In short: we collect only what we need to run an online whiteboard for tutors and their students. That means your account, the boards you work on, and the technical data needed to keep the service secure. There is no advertising, no analytics tracking and no sale of data. For students, the tutor who invites them decides what is recorded, and we process that data on the tutor’s behalf.
Who we are
Tirnel is operated by Volkomtech Ltd, a company registered in the Republic of Cyprus under number HE 456457, with its registered office at Astypalaias 9, 3047 Limassol, Cyprus (“we”, “us”, “our”).
For any privacy question or request, write to hello@tirnel.com. We have not appointed a data protection officer. Privacy requests are handled directly by our team.
Scope and our role
This Policy covers our website tirnel.com, the Tirnel web application at app.tirnel.com, and the emails and support connected to them. Words such as “Tutor”, “Student” and “Board” have the meanings given in our Terms of Service.
Our role depends on the data:
- We are the controller for account data, security and technical data, communications with us, and billing data. We decide why and how this data is used.
- We are the processor for Student Data that a Tutor manages in Tirnel: which Students are added, the Boards the Tutor shares with them, their work on those Boards, and the Tutor’s notes about them. In that case the Tutor is the controller, and we process the data only on the Tutor’s behalf under the data processing terms in Section 6 of our Terms. Students and parents who have questions about how a Tutor uses their data should contact the Tutor first. We will help where we can.
Information we collect
Account information
When you sign up we collect your name, email address, password and role (Tutor or Student). We store your password only as a salted cryptographic hash and never see it in plain text. We also record whether your email address has been verified and when your account was created and last updated.
Lesson content
Tirnel stores what you create and share on Boards:
- board titles, drawings, text, sticky notes, formulas, diagrams, tables and other elements;
- images you upload to a Board. We accept PNG, JPEG and SVG files of up to 10 MB each and record who uploaded them, their type and size;
- saved versions of each Board, including the account that made each change;
- which users are members of which Boards, the Boards you have starred, and invite links with their expiry and revocation dates.
Do not put sensitive information on Boards that you would not want the other members to see.
Tutors’ student records
A Tutor can keep a subject and private notes for each Student. Only the Tutor can see and edit them. The Student cannot see them, and neither can other Tutors.
Real-time collaboration data
While you are on a Board, your cursor position, your name and your presence are sent live to the other people on that Board. This data is sent only while the session is in progress and is not stored as history. Changes to the Board itself are saved as described above.
Technical and security data
When you sign in we create a session that records a session token, your IP address, your browser’s user agent and when the session expires. We use IP addresses to limit repeated sign-in, sign-up and password-reset attempts. Our servers and hosting providers also keep standard technical logs, such as request times, IP addresses and error messages, to run and secure the Service.
Communications
We send transactional emails needed to run your account, such as email verification and password reset links. We do not send marketing emails. If you write to us, we keep your message and our reply so that we can help you.
Payment information
If you buy a paid plan, payments are handled by a third-party payment provider. We receive only what we need to manage your subscription, such as your plan, billing status and payment history. We never receive or store your full card details.
What we do not collect
We do not use advertising, cross-site tracking, third-party analytics or social-media pixels. We do not ask for special categories of data such as health, religion or biometric data, and we ask Tutors not to record them in notes or on Boards.
How we use data and our legal bases
We use personal data only for the purposes below. Where the GDPR applies, each purpose relies on a legal basis under Article 6.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account, sign you in, keep Boards in sync and deliver the features you use | Account information, lesson content, collaboration data | Performance of our contract with you, Art. 6(1)(b) |
| Process Student Data on behalf of Tutors | Student Data | The Tutor’s instructions, Art. 28. The Tutor determines the legal basis |
| Send verification, password reset and other service emails | Name, email address | Performance of contract, Art. 6(1)(b) |
| Protect accounts, prevent abuse and fraud, and fix errors | Technical and security data | Our legitimate interest in a secure, working service, Art. 6(1)(f) |
| Answer your questions and support requests | Communications, account information | Performance of contract or our legitimate interest in helping users |
| Bill paid plans and meet tax and accounting rules | Payment information | Performance of contract and legal obligation, Art. 6(1)(b) and (c) |
| Establish, exercise or defend legal claims, and respond to lawful requests from authorities | Relevant data as needed | Legitimate interest and legal obligation, Art. 6(1)(f) and (c) |
We do not use personal data for automated decision-making that has legal or similarly significant effects, and we do not use your Content to train machine-learning models.
