01Who is responsible
Grade Ladder is the trading name of Dr Hadi Sabouhi, a self-employed private tutor. He is the data controller — the person who decides what is collected and why, and the person legally answerable for it.
Contact him about anything on this page at [email protected]. A postal address is available on request.
The website and booking system were built and are maintained by Redway Studio, who act as a processor — they keep the system running and can see the data in order to do that, but do not use it for anything of their own.
02What is collected, and why
What you type into a form is what is collected. On top of that, the server keeps ordinary access logs for every request, cookie-free Cloudflare Web Analytics counts page views and performance, and the live-chat widget loads automatically and sets its own cookies. The table below sets out each of those and what it is for.
| When you… | What is collected, and what it is for |
|---|---|
| Book a lesson or a free call | Your name, email address and, if you give it, a phone number. The student's first name and year group, the subject and level, the date and time, and anything you write in the notes box. Used to run the lesson, send the confirmation and reminder, and know who is being taught. |
| Ask a question on the site | Your email address, your name if you give it, and the question itself — so it can be answered. Held as an enquiry record. |
| Finish "Test your level" | Your email address, your score, the estimated working grade and the weakest topic — so a useful reply can be sent. Give a fake address and the quiz still works; you simply hear nothing back. |
| Become a student | A family record: parent name and contact details, student first name, subjects, level, starting and target grades, lesson history, worksheets and past papers shared with you, marks and grades recorded after assessments, and topics marked as covered. This is what the family portal shows you. |
| Receive an invoice | The bill payer's name and email, what the lessons were, the amounts, and what has been paid. Kept because tax law requires business records to be kept. |
| Simply visit the site | The server keeps ordinary access logs — page requested, time, browser type. Used to keep the site up and spot abuse. Separately, Cloudflare Web Analytics records page views and performance without cookies and without identifying you, so the site can see which pages are used. It is performance and page-usage measurement, not advertising, and it does not follow you elsewhere. |
Please do not send medical or diagnostic details through the website forms. If something about a student's learning matters — a diagnosis, an access arrangement, an exam concession — mention it on the introductory call instead. It is handled properly there, and there is then no reason for it to sit in a website database.
03The legal basis for holding it
- Performing a contract — bookings, lessons, portal records and invoices. Lessons cannot be delivered without them.
- Legitimate interests — replying to an enquiry, sending the tutor an alert that a booking has come in, keeping the site secure. The interest is running a small tutoring practice; the impact on you is minimal and you can object at any time.
- Consent — the follow-up email after the level quiz. You gave an address to get a reply; if you would rather not hear back, say so and it stops.
- Legal obligation — keeping financial records for as long as HMRC requires.
04Who else sees it
A handful of services are needed to make a tutoring practice work. Each one is listed here with what it actually receives — not a generic list of "partners".
| Service | What reaches it |
|---|---|
| Brevo (email delivery, EU) | Your email address and the contents of the emails Grade Ladder sends you — confirmations, reminders, invoices, replies. |
| Jitsi Meet (video lessons) | The lesson itself. Each lesson gets its own randomly named room, which is not listed anywhere and is not guessable. Lessons are not recorded. |
| Telegram (tutor's phone alerts) | A short notification to Dr Sabouhi's own phone when a booking or question arrives, containing the name, email and message. It is how a one-person practice answers quickly. |
| Cloudflare (network and analytics) | Carries traffic between your browser and the site, and filters attacks. It processes network requests in order to deliver and protect the site. Cloudflare Web Analytics also measures page views and performance — no cookies are set, nothing is used for advertising, and it is not tied back to you as a person. |
| Google Fonts | Your browser fetches two typefaces from Google's servers, which means Google sees the request and your IP address. No cookie is set and nothing is sent about you. |
| Stripe (card payments) | If you pay by card, your card details go straight to Stripe and are never seen by, or stored on, Grade Ladder's systems. Grade Ladder is told only that a payment succeeded. |
| Tawk.to (live chat) | The chat widget loads automatically on the home page and in the family portal, and it sets its own cookies as it loads — before you open the bubble, not only after. It tells Tawk.to the page you are on. Messages you send through it reach Tawk.to as well. The email address and the question form are alternatives for sending a message; using either of them does not stop the widget loading or the cookies it sets. |
Nothing is sold, rented, or handed to advertisers. Records would only ever be disclosed further if the law required it, or in the rare case where a safeguarding concern meant a child's welfare had to come first.
