Privacy Policy

Effective date: 18 August 2026. Last reviewed: 18 August 2026.

This notice explains what personal data Oxbridge Mentors Ltd collects, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it. It covers this website, our Student Portal, and the tutoring and mentoring we deliver.

1. Who We Are

• Data controller: Oxbridge Mentors Ltd
• Registered office: 2-8 Whinneyfield Road, Newcastle Upon Tyne, NE6 4HX, United Kingdom
• Companies House number: 16862372
• Director and Designated Safeguarding Lead: Jason Pahatouridis
• Contact: info@oxbridgementors.co.uk / +44 7537 143015

We are a UK company and your data is controlled from the UK. Data protection questions are handled by Jason Pahatouridis directly.

2. What We Collect

• Names and contact details (student, parent or guardian, school staff)
• School, year group, target universities and courses
• Academic information such as grades, drafts, submitted work and personal statement text
• Enquiry details, including anything you type into our contact, assessment or tutor application forms, and any CV you upload with a tutor application
• Booking, scheduling and attendance records
• Session notes, tutor feedback and progress tracking
• Lesson recordings, their transcripts, and the reports generated from them (section 4)
• Student Portal account data, including sign-in credentials held by our portal platform
• Payment records: what was bought, when, and the invoice. Card details go straight to Stripe and never reach our systems
• Communication records (Microsoft Teams, supervised WhatsApp group chats, email)
• Website usage data (cookies and analytics, section 10)

We do not intentionally collect special category data such as health or disability information, unless you give it to us, or unless we need it for safeguarding or to make a reasonable adjustment.

3. Why We Use It, and Our Lawful Basis

• Contract: delivering the tuition and mock interviews you have booked, matching a tutor, scheduling sessions, running the Student Portal account, taking payment and issuing invoices. Where a parent or guardian holds the contract, we rely on contract for their data and on our legitimate interests for the student we teach.
• Legitimate interests: delivering tutoring safely and effectively, quality assurance and tutor supervision, keeping a record of what was taught, securing this website, answering enquiries, and telling existing customers about our own services. You can object at any time (section 11).
• Consent: non-essential cookies and analytics, marketing emails to people who are not yet customers, and any use of a student's words, work or results in our marketing. You can withdraw consent at any time, and that does not affect anything we did before you withdrew it.
• Legal obligation: safeguarding and child protection duties, and keeping accounting and tax records.
• Vital interests: where a child is at risk of serious harm and we have to act or share information without waiting.

4. Lesson Recordings, Transcripts and AI Progress Reports

Lessons delivered through our Student Portal are recorded on Zoom. Recording is part of how the service works, and we set it out before you book, on our Student Portal and For Parents pages, so no student is recorded without it having been explained first. If you would rather lessons were not recorded, tell us before you book or at any point afterwards and we will stop recording that student.

What happens to a recording. The audio is transcribed and summarised by automated means to produce the progress report that appears in the portal after the lesson: what was taught, how the student got on, what to work on next, and what to revise from. The recording itself is kept so the student can rewatch the lesson.

Lawful basis. Recording, transcribing and reporting are part of the service you book, and we also have a legitimate interest in safeguarding and quality: a recorded lesson protects both the student and the tutor, and lets us review teaching standards. Whichever of those applies, we do not treat recording as something we can do over your objection. You can say no before you book or at any time afterwards and we will act on it, and we will not use a recording for anything beyond delivering and reporting on the lesson, such as tutor training or marketing, without asking your permission first and letting you take it back.

Who can see it. The student, the parent or guardian on the account, and the tutor who taught the lesson. Authorised Oxbridge Mentors staff can also access recordings and transcripts where they need to for safeguarding, complaints, quality assurance or technical support. Our video, transcription and hosting providers hold the data as processors, on our written instructions and for no purpose of their own. Recordings are never sold, published, or shared with other families.

Automated processing. The transcript and the summary are produced automatically, but no decision with a legal or similarly significant effect is made about a student by automated means. The report is a study record, not a grade, a prediction, or an admissions decision, and a human tutor stays responsible for what a student is taught.

