Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how Noktua Academy ("we", "us", "our") collects, uses, stores and protects your personal data when you visit https://www.noktuaacademy.com or use our online tutoring services. How we use cookies and similar technologies is set out in our Cookie Policy.

1. Who We Are — Data Controller

Noktua Academy is the trading name of André Filipe Andrade Baptista Beirão Nunes, a self-employed tutor based in Portugal, who is the data controller for personal data collected through this website and platform. We deliver live online tutoring via video call, and an online practice platform.

Contact: info@noktuaacademy.com

2. Personal Data We Collect

• •Account data: name, email address and sign-in credentials (managed by Clerk), and a phone number if you choose to add one in your dashboard.
• •Age and guardian data: your year of birth and, where a parent or guardian registers for a student, the parent or guardian's name, age and email address, together with the date and time consent was given.
• •Class data: your bookings (subject, level, date, time, tutor), anything you write when booking, session notes, homework and class files, and whiteboards and notebooks saved during or after a class.
• •Practice data: the exercises you attempt on the practice platform, your answers, the time taken, scores, progress, streaks and achievements.
• •Study-group data: the groups you create or join, and the email addresses of people you invite to a group.
• •Payment data: what you bought, the amount, currency and payment status. Session packs and group-class seats are paid by MB WAY, bank transfer or a card payment link: we record a payment reference, the name of the person paying if you give it, and when the payment was due and confirmed. Card details are entered on Revolut's own payment page and never reach our servers.
• •Live class data: during a class, your audio, video and screen share are transmitted live to the other participants. The platform does not record classes.
• •Communication data: the name, email address and message you send through the contact form, which reach us by email together with your country code.
• •Technical data: your IP address, which our hosting provider processes to deliver the site and which we use briefly to limit abuse of our forms (we do not store it in our database); a two-letter country code derived from it; and your device type (mobile, tablet or desktop).
• •Usage statistics: anonymous page counts, and — only if you accept analytics cookies — Google Analytics data. See section 10.

3. How We Use Your Data

• •Create and manage your account
• •Schedule and deliver online tutoring sessions
• •Take payment for classes and session packs
• •Provide the practice platform and keep track of your progress
• •Send booking confirmations, reminders, cancellations and group invitations by email
• •Send session notes, homework and progress updates
• •Respond to enquiries from the contact form
• •Choose a default language, currency and curriculum from your country
• •Understand how our website is used and how visitors find us
• •Comply with legal obligations including age verification and consent records

4. Legal Basis for Processing (EU/UK Users)

• •Consent (Art. 6(1)(a) GDPR): age verification and processing data relating to minors; optional analytics and marketing cookies, which you can accept, refuse or withdraw at any time through Cookie settings
• •Contract (Art. 6(1)(b) GDPR): delivering sessions and managing your account
• •Legal obligation (Art. 6(1)(c) GDPR): retaining records required by law

5. Children’s Privacy

Noktua Academy provides tutoring to students of all ages. We take the privacy of younger users extremely seriously.

5.1 EU & UK Users

Where an online service relies on consent as the lawful basis for processing a child's personal data and offers that service directly to the child, Article 8 of the GDPR requires the consent to be given or authorised by a parent or guardian below a certain age. The GDPR sets that age at 16 but allows each EU country to set a lower age, no lower than 13; Portugal has set it at 13. The United Kingdom has its own UK GDPR, under which the age is also 13. These rules are about consent for online services only. They are not a general minimum age for every kind of personal-data processing, and processing that relies on another lawful basis (for example, providing a service you have contracted for) is not governed by them.

• •Students under 16 in these countries are asked to have a parent or guardian register on their behalf or add their details at sign-up.
• •Parent/guardian consent is collected at account sign-up and stored with a timestamp.
• •Parents may withdraw consent at any time by emailing info@noktuaacademy.com — we will delete the account within 30 days.
• •We do not use data of EU/UK minors for any purpose other than the agreed tutoring service.

5.2 US Users — COPPA

Under COPPA, children under 13 require verifiable parental consent before we may collect or process their data.

• •We do not knowingly collect data from children under 13 without parental consent.
• •US users under 13 are directed to have a parent/guardian register on their behalf.
• •Parents may review, correct, or request deletion of their child’s data at any time.

5.3 All Other Jurisdictions

We apply a default minimum age of 13 as a conservative baseline for all other countries.

5.4 Technical measures in the student area

• •Google Analytics runs only on our public pages. It is switched off in the signed-in areas — the student dashboard, classroom, practice platform, study groups, sign-up and sign-in pages, and the teacher and admin areas — whatever cookie choice was made.
• •We never pass names, email addresses, phone numbers, usernames or messages to Google Analytics. The only information of our own we may send is a pseudonymous account ID, and only for adult accounts (see 10.2).
• •Accounts of students under 18, accounts whose age we do not know, and staff accounts are never given that ID. While such an account is signed in, Google signals and ad personalisation are also switched off for that browser, whatever cookie choice was made.
• •Your choice about analytics and marketing cookies is separate from the account and parental consent given at sign-up. Accepting or refusing cookies does not give, replace or withdraw that consent.
• •Marketing cookies can only be switched on by someone who confirms they are 18 or older. Analytics cookies do not depend on age.
• •No advertising tag is installed on this site.

These are technical measures. On their own they do not establish that our processing of children’s data meets every legal requirement.

