Privacy Policy

The Matheia platform is operated by Matimenti Marcin Kobuszewski, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland at 91A, 07-411 Ławy, NIP 7582274330, REGON 526832383 (“Matheia”, “we”, “us”). For matters relating to your personal data, contact us at help@matheia.com.

This policy explains what personal data we process, why, on what legal basis, who we share it with, and the rights you have under the General Data Protection Regulation (GDPR / RODO).

For most data, Matheia is the data controller — for example your account details, the payments you make on the platform, and the security and operation of the service.

When a tutor or organization uses Matheia to manage their own students (for example their student roster, lesson notes, and materials), that tutor or organization is the controller of those records and Matheia acts as a processor on their behalf, handling the data under a data processing agreement and only on their instructions. Questions about how a particular tutor or organization uses your data should be directed to them; we will help you reach them.

Account data: your first and last name, email address, and an encrypted password; your role and language preference. Profile and billing data: your public profile (for tutors and organizations), billing details, and VAT settings where relevant. Service data: bookings, lessons, cohorts, schedules, messages, and lesson notes and files you or your tutor add. Payment data: the amounts, currencies, and status of payments — card details are handled by Stripe and are never stored by us. Technical data: limited log and device data, and your IP address, used for security and to prevent abuse. Integration data: where you connect Google Calendar or Drive, the access tokens needed to provide that integration.

We process your data to: provide and operate the platform and the bookings you make (performance of a contract, Art. 6(1)(b)); process payments and issue invoices, and meet accounting and tax obligations (legal obligation, Art. 6(1)(c)); keep the service secure and prevent abuse, and improve it (legitimate interests, Art. 6(1)(f)); and provide optional features you switch on, such as calendar integration (consent, Art. 6(1)(a), which you can withdraw at any time). Where we rely on legitimate interests, we balance them against your rights.

We share data only where necessary to run the service: Stripe (payment processing and payouts); our invoicing provider, FakturaXL (issuing invoices where a tutor or organization enables it); Google (only if you connect Calendar or Drive); and our hosting and email-delivery providers. Tutors and organizations you book with receive the data needed to provide their service to you. We do not sell your personal data.

Some providers may process data outside the European Economic Area. Where they do, the transfer is protected by an appropriate safeguard under the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision. You can ask us for more detail about the safeguards that apply.

We keep account data for as long as your account is active, and for a short grace period (currently 30 days) after deletion to allow recovery, after which it is deleted or anonymised. Invoicing and accounting records are kept for the period required by Polish tax law (generally five years from the end of the relevant year). Data we process on behalf of a tutor or organization is retained according to their instructions and our agreement with them.

Under the GDPR you have the right to: access a copy of your data (Art. 15); rectify inaccurate data (Art. 16); erase data that is no longer necessary (Art. 17); restrict processing (Art. 18); data portability (Art. 20); object to processing based on legitimate interests (Art. 21); and withdraw consent at any time, without affecting earlier processing. To exercise these rights, contact help@matheia.com. Where Matheia is only a processor for your data, we will pass your request to the responsible tutor or organization.

Matheia uses strictly necessary cookies for authentication and to keep you signed in. We do not use advertising or third-party tracking cookies, so no cookie-consent banner is required. Your browser lets you manage or clear cookies, though blocking essential cookies will stop you from signing in.

We apply appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls, and rate limiting. No system is perfectly secure, but we work to reduce risk and will notify you and the authorities of a breach where the law requires.

Matheia accounts are intended for users aged 16 and over. Where a tutor teaches a student under 16, a parent or legal guardian must be involved and provide consent, and is responsible for the account. If you believe a child has provided data without appropriate consent, contact us and we will address it.

We may update this Privacy Policy from time to time. We will notify registered users of material changes, and the “last updated” date above always reflects the current version.

For privacy questions or to exercise your rights, contact help@matheia.com. If you believe we have processed your data unlawfully, you may lodge a complaint with the Polish Data Protection Authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw — uodo.gov.pl.