Students and children
Tirnel is built for tutoring, and many Students are under 18. We take this seriously:
- Students join through a Tutor. A Student account is normally created by following an invite link from a Tutor. The Tutor decides which Students to invite and what to record about them.
- Parental consent. Under the GDPR, a child below the digital age of consent (14 in Cyprus, and between 13 and 16 in other EU countries) may use online services only with the consent of a parent or guardian. Our Terms require Tutors to obtain that consent, and parental permission for any Student under 18, before inviting a Student, and to be able to show it. A parent or guardian may also create an account for their own child.
- Minimal data. For a Student we need only a name, an email address and a password. A Student can use a nickname or first name.
- Limited visibility. Students see only the Boards they have been invited to. The Tutor’s notes about a Student are never visible to the Student or other Tutors.
- No profiling. We do not show ads to anyone, profile Students for marketing or sell their data.
- Parents’ rights. A parent or guardian can ask the Tutor, or us at hello@tirnel.com, to access, correct or delete their child’s data. If we learn that a child’s account was created without the required consent, we will delete it or ask the Tutor to obtain that consent.
Who can see your information
Inside Tirnel. Your name is visible to the people you share Boards with. A Tutor sees the name and email address of each Student they have added and the Boards they share with that Student. Everyone on a Board sees its content, and while they are present, each other’s names and cursors.
Service providers. We use the providers listed in Section 7 to host and deliver the Service. They act as our processors or sub-processors, may use the data only to provide their service to us, and are bound by contractual data protection terms.
Legal reasons. We may disclose data if the law requires it, to protect the safety of a person (in particular a child), or to establish, exercise or defend legal claims.
Business transfers. If Tirnel is sold or merged, personal data may pass to the new owner, who will be bound by this Policy. We will tell you before that happens.
We do not sell or rent personal data and do not share it for advertising.
Service providers
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Hosting provider | Hosts the Tirnel application, database and uploaded files | All data stored in the Service | European Union |
| Email delivery provider | Delivers transactional emails | Name, email address, email content | European Union |
| Cloudflare, Inc. | Hosts and delivers the tirnel.com website | IP address and request data of website visitors | Global network |
| Google LLC (Google Fonts) | Serves the typeface used in the web application | IP address and browser information when fonts load | United States and global network |
You can ask us at hello@tirnel.com for the names of our current hosting and email delivery providers. We will update this list before we add or replace a provider that processes personal data.
Where your data is stored
Account data, Boards, uploaded files and Student Data are stored on servers in the European Union, wherever you are located. Transactional emails are also processed in the EU. We do not transfer this data outside the European Economic Area.
Website and fonts. Cloudflare and Google are global networks, and when you load our website or the fonts in the web application they may process your IP address and request data outside the EEA, including in the United States.
Safeguards. Where Cloudflare or Google process data outside the EEA, it is protected by one of the following, together with additional safeguards where needed:
- an adequacy decision of the European Commission for the destination country, including the EU–US Data Privacy Framework where the recipient is certified; or
- the European Commission’s Standard Contractual Clauses.
You can ask for a copy of the safeguards that apply to your data by writing to hello@tirnel.com.
