Privacy Policy

GRC Madagascar publishes and operates TuToSite. For privacy questions, contact contact@tutosite.com.

We only collect what is needed to run the service:

• Email address and display name (profile), provided at sign-up or through an identity provider (Google, Facebook) via Supabase Auth.
• Profile details you choose to add or edit (for example a profile photo).
• Learning data tied to your account, including progress through tutorials and learning paths.
• Limited technical logs (approximate IP, device/browser type, timestamps) used for security, diagnostics, and abuse prevention.
• Information you voluntarily send through Feedback (message, feedback type, optional screenshot, page URL).

Your data is used only to operate and secure TuToSite:

• Create and manage your user account.
• Track tutorial and path progress so your learning status stays accurate.
• Send service-related notifications (for example feedback acknowledgements) through the Resend API.
• Protect the platform, detect abusive use, and manage admin privileges.
• Improve the product using user feedback and technical incident reports.

Account authentication and storage run on Supabase infrastructure. Credentials and sensitive authentication data are handled according to Supabase security practices, including hashing and service-side access controls.

Database access is governed by Row Level Security (RLS) policies so users only reach data they are allowed to see. Admin accounts have restricted privileges through a dedicated role.

Tutorials play through YouTube’s privacy-enhanced embed (`youtube-nocookie.com`). This reduces advertising cookie use compared with the standard embed while still allowing playback.

YouTube (Google) may still process technical data related to playback. Please review Google’s privacy policy for those details.

We do not sell, rent, or hand over your personal data to advertisers or data brokers.

Technical providers support the service only: Supabase (auth and database), Resend (transactional / feedback email), and YouTube for video playback. They process data under their own terms and only for the purposes described here.

Account data is kept while your account remains active. Technical logs are retained as long as needed for security and diagnostics. Feedback messages and attachments are kept for the time required to handle your request, then archived or deleted as operations require.

You may request deletion of your account and related data by writing to the contact address below.

Under applicable law (including Malagasy law and, where relevant, the GDPR for people in the EU/EEA), you may request access, correction, deletion, restriction, or object to certain processing. Contact us to exercise these rights. We will respond within a reasonable time after verifying your identity.

We may update this policy when the service or legal requirements change. The update date at the top of this page is authoritative. For material changes, we will aim to notify signed-in users through an appropriate channel.