookies may be used. They may be used for:
measuring advertising effectiveness;
analysing advertising campaigns;
operating the Affiliate Programme;
tracking conversions. Such cookies are used only with the User’s consent where required by applicable law.
9.3. Third-Party Cookies Third-party technologies may be used on the Platform. Depending on the services actually used, cookies or similar technologies may be set by:
Google Analytics;
Google Tag Manager;
Meta Pixel;
YouTube;
OPAY;
ComplyPay;
technologies provided by AI service providers, where they use cookies or similar technologies;
other technology service providers used by the Platform. The use of such cookies or similar technologies may also be governed by the privacy policies of the relevant service providers. The optional Google Calendar integration described in Section 2.9 is an account integration and should not be understood as authorising unrelated analytics or marketing cookies.
9.4. How Can You Manage Cookies? When visiting the Platform for the first time, the User is shown information regarding the use of cookies. Where applicable, the User may:
accept all cookies;
reject non-essential cookies;
select individual categories of cookies. The User may change their choices at any time through the Platform’s cookie settings where such functionality is available.
9.5. Disabling Cookies Most internet browsers allow Users to:
view cookies in use;
delete cookies;
block new cookies. Please note that disabling strictly necessary cookies may prevent some Platform features from functioning properly. This may affect:
logging in;
operation of the AI Tutor;
one-to-one lesson bookings;
payments;
other Platform features.
9.6. Analytics Information The Platform may collect aggregated statistical information about the use of the Platform. Such information is used to:
improve the quality of the Platform;
improve AI Tutor features;
analyse performance;
improve the User experience. Where possible, such data is anonymised, aggregated or pseudonymised.
9.7. Changes to the Cookie Policy The Platform may periodically update this Section of the Privacy Policy. The updated version will be published on the Platform. Users are encouraged to review the latest version periodically.
10. Protection of Minors’ Personal Data
LuxRepetitor is an educational platform intended for students, and we therefore pay particular attention to the protection of minors’ personal data. Persons under the age of 14 may use the Platform through the account of their parent or legal guardian, except where applicable law permits otherwise. Users aged 14 to 18 may use the Platform and paid services with the consent of their parent, guardian or other legal representative where such consent is required by applicable law. Parents, guardians or other legal representatives are responsible, as applicable, for:
the accuracy of the data provided during registration;
the minor’s use of the Platform;
booking one-to-one lessons;
making payments;
the accuracy of data provided by the minor;
the minor’s use of the AI Tutor. Connecting Google Calendar does not by itself constitute proof of the User’s age, identity or parental, guardian or other legal representative consent. If it becomes apparent that personal data has been collected or processed in breach of applicable law, the Platform may delete such data, restrict its processing or take other appropriate measures.
11. Specific Aspects of AI Tutor Data Processing
The AI Tutor used on the Platform is a standalone digital learning service. When using the AI Tutor, the following data may be processed:
questions submitted by the User;
AI-generated responses;
learning history;
selected topics;
learning progress data;
personalised recommendations. This data is used to:
ensure the operation of the AI Tutor;
generate responses;
personalise the learning process;
improve the quality of the Platform’s services;
identify and resolve technical errors. The Platform seeks to share with AI service providers only the data necessary to process a specific request and to avoid sharing excessive personal data. AI Tutor responses are generated automatically using artificial intelligence technologies. Although the Platform seeks to ensure that responses are as accurate and useful as possible, AI-generated responses may be inaccurate, incomplete or outdated. The User should therefore not rely on AI-generated responses as their sole source of information. The AI Tutor is not a human Tutor or an official educational institution and does not replace one-to-one tutoring services provided by independent Tutors. The AI Tutor is not intended to provide financial, legal, medical or other professional advice. Data obtained through the optional Google Calendar integration is not used to train or improve general-purpose artificial intelligence or machine-learning models.
12. Processing of Data in the Affiliate Programme
If the User participates in the LuxRepetitor Affiliate Programme, the Platform may process additional data required to administer the Programme. This may include:
Affiliate identification data;
referral links or Referral IDs;
statistics relating to referred users;
calculated commission;
payment information;
payment history. This data is used for:
administration of the Affiliate Programme;
calculation of commission;
making payments;
fraud prevention;
compliance with legal obligations. The Affiliate Programme may use cookies or unique referral links to identify users referred by an Affiliate, subject to applicable cookie and data protection requirements.
13. Links to and Integrations with Third-Party Services
The Platform may contain links to, or optional integrations with, websites and services operated by third parties. Third-party services may process personal data in accordance with their own applicable privacy terms and legal obligations. Where the Platform transfers personal data to a third party as part of an integration requested by the User, we limit such transfers to the data necessary for the relevant functionality. The Google Calendar integration is specifically described in Sections 2.9 and 4.5 of this Privacy Policy. We recommend that Users review the privacy information provided by third-party services they choose to use.
14. Changes to this Privacy Policy
The Platform may update this Privacy Policy from time to time, including where necessary due to changes in legislation, Platform functionality, technology or data processing practices. The updated version of the Privacy Policy will be published on the Platform. Where required by applicable law, registered Users may also be notified of material changes by email or through other appropriate means used by the Platform. The updated Privacy Policy will apply from its stated effective or update date. We encourage Users to review the Privacy Policy periodically to remain informed about how personal data is processed.
15. Contact Information
If you have any questions regarding this Privacy Policy or wish to exercise your rights under the GDPR, you may contact: MB “Luxagente” Legal entity registration number: 307409593 Address: Z. Gerulaičio g. 4–34, LT-45391 Kaunas, Lithuania Email: info@luxrepetitor.ai Website: luxrepetitor.ai
16. Final Provisions
This Privacy Policy is governed by the applicable laws of the Republic of Lithuania and European Union legislation governing the protection of personal data. If any provision of this Privacy Policy is found to be invalid or unenforceable, this will not affect the validity of the remaining provisions. Any disputes arising from the application of this Privacy Policy shall first be addressed through negotiation where appropriate. If no agreement can be reached, disputes shall be resolved in accordance with applicable law, without prejudice to the data subject’s right to lodge a complaint with the competent supervisory authority or exercise any other rights available under applicable law.