How to object or ask for deletion. Email info@oxbridgementors.co.uk. You can ask us to stop recording a particular student's lessons, to delete one recording, or to delete every recording we hold for a student. We will do it unless a recording is needed for a live safeguarding or complaint matter, and we will tell you if that is the case. If lessons are not recorded there is nothing to rewatch, and the tutor writes the progress report from their own notes instead.

5. The Student Portal

The Student Portal is a separate application from this website. It holds each student's account, bookings, session history, lesson recordings, progress reports, syllabus tracker, messages and payment history.

• Roles. Everyone signs in with their own account. A student sees their own record. A parent or guardian linked to that student sees their child's record. A tutor sees only the students they teach, and only what they need in order to teach them.
• Authentication. Sign-in is per person and password-protected, handled by our portal platform. Accounts are not meant to be shared, and tutors and students do not get private one-to-one messaging outside supervised channels.
• Administrator access. Authorised Oxbridge Mentors staff can access portal records for support, billing, safeguarding and quality assurance. We keep that list to the people who need it.
• Hosting. The portal runs on infrastructure provided by the database and hosting suppliers named in section 6. Their personnel can technically reach the underlying data while maintaining and securing the service, under contract and confidentiality obligations.

6. Who We Share Your Data With

We never sell your data, and we never share it for anyone else's marketing. We share it with:

• The tutor teaching the student
• Your school, where we deliver the service through a school
• Safeguarding authorities, social services or the police, where we are required to report or a child is at risk
• Professional advisers such as our accountant, where necessary

We also use the service providers below. They process personal data on our instructions and are not allowed to use it for their own purposes.

• Formspree: receives contact, enquiry, assessment and tutor application form submissions and delivers them to our inbox.
• Calendly: handles consultation and session booking. It holds the name, email and booking details you enter, and a webhook passes new bookings into our own systems.
• Resend: sends our transactional and follow-up emails, so it processes recipient addresses and message content.
• Supabase: hosts the Student Portal database and its sign-in accounts, which is where student records, session history and progress data live. It also stores CVs uploaded with tutor applications, in private storage only our admin team can open.
• Stripe: takes card payments and issues invoices. Stripe collects card details directly, so we never see or store a full card number.
• Zoom: runs live lessons and holds lesson recordings.
• Sanity: our content management system. It stores website content, and the email addresses captured when you unlock a gated resource or join a mailing list.
• Vercel: hosts and serves this website, which means it processes the requests your browser makes. Vercel Analytics and Speed Insights are separate, and neither is loaded at all unless you accept analytics cookies (section 10).
• Google: provides Google Analytics 4. The Google tag loads on every visit, but it starts with every consent signal denied, so it sets no analytics cookies and stores no identifier on your device unless and until you accept (section 10).
• Baidu: provides Baidu Tongji, the analytics we use on our China site because Google services are not reliably reachable there. It is not loaded at all unless the visitor accepts (section 10).
• Microsoft and Meta: Microsoft Teams and supervised WhatsApp group chats are the channels we use for school and family communication.

7. International Transfers

We are based in the United Kingdom and your data is controlled from here. We serve families in the UK, Japan and China, and several of the providers in section 6 are headquartered in the United States or store data outside the UK, so your data may be transferred out of the UK.

Where it is, we rely on one of the following safeguards, depending on the provider:

• UK adequacy regulations, where the receiving country is recognised as offering an adequate level of protection
• The UK Extension to the EU-US Data Privacy Framework, where the provider is certified under it
• The UK International Data Transfer Agreement, or the standard contractual clauses with the UK International Data Transfer Addendum, together with a transfer risk assessment

You can ask us which safeguard applies to a particular provider and we will tell you.

8. How Long We Keep It

• Enquiry data, where you contacted us but did not become a customer: 12 months from your last contact with us.
• Customer records (account, session notes, feedback, correspondence): 12 months after services end.
• Lesson recordings and transcripts: kept while the student's account is active so lessons can be rewatched, then deleted. You can ask us to delete a recording sooner (section 4).
• Payment and accounting records: 6 years from the end of the financial year they relate to, because UK tax law requires it.
• Safeguarding records: kept longer than other records where statutory safeguarding guidance requires it, because they can be needed long after a student has left us.
• Marketing preferences: we keep a record that you unsubscribed, so that we do not email you again.
• Website analytics: kept for the retention period set in our analytics account, after which only aggregated figures remain.

