Privacy Policy

Last Updated: 22 October 2026

Your privacy is important to us and so is being transparent about how we collect, use, and share information about you. This Privacy Policy explains our privacy practices for the activities described herein. Please read this Privacy Policy carefully to learn how we collect, use, disclose, store, and handle your personal information when you access our website or use any of our Services. Any reference to "Clastor," "we," "us," "our" or the "Company" is a reference to Clastor. When you access our Website or use our Services you agree to the terms of this Privacy Policy.

Sometimes we will need to update our Privacy Policy so it may change from time to time. By continuing to use our Website or Services after we make any changes, you will be deemed to have accepted those changes, so it is important that you read this Privacy Policy in its entirety and check this Privacy Policy regularly for any updates.

What is personal information?

'Personal information' is information we collect and hold which is identifiable as being about you.

This policy covers how we treat your information, including your personal information, that you provide when you access or use our services. Our services include Clastor, a tutor management platform that helps independent tutors and small tutoring teams manage scheduling, student records, communications, invoicing, and payments. We are not responsible for and our services don't extend to the services of any company we don't own or control, or people that we don't manage.

Types of information we collect

We collect personal information directly only when you provide it to us. The types of personal information we collect includes but is not limited to:

  • Account information such as your name and email address;
  • Answers you give when you sign up, such as the kind of tutoring you do, how many students you have, the subjects you teach, your usual rate, where and when you teach, and the tools you use now, which we use to set up and personalise your account;
  • Professional information including your subjects, rates, and qualifications (as you add them to your public profile);
  • Student and guardian contact details that you add to your account (for example, name, email, phone number, and timezone);
  • Scheduling information, including lesson times, attendance records, and lesson notes;
  • Billing information, including invoice details, payment status, and transaction history;
  • Information from integrations you connect, such as Google Calendar and Google Meet, as described in How we use Google user data below; and
  • Your chats with Ask Clastor, the assistant built into Clastor, as described in How do we use artificial intelligence? below;
  • Usage data and analytics, including product analytics events and session recordings of on-screen activity, as described in the "How do we use cookies and analytics?" section below.

We do not collect or store full payment card numbers. Card information entered by your students or their guardians is handled directly by our payment processor, Stripe, and is governed by Stripe's privacy policy.

Any sensitive information you provide to us may be relevant to providing you with our services, and you acknowledge that we will use your sensitive information for this sole purpose. Your sensitive information will only be disclosed for another purpose where you would reasonably expect the sensitive information to be disclosed, and the disclosure is directly related to providing you with our services.

Data Ownership: You own the student records, lesson notes, invoices, and other content you add to Clastor. We process that information solely to provide and run the Services for you.

How we use Google user data

Clastor is tutor management software that helps private tutors schedule lessons, track attendance and invoice students. Tutors can choose to connect a Google account so their lessons appear in Google Calendar, with Google Meet links for online lessons. Connecting Google is optional, and Clastor works without it.

What we access

When you connect Google, we ask for one permission: events on Google calendars you own (calendar.events.owned), to see, create, change and delete events on your own calendars. We don't ask for your Google account email address or profile.

We don't use Google to sign you in to Clastor, and we don't access calendars shared with you by others, Gmail, Google Drive, your contacts or any other Google service.

How we use it

  • Adding your lessons to Google Calendar. We create, update and delete calendar events for the lessons you schedule in Clastor. Each event contains the student's name and subject as its title, the lesson time and location, and a Google Meet link for online lessons. We don't add students as guests, so Google doesn't email them. We only change or delete events that Clastor created.
  • Showing your other commitments. We read the title, time and location of other events on your primary calendar so we can show them next to your lessons in your Clastor schedule and warn you when a lesson clashes with them. These events are fetched when you view your schedule and aren't stored on our servers.

What we store

We store a refresh token from Google so your calendar stays in sync without you having to reconnect, the date you connected, and the ID and Meet link of each calendar event Clastor creates for a lesson. This data is stored in Google Cloud (Firestore), encrypted in transit and at rest, and is only used to provide the features above.

