Privacy Policy

01. Introduction & Scope

This Privacy Policy explains how Ortyco Pty Ltd (ABN 54 699 528 277), operating the digital service TeachCard (“we,” “our,” or “us”), collects, uses, processes, stores, and safeguards personal data when you interact with our digital portfolio platform, websites, and services available at getteachcard.com, teachcard.me, and associated subdomains (collectively, the “Service”).

We operate as a software-as-a-service (SaaS) provider enabling independent educators, academic tutors, and coaches (“Instructors”) to build video-first digital profile cards (“TeachCards”), showcase verified educational credentials, and receive direct lesson inquiries from prospective students, parents, and guardians (“Clients” or “Prospective Students”).

02. Information We Collect

We collect information across several distinct categories depending on how you engage with our Service:

03. How We Use Your Information (Lawful Bases)

We process personal data only when we have a lawful basis under applicable data protection laws, including the GDPR, UK GDPR, and Nigeria Data Protection Act 2023:

• Performance of Contract: To provision, host, transcode, and serve your public Video TeachCard; to deliver student lead inquiries into your dashboard inbox; and to manage active Studio Pass billing access.
• Legitimate Business Interests: To detect, investigate, and prevent fraudulent claims, academic credential falsification, automated bot abuse, or malicious attacks on our infrastructure; and to monitor CDN bandwidth and streaming performance.
• Consent: To publish Instructor profile reels, public bios, and verified proof items authorized by you and your students; to feature or highlight exceptional TeachCards across our official marketing channels, social media platforms, or promotional campaigns; to deliver transactional notifications and studio updates; and, when expressly selected, to process government identity and biometric selfie information through Smile ID for identity verification and fraud prevention.
• Legal & Regulatory Compliance: To comply with statutory tax and financial reporting requirements, respond to lawful subpoenas or court orders, and enforce our Terms of Service.

04. Student Records, Minors & Proof Gallery Redaction Standards

GetTeachCard upholds rigorous standards regarding student privacy, minors' data, and examination documentation (including Nigerian examination bodies such as WAEC, NECO, JAMB, and international equivalents):

05. Third-Party Service Providers (Subprocessors)

We do not sell, monetize, or rent personal data or student inquiries to commercial brokers, advertisers, or third-party telemarketers. We share information strictly with verified subprocessors necessary to deliver our core SaaS infrastructure:

• Vercel & Supabase (Hosting, Database & Authentication): For edge application delivery, secure relational PostgreSQL database storage, and cryptographic authentication. Row Level Security (RLS) is strictly enforced at the database level so only authenticated Instructors can access their studio inboxes.
• Stripe (Payment Infrastructure): For secure processing of Instructor Studio Pass purchases, billing cycles, and invoice generation. All payment data is processed under Level 1 PCI-DSS compliance standards.
• Smile ID (Identity Verification): For optional Pro identity checks using a Nigerian NIN or government-issued ID document, selfie comparison, liveness checks, and fraud signals. Smile ID may process this information outside Nigeria. Its hosted flow presents a separate consent step before collection.
• Google Cloud Vision (Media Safety): Images selected for profile avatars, cover media, and proof galleries, together with sampled frames from intro videos, are sent securely to Google's SafeSearch service after upload to detect potentially adult, violent, or otherwise inappropriate content. Flagged uploads may be retained and placed in a private staff review queue with the safety result, account identifier, and media location. A suspicious result may temporarily move the associated profile into review until TeachCard approves or rejects the media.
• Resend (Transactional Communications): For the dispatch of essential account security emails, authentication magic links, verification codes, and service notifications.
• Mux / Cloudflare Stream (Video Encoding & Streaming CDN): For transcoding, compressing, optimizing, and globally streaming vertical instructor introduction video reels via worldwide Content Delivery Networks.
• WhatsApp (Direct Inquiry Routing): When a prospective student submits a TeachCard lead inquiry, our platform formats an encrypted message link to open the Instructor's designated WhatsApp conversation. WhatsApp operates under its own end-to-end encryption and independent privacy policy.

06. Data Security & Technical Safeguards

We enforce modern administrative, physical, and technical safeguards designed to preserve data confidentiality and integrity:

• End-to-End Encryption in Transit: All HTTP traffic is secured via forced HTTPS/TLS 1.3 cryptographic protocols.
• Database Protection & RLS: Every table in our database enforces strict PostgreSQL Row Level Security (RLS), ensuring that instructor inquiries and private profile settings cannot be accessed or queried by unauthorized actors.
• Secret Key Isolation: Service role keys, database connection strings, and webhook signing secrets are stored securely in isolated server-side environment variables and are never exposed to browser clients.

07. Data Retention & Account Deletion

We retain personal data only for as long as your account remains active or as needed to provide our services, satisfy our legal accounting obligations, and resolve disputes:

• Active Accounts: Profile data, video reels, and proof gallery images remain active while your account is published.
• Lead Inquiries: Stored in the Instructor's dashboard inbox until cleared or until the account is terminated.
• Account Deletion: You may request permanent deletion of your account at any time. Upon verified request, we permanently purge your profile, intro video media, proof assets, and lead inquiries from our live database systems within 30 days, retaining only minimal records required by statutory financial or legal compliance.
• Identity Verification: TeachCard retains only the limited verification status and audit information described above. Requests to delete identity information held by Smile ID will be coordinated with Smile ID, subject to legal fraud-prevention and record-retention obligations.

08. Your Global Privacy Rights

Depending on your jurisdiction (such as under the EU/UK General Data Protection Regulation, the California Consumer Privacy Act / CPRA, or the Nigeria Data Protection Act / NDPA), you possess specific rights regarding your personal information:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may update or correct inaccurate or incomplete profile information directly via your studio dashboard.
• Right to Erasure (“Right to be Forgotten”): You may request the deletion of your account and associated media.
• Right to Restrict or Object: You may object to our processing of your data under certain circumstances.
• Right to Data Portability: You may request an export of your primary account and profile data in a structured, machine-readable format.

To exercise any of these rights, please email us at support@getteachcard.com. We respond to all verified requests within the statutory timeframe (typically 30 days).

09. Children's Privacy Policy

GetTeachCard is intended for educators, adult students, and parents aged 18 and older. We do not knowingly solicit or collect personal data directly from children under the age of 13 (or under 16 in certain jurisdictions) without verified parental consent. If a parent or guardian learns that their minor child has submitted personal details through an inquiry form or has been featured in a proof gallery without appropriate consent, please contact us immediately at support@getteachcard.com for prompt takedown.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect enhancements in our product features, cloud infrastructure, or evolving legal frameworks. When updates occur, we will revise the “Last Updated” date at the top of this page. In the event of material modifications impacting your rights, we will notify registered Instructors via email or through a prominent notice on our platform.