01Who is responsible
Grade Ladder is the trading name of Dr Hadi Sabouhi, a self-employed private tutor. He is the data controller — the person who decides what is collected and why, and the person legally answerable for it.
Contact him about anything on this page at [email protected]. A postal address is available on request.
The website and booking system were built and are maintained by Redway Studio, who act as a processor — they keep the system running and can see the data in order to do that, but do not use it for anything of their own.
02What is collected, and why
Only what a form asks for. Nothing is gathered quietly in the background.
| When you… | What is collected, and what it is for |
|---|---|
| Book a lesson or a free call | Your name, email address and, if you give it, a phone number. The student's first name and year group, the subject and level, the date and time, and anything you write in the notes box. Used to run the lesson, send the confirmation and reminder, and know who is being taught. |
| Ask a question on the site | Your email address, your name if you give it, and the question itself — so it can be answered. Held as an enquiry record. |
| Finish "Test your level" | Your email address, your score, the estimated working grade and the weakest topic — so a useful reply can be sent. Give a fake address and the quiz still works; you simply hear nothing back. |
| Become a student | A family record: parent name and contact details, student first name, subjects, level, starting and target grades, lesson history, worksheets and past papers shared with you, marks and grades recorded after assessments, and topics marked as covered. This is what the family portal shows you. |
| Receive an invoice | The bill payer's name and email, what the lessons were, the amounts, and what has been paid. Kept because tax law requires business records to be kept. |
| Simply visit the site | The server keeps ordinary access logs — page requested, time, browser type. Used to keep the site up and spot abuse. They are not tied to a person and are not analysed for behaviour. |
Please do not send medical or diagnostic details through the website forms. If something about a student's learning matters — a diagnosis, an access arrangement, an exam concession — mention it on the introductory call instead. It is handled properly there, and there is then no reason for it to sit in a website database.
03The legal basis for holding it
- Performing a contract — bookings, lessons, portal records and invoices. Lessons cannot be delivered without them.
- Legitimate interests — replying to an enquiry, sending the tutor an alert that a booking has come in, keeping the site secure. The interest is running a small tutoring practice; the impact on you is minimal and you can object at any time.
- Consent — the follow-up email after the level quiz. You gave an address to get a reply; if you would rather not hear back, say so and it stops.
- Legal obligation — keeping financial records for as long as HMRC requires.
04Who else sees it
A handful of services are needed to make a tutoring practice work. Each one is listed here with what it actually receives — not a generic list of "partners".
| Service | What reaches it |
|---|---|
| Brevo (email delivery, EU) | Your email address and the contents of the emails Grade Ladder sends you — confirmations, reminders, invoices, replies. |
| Jitsi Meet (video lessons) | The lesson itself. Each lesson gets its own randomly named room, which is not listed anywhere and is not guessable. Lessons are not recorded. |
| Telegram (tutor's phone alerts) | A short notification to Dr Sabouhi's own phone when a booking or question arrives, containing the name, email and message. It is how a one-person practice answers quickly. |
| Cloudflare (network) | Carries traffic between your browser and the site, and filters attacks. Sees the connection, not the contents of your family's records. |
| Google Fonts | Your browser fetches two typefaces from Google's servers, which means Google sees the request and your IP address. No cookie is set and nothing is sent about you. |
| Stripe (card payments) | If you pay by card, your card details go straight to Stripe and are never seen by, or stored on, Grade Ladder's systems. Grade Ladder is told only that a payment succeeded. |
| Tawk.to (live chat) | If you use the chat bubble, Tawk.to receives your messages and sets cookies in your browser to keep the conversation going between pages. It also records the page you were on. Do not use the chat if you would rather avoid that — the email address and the question form reach the same person. |
Nothing is sold, rented, or handed to advertisers. Records would only ever be disclosed further if the law required it, or in the rare case where a safeguarding concern meant a child's welfare had to come first.
05Cookies
Grade Ladder sets no cookies of its own — no analytics, no advertising, no "we value your privacy" banner, because there is nothing to consent to. Your family portal opens from a private link in your email rather than a login, which is precisely why no session cookie is needed.
The one exception is the live chat. Open it and Tawk.to sets its own cookies so the conversation survives moving between pages. Leave the bubble alone and it sets nothing.
06Students under 18
Most students here are between 13 and 18. That shapes how this works.
- A parent or guardian books, and the account is theirs. The family portal link goes to the adult. Lesson notes, invoices and contact details sit with them.
- A student only gets their own view if a parent switches it on — and that view deliberately excludes invoices, private notes and the parent's contact details. It shows the student their own lessons, worksheets and progress, nothing else.
- As little as possible is recorded about the child. A first name, year group, subjects and grades. No date of birth, no address, no school records, no photographs.
- Dr Sabouhi holds a valid enhanced DBS check and is registered with the General Teaching Council. Both can be seen at the free introductory call.
If you are a student under 18 reading this and you want to know what is held about you, or want it removed, you can ask — write to [email protected]. For anything that affects the family account, your parent will be asked first.
07How long things are kept
| Record | Kept for |
|---|---|
| Enquiries and quiz entries that never became a booking | 12 months, then deleted. |
| Family and student records, lesson history, worksheets and results | While you are a client, and for 12 months after the last lesson — long enough to write a reference or pick lessons back up. Then deleted. |
| Invoices and payment records | Six years after the end of the tax year they fall in, because HMRC requires it. |
| Server access logs | A short rolling window, then overwritten. |
Ask for deletion sooner and it happens — except the invoices, which have to stay for the tax years they belong to. That is a legal obligation, not a preference.
08Where it is kept, and how it is protected
Family records live on a private server in the United Kingdom, run by Redway Studio for Grade Ladder. They are not on a shared marketing platform and not in a third-party CRM.
- The whole site runs over an encrypted connection (HTTPS). There is no way to reach it otherwise.
- Your family portal opens from a long random link that is not listed, not indexed by search engines, and cannot be guessed. Treat that link like a password — anyone holding it can see your family's page. Ask and it can be reissued, which instantly kills the old one.
- Worksheets and files download only for the family they belong to; the wrong link returns nothing at all.
- The tutor's own admin area is protected by a separate key that is not shared with anyone.
Some of the services in section 4 are outside the UK. Where that happens, the transfer relies on UK adequacy regulations or the standard contractual clauses those providers publish.
09Your rights
Under UK GDPR you can ask Grade Ladder to:
- Show you everything held about you or your child.
- Correct anything wrong — a misspelled name, an out-of-date phone number, a grade recorded incorrectly.
- Delete it, subject to the invoice exception above.
- Stop using it for a particular purpose, or pause use while a dispute is sorted out.
- Hand it over in a portable form, or send it to another tutor.
- Withdraw consent for follow-up emails, at any time, without giving a reason.
Email [email protected]. You will get a reply within a few days and the law allows a month at most. There is no charge.
If you are not satisfied with how a request is handled, you can complain to the Information Commissioner's Office — ico.org.uk/make-a-complaint, or 0303 123 1113. You are welcome to raise it here first, but you do not have to.
10Changes to this page
If what is collected changes, this page changes with it and the date at the top moves. Anything that materially affects existing families — a new service seeing your data, for instance — is emailed to you rather than quietly published.