Sharing and limits on use

  • We do not sell Google user data.
  • We do not use Google user data for advertising, and we do not use it to develop, improve or train artificial intelligence or machine learning models.
  • We do not send Google user data, including your calendar events and Google Meet links, to Anthropic or any other AI provider. Clastor's AI features (see How do we use artificial intelligence?) only work with the information you add to Clastor itself.
  • We do not share Google user data with third parties, except as needed to provide the features described above, to comply with the law, or as part of a merger or acquisition with your notice.
  • Our team does not read your Google user data unless you ask us to (for example, for support), it's needed for security purposes such as investigating abuse, or it's required by law.

Clastor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deleting

You can disconnect Google at any time from the Google card in your Clastor settings. When you do, we delete the stored token and ask Google to revoke Clastor's access. You can also remove access from your Google Account permissions page.

Lesson events already added to your Google Calendar stay there after you disconnect, and you can delete them in Google Calendar. To have all of your Google user data deleted from Clastor, email us at info@xamify.com.au and we will delete it within 30 days.

Cloud-based Data Storage and Management

We use secure cloud-based data storage for managing the information you add to Clastor. This data is stored on secure cloud infrastructure which helps us organise it in a structured manner. Access to your data is restricted so that only you (and, for team accounts, the colleagues you invite) can access it.

Users can delete their data and their account at any time. Our systems process only the information necessary to provide the Services to you.

No AI Training on Your Data: We do not use your content, your students' details, or any data you add to Clastor to train artificial intelligence models, nor for any purpose not directly related to delivering the Services to you.

Ways of collecting information

We have different ways of collecting information. We collect your personal information directly from you, including when you:

  • Access or use our Website;
  • Create an account, or subscribe to or use our Services;
  • Use our Services as an invited team member (for example, as a colleague invited by a tutor who holds the account);
  • Sign up to receive marketing material including exclusive offers, promotions, or events;
  • Participate in surveys, competitions, promotions or request information or material from us;
  • Make inquiries about us or our Services or otherwise communicate with us by email, by telephone, in person, via the Website or otherwise; and
  • Apply to work with us or are engaged by us.

We may also receive limited information from third-party services you choose to connect (such as Google, when you enable Calendar sync) or from a colleague who invites you to a shared Clastor workspace.

How do we use cookies and analytics?

Certain information is collected automatically through your device, such as your computer address, computer type, operating system name and version, device manufacturer and model, language, Internet browser type and the websites you visit, including through cookies and analytics. We collect this information to analyse data, to track your experience on our Website and to improve the functionality and experience of Clastor products, services and our Website.

We use the following technologies to collect technical information and general analytics:

  • Cookies – these are type of data files that are placed on your device and often include an anonymous unique identifier;
  • Log files, which track actions occurring on our Website (which we collect anonymous data on and track); and
  • Web beacons, tags, and pixels, which are electronic files used to record information about how you browse our Website.

We use a third-party product analytics service, PostHog, to help us understand how our Website and Services are used so we can improve them. When you use Clastor, PostHog may collect:

  • Analytics events, such as pages viewed, elements clicked, and features used;
  • Device and browser information, such as browser type, operating system, and approximate location derived from your IP address;
  • If you have an account, limited account details (your user ID, name, email address, and role) so we can understand how you use the Services; and
  • Session recordings: recordings of on-screen activity (such as mouse movements, scrolls, and the page content visible during your session) that help us troubleshoot issues and improve the Services. Text you type into input fields (such as passwords) is masked in these recordings by default.

PostHog processes this information on our behalf as a service provider. You can learn more about PostHog's data practices at posthog.com/privacy.

By using our Website and our Services, you are consenting to the use of these technologies in accordance with this Privacy Policy.

How do we use artificial intelligence?

Some features of the Services use artificial intelligence (AI) models provided by Anthropic. When you use one of these features, the information it needs is sent to Anthropic, which processes it on our behalf to produce the result and returns it to Clastor.