When a retention period ends we delete the data, or anonymise it so that it can no longer identify anyone.

9. Storage and Security

Data is held in password-protected systems, encrypted in transit over HTTPS, with access granted on a least-privilege basis to the people who need it. Portal access is logged. All tutors and staff are safeguarding-trained and under confidentiality obligations, and private one-to-one messaging between tutors and students outside supervised channels is not permitted. If a breach happens that is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you where the law requires it.

10. Cookies and Similar Technologies

When you first visit, a banner asks whether you accept analytics cookies and similar storage. Accepting and rejecting take one click each and are offered with equal prominence, and refusing costs you nothing on this site. You can change your mind at any time by reopening the cookie settings from the Cookie Settings link in our site footer, or by clearing this site's cookies and storage in your browser, which makes the banner ask again. If you refuse, or accept and then withdraw, we also expire the analytics cookies already on your device.

What happens before you choose. We use Google Consent Mode v2. The Google tag itself loads on every visit and reports the page view, but every consent signal starts denied, so it sets no analytics cookies and stores no identifier on your device unless and until you accept. Vercel Analytics, Vercel Speed Insights and, on our China site, Baidu Tongji work differently: they are not loaded at all until you accept.

Some things run whichever way you choose, because they are not analytics or advertising:

• A small amount of storage the site itself uses to remember interface state. For example, that a booking prompt or a notice has already appeared in this browser tab, which market version of the site you picked, the cookie choice you made so we do not ask again on every page, that you have already given your email to unlock a mock interview guide, and a draft of our readiness assessment so a half-finished answer is not lost. That draft stays on your device and expires after 7 days, and we do not receive it unless you submit the form.
• Third-party embeds, on the pages that carry them. Where we embed a booking calendar, the Calendly widget loads with the page so the calendar is ready when you want it, and Calendly may set its own storage in the process. Where we embed a video, the player is YouTube's. We use youtube-nocookie.com, Google's privacy-enhanced embed domain, which limits what YouTube stores on your device, but your browser still has to contact Google to fetch the player, so Google receives your IP address and the address of the page the video sits on. Both load because the page carries them, not because of anything you chose on the cookie banner. If you would rather not load the booking widget, book by email or phone using the details in section 1 instead.

Strictly necessary storage is always on and does not need your consent. We set one cookie of our own, ps_unlock. It appears after you enter your email to unlock a full personal statement example, so the example stays unlocked when you come back. It is httpOnly, so page scripts cannot read it, and it holds an expiry, a short one-way hash of your email and a signature, not your email address itself. It lasts 90 days.

Measurement we use once you accept:

• Google Analytics 4, to see which pages people find useful
• Vercel Analytics and Vercel Speed Insights, which measure traffic and page speed in aggregate
• Baidu Tongji, on our China site, because Google services are not reliably reachable there

11. Your Rights

Under UK GDPR you can ask us to:

• Give you a copy of the data we hold about you
• Correct anything that is wrong or incomplete
• Delete your data, including lesson recordings, subject to safeguarding and legal retention
• Restrict or stop a particular use, including recording
• Object to processing we base on legitimate interests
• Send your data to you or another provider in a portable format
• Withdraw a consent you have given

Email info@oxbridgementors.co.uk and we will respond within one month. We may ask you to confirm who you are first. For students under 16, a parent or guardian normally exercises these rights on the student's behalf.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first so we can put it right.

12. Children

Many of our students are under 18. We collect only what we need to deliver the service and keep students safe. For students under 16, a parent or guardian must set up and manage the account and gives consent on the student's behalf. All tutors are safeguarding-trained and work to our child protection and safeguarding policies. Where we have a safeguarding concern we put the child's safety first, and we may share information with the relevant authorities without consent where the law allows or requires it.

13. Changes to This Notice

We update this notice when the law changes or when we change how we work. The effective and last-reviewed dates at the top tell you which version you are reading. Where a change is significant, we will tell you directly.