How long we keep data
We keep personal data only for as long as we need it for the purposes above.
| Data | How long we keep it |
|---|---|
| Account information | While your account is open. Deleted within 30 days of closing the account |
| Boards and uploaded images | Until the Tutor deletes them or closes their account. Boards moved to the trash can be restored and stay there until permanently deleted, at the latest when the account is closed |
| Board versions | The 30 most recent automatic versions of each Board. Versions saved manually by the Tutor are kept until the Board is deleted |
| Tutor notes about a Student | Until the Tutor edits them, removes the Student or closes their account |
| Sessions | Up to 7 days after your last activity, or until you sign out. If you do not choose “remember me”, the session ends when you close your browser |
| Board invite links | Valid for 7 days unless revoked sooner |
| Verification and password reset links | Expire after a short period, usually one hour |
| Technical logs | Kept by our hosting providers for a limited period under their retention settings, usually no more than 30 days |
| Support emails | Up to 2 years after the conversation ends |
| Billing records | As long as Cypriot tax and accounting law requires |
| Backups | Overwritten on a rolling basis. Deleted data disappears from backups when they expire |
We may keep data longer if the law requires it or if it is needed to resolve a dispute.
Closing your account. You can ask us to close your account and delete your data at any time by writing to hello@tirnel.com from the email address on the account. Closing a Tutor account deletes the Tutor’s Boards and student records. Closing a Student account removes the Student from the Tutor’s Boards. Content the Student added to a Tutor’s Board stays on that Board, because the Board belongs to the Tutor.
How we protect data
We use technical and organisational measures appropriate to the risk, including:
- encryption in transit (HTTPS) for all traffic to the website and the application;
- password hashing, rate limits on sign-in, sign-up and password reset, and session cookies that scripts cannot read;
- access controls, so that Boards are available only to their owner and invited members, and Tutors’ notes only to the Tutor;
- security headers, restricted cross-origin access, and access to production systems limited to authorised personnel;
- regular backups of the database.
No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the competent supervisory authority as the law requires.
Cookies and local storage
Website (tirnel.com). Our marketing website does not set cookies. Its fonts are hosted on our own servers, and it does not use analytics or tracking.
Application (app.tirnel.com). The application uses only what is strictly necessary to work:
| Name | Type | Purpose | Duration |
|---|---|---|---|
better-auth.session_token |
Cookie, strictly necessary | Keeps you signed in. Over HTTPS the name has the prefix __Secure- |
Up to 7 days, or until you close your browser if “remember me” is not selected |
better-auth.dont_remember |
Cookie, strictly necessary | Records that you chose not to stay signed in | Browser session |
dashboard-board-view |
Local storage | Remembers whether you view Boards as a grid or a list | Until you clear it |
education-board.selection-template |
Local storage | Remembers your preferred style for new Board elements | Until you clear it |
Because these are strictly necessary for the service you asked for, they do not require consent. We do not use advertising or analytics cookies. If we ever plan to, we will ask for your consent first. You can delete cookies and local storage in your browser settings, but you will then be signed out.
Your rights
Depending on where you live, and in particular under the GDPR, you have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate or incomplete data;
- delete your data (“right to be forgotten”);
- restrict or object to processing based on our legitimate interests;
- data portability, meaning you can receive data you provided in a structured, machine-readable format. You can also download Boards as PDF or image files;
- withdraw consent at any time, where we rely on consent;
- complain to a supervisory authority.
To exercise a right, email hello@tirnel.com. We may need to verify your identity, usually by replying from the email address on your account. We will respond within one month. We may extend this by up to two more months for complex requests and will tell you if we do. If your request concerns Student Data that a Tutor controls, we may pass it to the Tutor and help them respond.
Supervisory authority. Our lead authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy). You can also complain to the authority in the country where you live or work. We would appreciate the chance to resolve your concern first.
Changes to this Policy
We may update this Policy as Tirnel changes or as the law requires. The date at the top shows the latest version. For significant changes, we will notify account holders by email or in the application before the changes take effect.
Contact us
Volkomtech Ltd
Astypalaias 9, 3047 Limassol, Cyprus
Company number HE 456457, Republic of Cyprus
Email: hello@tirnel.com