Privacy Policy

TotMaiSus is operated by HAMMER STUDIO PRODUCTION S.R.L., a company registered in Romania (Trade Register no. J2009003471404, VAT no. RO25290635), with its registered office at Bd. Timișoara nr. 103E, Corp A, Sc. 2, Et. 3, Ap. 130, Sector 6, 061327 București, România. We are the data controller for the personal data described in this policy. We provide online tutoring: live lessons, a recorded-lesson library, homework, competitions, and related learning tools for pupils and their families.

If you have any questions about this policy or want to exercise your rights, you can reach us at contact@totmaisus.ro.

This policy covers two kinds of people. First, adults — parents, tutors, and other grown-ups who create their own accounts. Second, children — pupils, including those under 16, whose accounts are created and controlled by a parent or legal guardian. We treat a child's data very differently from an adult's, and we explain the difference throughout this policy.

From adults who create an account, we collect:

• Account details you give us, such as your name, email address, and password.
• Payment information, which is handled directly by our payment processor, Stripe. We never see or store your full card number.
• Information you choose to add, such as a tutor's application, qualifications, or documents you upload.
• Basic usage information needed to run the service, such as which pages you visit and actions you take in your account.

From a pupil, including a child under 16, we collect only the minimum needed to deliver lessons:

• First name and last initial.
• Birth year (not a full date of birth).
• School grade.
• Learning activity needed to run the service, such as attendance, progress, grades, and homework.

For a child under 16, we never collect:

• An email address, phone number, or home address.
• A photo of the child (pupils use illustrated avatars, never photos).
• A full date of birth or personal numeric code (CNP).
• Precise location or any advertising identifiers.

We use personal data only to run and improve the service you asked for. Our legal bases are the contract with you (Art. 6(1)(b) GDPR), your consent where we ask for it (Art. 6(1)(a)), our legal obligations (Art. 6(1)(c)) and our legitimate interest in keeping the platform safe (Art. 6(1)(f)):

• To create and manage accounts and family relationships.
• To deliver live lessons, the lesson library, homework, competitions, and certificates.
• To process payments and payouts to tutors.
• To keep the platform safe, including moderating lesson chat and responding to safety reports.
• To send account and service emails you need to use TotMaiSus.

We knowingly serve children, so we apply Article 8 of the GDPR and Romanian Law no. 190/2018, under which a child under 16 cannot consent to an online service on their own. A parent or legal guardian creates each child's account, and we require verifiable parental consent before a child's account becomes active. We collect only what is listed above, we never show a child's data publicly, and we never use a child's data for advertising or sell it.

Read our full Children's Privacy Notice for parents

We do not run behavioral analytics or advertising trackers on any pupil-facing surface. Pupil screens only record the basic, first-party activity needed to deliver the service, such as lesson attendance and lesson progress. Our product analytics tool (used only on adult screens) is cookieless for anonymous visitors, and we never use it to build profiles of minors.

We do not use advertising software anywhere on TotMaiSus, and we never sell anyone's personal data.

Some features use artificial intelligence, such as a pupil learning companion, tutor grading help, and weekly parent summaries. These features are built with strict limits:

• We do not allow your data to be used to train AI models, and we configure our AI provider for zero data retention.
• For children under 16, the AI companion is off by default. A parent must turn it on for each child.
• Every AI conversation a child has is readable by their parent.
• The companion is guided to redirect sensitive topics to a parent and to never ask for personal data or off-platform contact.

We use only the strictly necessary cookies needed to keep you signed in and to run core features. We do not use advertising or cross-site tracking cookies, and we do not place tracking cookies on pupil-facing surfaces. For anonymous visitors, our product analytics is cookieless, so no cookie banner consent is required for it.

We do not sell your personal data. We share it only with the service providers who help us run the platform, and only as needed. These providers act as our processors under data-processing agreements (Art. 28 GDPR). Where a processor is established outside the European Economic Area, transfers rely on an adequacy decision or the European Commission's Standard Contractual Clauses:

• Stripe — payments, subscriptions, and tutor payouts.
• Supabase — our database, sign-in, and file storage.
• Amazon Web Services (AWS, EU region) — hosting and our video delivery pipeline.
• Resend — sending account and service emails.
• Anthropic — the AI model behind our AI features, configured so your data is not used for training.

We may also share personal data when the law requires it, or to protect the safety of a child or another person. We never sell personal data, and we never share a child's data for advertising.

We keep personal data only as long as we need it, and we group data into tiers:

• Records, such as enrollments, attendance, grades, and certificates — kept while your family account is active. On a deletion request, we offer an export first and then anonymize the pupil's identity while preserving aggregate integrity.
• Activity data, such as chat, AI logs, and view events — kept on rolling windows and removed on deletion.
• Safety and audit records, such as consent records and tutor verification records — kept as long as the law requires, even after account deletion.

Under the GDPR you have rights over your personal data, and a parent can exercise these rights on behalf of their child:

• Access and get a copy (export) of your data (Art. 15 and 20).
• Ask us to correct data that is wrong (Art. 16).
• Ask us to delete your account and data, subject to records we must keep by law (Art. 17).
• Restrict or object to processing, and withdraw consent at any time where consent is the legal basis (Art. 18, 21 and 7).

To make a request, use the privacy tools in your account. We answer within one month. Manage your data & privacy requests

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, www.dataprotection.ro), or with the supervisory authority of the EU country where you live.

Because we never sell data and never use it for advertising, there is nothing to opt out of — these rights are yours by default.

We follow strong security practices, including database-level access controls, encrypted connections, signed and verified integrations, rate limiting, and audit logging of sensitive actions. Before launch, an independent security firm reviews the platform. No system is perfectly secure, but we work hard to protect your family.

If we make a material change to what we collect from children, we will ask parents to review and consent again before the child's next lesson. We will update the date at the top of this page whenever we make changes.

Questions about your privacy? Email us at contact@totmaisus.ro or call 0727555041. HAMMER STUDIO PRODUCTION S.R.L., Bd. Timișoara nr. 103E, Corp A, Sc. 2, Et. 3, Ap. 130, Sector 6, 061327 București, România.