6. How We Share Your Data

We do not sell your data. We share it only with the service providers we need to run the platform:

• •Clerk — sign-up, sign-in and session management. Holds your name, email address and credentials, and sets the cookies that keep you signed in.
• •Supabase — our database and file storage (account, class, practice and payment records; homework and class files), and the real-time channel that keeps the whiteboard in step between participants during a class.
• •Vercel — website hosting. Processes your IP address to deliver the site and tells us the country you are connecting from.
• •LiveKit — live audio, video and screen sharing in the classroom. Receives your account identifier and display name and carries the live streams.
• •Resend — sends our emails. Receives the recipient's email address and the content of each message (booking confirmations, reminders, cancellations, group invitations and contact-form enquiries).
• •Google (Google Analytics 4) — website analytics, only if you accept analytics cookies and only on our public pages; with Google signals, a pseudonymous account ID for adult accounts, and — only if you also accept marketing cookies — ad personalisation. See section 10.
• •jsDelivr — a content delivery network from which your browser downloads the open-source Python and TypeScript tools used by the programming notebook. It sees your IP address when you open that tool.

Payments go into our account at Revolut (Revolut Bank UAB, in the EU; UK bank transfers are received through Revolut Ltd in the United Kingdom). When you pay, Revolut receives the payment details your bank sends — such as the payer’s name, account details, amount and the reference — and, for a card payment link, the card details you enter on Revolut’s own payment page. MB WAY payments are handled by SIBS and your bank. All of these act under their own terms and privacy policies.

Our pages link to WhatsApp so you can message us. Nothing is loaded from WhatsApp until you click such a link; if you do, the conversation takes place on WhatsApp under its own terms and privacy policy.

7. International Data Transfers

Some of these providers are based in the United States or may process personal data outside the European Economic Area and the United Kingdom. You can ask us for details of these transfers and the safeguards that apply by emailing us.

8. Data Retention

• •Account data: kept while the account exists, and deleted when you ask us to (see section 9), except records we are required by law to keep
• •Files attached to a class: deleted automatically 12 months after they were uploaded
• •Whiteboards saved from the classroom: deleted automatically after 14 days
• •Session notes, homework files, practice records and booking history: not deleted automatically; kept while the account exists and deleted when you ask us to (see section 9), except records we are required by law to keep
• •Record of the consent given at sign-up (date and time): kept with the account, for as long as the account data is kept
• •Data of minors: deleted within 30 days of a parental deletion request
• •Your cookie choice: 6 months, after which we ask again
• •Google Analytics cookies: up to 2 years, or until you withdraw consent, which deletes them
• •Anonymous page counts: contain no personal data and are kept as statistics

9. Your Rights

9.1 EU/UK Rights (GDPR)

• •Access — obtain a copy of your personal data
• •Rectification — correct inaccurate data
• •Erasure — request deletion of your data
• •Portability — receive your data in a machine-readable format
• •Object — object to processing based on legitimate interests
• •Withdraw consent — at any time, without affecting prior processing. For cookies, use Cookie settings at the foot of our public pages or in the Cookie Policy
• •Complain — lodge a complaint with your national data protection authority

9.2 US Rights

• •Request access to or deletion of your personal data
• •Parents: review, correct, and delete your child’s information
• •Opt out of any marketing communications

To exercise any right, email info@noktuaacademy.com. We respond within 30 days.

10. Cookies, Storage & Analytics

We use a small number of necessary cookies (to keep you signed in, remember your language and your cookie choice, and detect your country). Optional analytics and marketing cookies are used only with your consent. The full list, and how to change your choice, is in our Cookie Policy.

10.1 Our own page statistics

We count page views on our own servers to see which pages and adverts bring people here. Each record holds only the page address, the site you arrived from, the campaign tag on the link, your country, whether you are on mobile, tablet or desktop, and whether a contact or sign-up button was clicked. It sets no cookie, stores no IP address, and contains nothing that identifies you or links one visit to another. No third party receives it.

10.2 Google Analytics

If — and only if — you accept analytics cookies, we also use Google Analytics 4 on our public pages. It sets cookies on your device and sends Google information about how you use the site, such as the pages you view, how you arrived, your approximate location, and your device and browser. Until you accept, the Google Analytics script is not loaded and nothing is sent to Google. We do not send Google your name, email address, phone number or the content of any message.

Account ID (adults only). If you are signed in to an account that belongs to someone aged 18 or over and you have accepted analytics cookies, we also send Google Analytics a pseudonymous account ID while you browse our public pages. It is a random-looking code derived from our internal account number with a secret key; it is not your name, email address or username, and Google cannot turn it back into them. It lets us see how the same person uses the site across devices. It is removed when you sign out, and it is never used for accounts of under-18s, accounts whose age we do not know, or staff accounts.

Google signals. We have enabled Google signals. For visitors who are signed in to a Google account and have allowed ad personalisation in their Google settings, Google can associate the analytics data with that account to give us aggregated, de-identified reports across devices and about audiences (such as age range and interests). We receive only aggregated reports, never your Google account details.

10.3 Advertising

No advertising tag is installed on this site at present. Marketing cookies are for adults only: they can be switched on only in the cookie preferences, after you confirm that you are 18 or older. If you also accept marketing cookies, Google may use the Google Analytics data described above — including through Google signals — to personalise advertising and to build advertising audiences, for example if we later link Google Analytics to Google Ads. If you do not accept marketing cookies, ad personalisation is switched off for your visits. It is always switched off for accounts of under-18s, for accounts whose age we do not know and for staff accounts. We do not send Google your email address, phone number or other contact details for advertising.

11. Security

We use HTTPS, database access controls, and authentication handled by Clerk. No method of internet transmission is 100% secure, but we take appropriate measures to protect your data.

For payments, cancellations and refunds, see our Refund Policy.

12. Changes to This Policy

We may update this policy and will update the date above when we do. Material changes will be communicated by email or a prominent notice on the website.

13. Contact Us

EU/UK users may also complain to their national supervisory authority (e.g. ICO in the UK, CNPD in Portugal).