05Cookies
Grade Ladder sets no cookies of its own — no session cookie, no login cookie, no advertising cookie. The site's own analytics are Cloudflare Web Analytics, which is cookie-free: it counts page views and performance without setting anything on your device. Your family portal opens from a private link in your email rather than a login, which is precisely why no session cookie is needed.
The widgets are the exception. The Tawk.to live-chat widget loads by itself on the home page and in the portal, and sets its own cookies as it loads — so leaving the bubble closed does not mean nothing was set. Those cookies keep a chat conversation going between pages. The email address and the question form are simply other ways to send a message; using them does not prevent the widget from loading or setting its cookies.
06Students under 18
Most students here are between 13 and 18. That shapes how this works.
- A parent or guardian books, and the account is theirs. The family portal link goes to the adult. Lesson notes, invoices and contact details sit with them.
- A student only gets their own view if a parent switches it on — and that view deliberately excludes invoices, private notes and the parent's contact details. It shows the student their own lessons, worksheets and progress, nothing else.
- As little as possible is recorded about the child. A first name, year group, subjects and grades. No date of birth, no address, no school records, no photographs.
- Dr Sabouhi holds a valid enhanced DBS check and is registered with the General Teaching Council. Both can be seen at the free introductory call.
If you are a student under 18 reading this and you want to know what is held about you, or want it removed, you can ask — write to [email protected]. For anything that affects the family account, your parent will be asked first.
07How long things are kept
| Record | Kept for |
|---|---|
| Enquiries and quiz entries that never became a booking | 12 months, then deleted. |
| Family and student records, lesson history, worksheets and results | While you are a client, and for 12 months after the last lesson — long enough to write a reference or pick lessons back up. Then deleted. |
| Invoices and payment records | Six years after the end of the tax year they fall in, because HMRC requires it. |
| Server access logs | A short rolling window, then overwritten. |
Ask for deletion sooner and it happens — except the invoices, which have to stay for the tax years they belong to. That is a legal obligation, not a preference.
08Where it is kept, and how it is protected
Family records live on a private server in the United Kingdom, run by Redway Studio for Grade Ladder. They are not on a shared marketing platform and not in a third-party CRM.
- The whole site runs over an encrypted connection (HTTPS). There is no way to reach it otherwise.
- Your family portal opens from a long random link that is not listed, not indexed by search engines, and cannot be guessed. Treat that link like a password — anyone holding it can see your family's page. Ask and it can be reissued, which instantly kills the old one.
- Worksheets and files download only for the family they belong to; the wrong link returns nothing at all.
- The tutor's own admin area is protected by a separate key that is not shared with anyone.
Some of the services in section 4 are outside the UK. Where that happens, the transfer relies on UK adequacy regulations or the standard contractual clauses those providers publish.
09Your rights
Under UK GDPR you can ask Grade Ladder to:
- Show you everything held about you or your child.
- Correct anything wrong — a misspelled name, an out-of-date phone number, a grade recorded incorrectly.
- Delete it, subject to the invoice exception above.
- Stop using it for a particular purpose, or pause use while a dispute is sorted out.
- Hand it over in a portable form, or send it to another tutor.
- Withdraw consent for follow-up emails, at any time, without giving a reason.
Email [email protected]. You will get a reply within a few days and the law allows a month at most. There is no charge.
If you are not satisfied with how a request is handled, you can complain to the Information Commissioner's Office — ico.org.uk/make-a-complaint, or 0303 123 1113. You are welcome to raise it here first, but you do not have to.
10Changes to this page
If what is collected changes, this page changes with it and the date at the top moves. Anything that materially affects existing families — a new service seeing your data, for instance — is emailed to you rather than quietly published.