Last updated: 9 October 2026
This notice is for US schools, parents and guardians and explains how AB Tutor handles personal information from children under 13, in accordance with the Children’s Online Privacy Protection Act (COPPA), as amended by the FTC’s 2025 rule amendments, and the Family Educational Rights and Privacy Act (FERPA). It covers the AB Tutor cloud service. On-premise installations, where the school hosts all data on its own infrastructure, are covered by a separate notice.
AB Tutor is a classroom management, monitoring and safeguarding service provided by AB Tutor Limited.
Operator contact: AB Tutor Limited
Unit E, Argent Court, Hook Rise South, Surbiton, KT6 7NL
Email: support@abtutor.com
Phone: +44 (0)1372 465000
AB Tutor is used by children only through their school. We do not offer the service directly to children and children cannot sign up themselves. Consistent with the FTC’s published guidance on COPPA and schools, we rely on the school to provide consent on behalf of parents for the collection of students’ personal information, solely for use in the educational context, and for no commercial purpose beyond providing the service. Schools should ensure they have authority to consent and should make this notice available to parents.
For FERPA purposes, we accept the conditions of the “school official” exception — we perform a function the school would otherwise use its own staff for, we act under the school’s direct control over the use and maintenance of education records, we use them only as the school authorises, and we do not pass them on. Schools should note that the exception depends on their own annual notification of FERPA rights identifying contractors of this kind as school officials. The conditions are set out in our Data Processing Agreement — Cloud Service.
A note on the legal basis of the school-consent model: it comes from FTC guidance rather than the text of the COPPA Rule. The FTC consulted on codifying a school-authorisation exception as part of its 2025 amendments and decided not to adopt one, citing anticipated changes to the FERPA regulations. It remains the FTC’s stated approach to educational technology and is the basis on which the sector operates, but we will revisit this notice if the position changes.
Collection depends on the features the school enables:
We collect no more information than is reasonably necessary for a child to use the service, and a child’s participation is never conditioned on providing more.
We do not collect audio or voice recordings, photographs (other than what appears on a monitored screen), precise geolocation, or biometric data.
Student information is used only to provide the service to the school: displaying classroom activity to authorized school staff, enforcing the school’s device policies, and generating safeguarding alerts for the school. We use persistent identifiers solely for internal operations — authenticating devices, maintaining connections, security and service integrity — and for no other purpose.
We never use children’s personal information for targeted or behavioral advertising, marketing, profiling for non-educational purposes, sale, or training artificial intelligence models.
We disclose children’s personal information only to service providers that are integral to providing the service, each bound by written contracts with confidentiality and security obligations:
| Recipient | Purpose |
|---|---|
| Linode (Akamai) — US data centers | Cloud service hosting and backups for US schools |
| The child’s school | All collected information is available to authorized school staff — that is the service |
| Google / Microsoft (optional, school-enabled) | Roster and sign-in sync with the school’s own tenant |
Our helpdesk, business email and licence-management systems serve school staff and administrators; children’s personal information is not disclosed to them in the ordinary course of providing the service. If a school chooses to include student information in a support request, it is used only to resolve that request and deleted when the request is closed.
We do not disclose children’s personal information to any third party for advertising, marketing, payment processing unrelated to the school’s account, or AI training. We may disclose information where required by law (for example, a valid court order) or to protect the safety of a child.
As required by the amended COPPA Rule, our written retention policy for children’s data is:
We retain children’s personal information only as long as reasonably necessary for the educational purpose for which it was collected, and never indefinitely.
The software reports feature-usage counts to us, labelled with the school’s licence key or name so we know which installation they came from. This telemetry contains no personal information from or about any child — no names, user or device identifiers, screen content, or persistent identifiers attributable to an individual. It is not used to contact, profile, track or advertise to anyone.
We maintain a written information security program with designated personnel responsible for it, annual risk assessments, safeguards including encryption in transit and at rest and role-based access controls, regular testing, and at least annual review. Service providers handling children’s data must provide written assurances of equivalent protection. AB Tutor Limited is certified to ISO/IEC 27001 and holds Cyber Essentials.
Parents and guardians have the right to review the personal information collected from their child, direct us to delete it, and refuse to permit further collection or use. Because the school controls student accounts and data, please direct requests to your child’s school, which can action them directly or instruct us; we support schools in responding promptly. If you prefer, you may contact us at support@abtutor.com and we will coordinate with the school. We will not retaliate against, or degrade the service for, any child whose parent exercises these rights, except where deletion means a feature can no longer function.
Schools may also contact us at any time to review, correct, export or delete student data.
If we make material changes to how we collect, use or disclose children’s personal information, we will notify subscribing schools directly and update this notice. New uses require new consent via the school.
support@abtutor.com — all questions, requests and complaints regarding children’s privacy.
