Last updated: 9 October 2026
This notice is for US schools, parents and guardians whose school runs AB Tutor on its own infrastructure (“on-premise”). A separate notice covers the AB Tutor cloud service. It addresses the Children’s Online Privacy Protection Act (COPPA), as amended by the FTC’s 2025 rule amendments, and the Family Educational Rights and Privacy Act (FERPA).
AB Tutor is classroom management, monitoring and safeguarding software supplied by AB Tutor Limited.
Operator contact: AB Tutor Limited
Unit E, Argent Court, Hook Rise South, Surbiton, KT6 7NL, United Kingdom
Email: support@abtutor.com
Phone: +44 (0)1372 465000
On an on-premise installation, AB Tutor Limited does not collect any personal information from children. The software runs on infrastructure the school controls; everything it records stays there. We receive no student information from it, and we have no ability to reach into the school’s installation.
COPPA applies to an operator that collects personal information from children through an online service. For an on-premise installation:
On an on-premise installation, therefore, we never receive, store or have access to personal information about any child; the school holds and controls all of it. We provide this notice so that schools and parents can see exactly what the software does and what does — and does not — reach us. It does not replace the school’s own notices or obligations.
For FERPA purposes, the position follows from the same facts. In normal operation the school discloses no education records to us, so there is nothing for the “school official” exception to apply to. Where a school chooses to send us material for support, that is a disclosure, and for that request we accept the conditions of the exception — we use the material only as the school directs, do not pass it on, and delete it when the request closes. Schools should note the exception depends on their own annual notification of FERPA rights identifying contractors of this kind as school officials.
Because no personal information about children reaches us from an on-premise installation, we do not ask the school to provide consent on parents’ behalf for any collection by us.
Depending on which features the school enables: account and class details entered by the school; device and technical information; screen views and thumbnails; websites visited and applications used; chat messages within the service; and safeguarding alerts consisting of flagged keywords with a short excerpt of surrounding typed text on machines where the school has applied that policy. There is no continuous keystroke logging.
The school determines what is enabled, who may view it, and how long it is kept. All of it remains in the school’s custody.
The on-premise product does not connect to Google Workspace, Microsoft Entra ID, or any other external directory or service. No student information is disclosed to any third party by the software.
We can only ever see school data if the school actively chooses to show it to us — by attaching a log, export or screenshot to a support request, or by granting a remote screen-sharing session in the presence of school staff. There is no automated mechanism for this. We ask schools not to include student information in support material. Where a school does so, we use it solely to resolve that request, restrict it to the staff working on the request, and delete it when the request is closed.
We hold no children’s personal information from on-premise installations, so we have nothing to retain or delete. Retention of student data is configured and enforced by the school on its own systems, and the school should publish its retention practice in its own notice. Support material a school sends us is deleted on closure of the request.
The school secures its own installation — servers, network, access control, patching and backups. Our responsibility is to develop and ship the software securely and to support safe configuration. We maintain a written information security program with designated responsible personnel, annual risk assessments, encryption of data in transit for our own systems, role-based access control, regular testing and at least annual review; AB Tutor Limited is certified to ISO/IEC 27001 and holds Cyber Essentials.
Parents and guardians have the right to review the personal information collected from their child, to have it deleted, and to refuse further collection. Because the school holds all of that information and we hold none, please direct your request to your child’s school. The school can act on it directly. We will assist the school with technical questions about where the software stores particular data and how to export or purge it.
We do not condition a child’s participation on the provision of unnecessary information, and we do not use children’s information for advertising, marketing, profiling, sale or AI training — we do not have it.
If the on-premise product ever begins transmitting student information to us, that would be a material change: we would notify subscribing schools directly before it took effect and obtain consent through the school as required.
support@abtutor.com — questions about the software or this notice. Your child’s school — anything concerning your child’s information.