Ask Clastor

Ask Clastor is an assistant built into Clastor. It answers questions about your tutoring business and can make changes for you, such as booking lessons, recording attendance or creating invoices. When you use it:

  • We send Anthropic your messages, the page you have open, the current time and your timezone, and the records the assistant looks up to answer you, such as student and guardian contact details, rates, lesson times and notes, invoices and payments;
  • The assistant looks things up straight away, but before it changes anything, emails anyone or records a payment, it shows you what it is about to do and only goes ahead once you approve. Changes it makes are listed in your Activity;
  • We save your chats so you can come back to them. Each chat is deleted automatically 90 days after its last message, and you can delete a chat sooner from your list of chats; and
  • We keep a count of how many questions you ask each month, and how much processing they use, to apply your monthly allowance.

Finding students in a list

When you add students by pasting or uploading a list, such as a class list, a copied spreadsheet or an email from a parent, we send that text to Anthropic to pick out each student's details. A CSV file in Clastor's student template is read without AI. Nothing is saved until you review the students found and confirm which ones to add.

Our commitments

Wherever we use AI:

  • We send only what the feature needs to produce the result you asked for;
  • We never send information we receive from Google APIs, such as your Google Calendar events and Google Meet links, to Anthropic or any other AI provider;
  • We do not use your content, your students' details, or any data you add to Clastor to train AI models, whether our own or those of third parties; and
  • We require any third-party AI providers we use to process data on our behalf solely to deliver the feature, and not to use it to train their models.

You can learn more about Anthropic's data practices at anthropic.com/legal/privacy.

How we use and disclose information

In general, we use your personal information for purposes or legitimate interests connected with our business. We use your personal information strictly for the purposes of providing our Services to you. Specifically:

  • To enable the proper operation and functionality of our Services as requested by you or your organisation;
  • To verify your identity when you access our Services;
  • To send scheduling reminders, calendar invites, invoice emails, and other communications through the Services on your behalf;
  • To communicate with you regarding our Services and to address any updates, issues or complaints;
  • To consider you for a role at Clastor (whether as an employee or contractor) or other relationships with us;
  • To meet our legal obligations related to providing our Services;
  • To contact you regarding the above, including via electronic messaging such as email, by mail, by phone or in any other lawful manner.

Who do we disclose personal information to?

We may disclose your personal information to third parties in connection with the purposes described above. This may include disclosing your personal information to the following types of third parties:

  • Our professional advisers (such as lawyers, accountants or auditors) and insurers;
  • Our employees, contractors and third party service providers who assist us in performing our functions and activities;
  • Payment systems operators (such as Stripe) and financial institutions;
  • Cloud service providers and data storage providers;
  • Product analytics providers (such as PostHog), who process usage data and session recordings on our behalf to help us understand and improve the Services;
  • AI providers (such as Anthropic), who process the information an AI feature needs on our behalf to produce its results;
  • Integration providers you connect (such as Google, for Calendar and Meet), only to the extent needed to provide the feature you enabled;
  • Telecommunications providers and IT support services providers;
  • Third parties to whom you have authorised us to disclose your information; and
  • Any other person as required or permitted by law.

We may also share anonymous or de-identified usage data with our service providers for the purpose of helping us in such analysis and improvements. Additionally, we may share such anonymous or de-identified usage data on an aggregate basis in the normal course of operating our business.

Data Security Practices

We implement industry-standard security measures to protect your personal information:

  • Encryption: We use encryption in transit and at rest to protect your sensitive data;
  • Authentication: Accounts are protected by secure authentication and session management;
  • Access Controls: We maintain strict access controls so that only you (and teammates you invite) can access your data;
  • Regular Audits: We conduct regular security audits and assessments;
  • Accredited Infrastructure: We use accredited data centers via Google Cloud Platform and Firebase;
  • Incident Response: We have processes in place to detect and respond to security incidents.

While we have implemented appropriate organisational and technical measures, we cannot guarantee the security of transmission of personal information online. All personal information you share with us online is disclosed at your own risk. Please notify us immediately if you become aware of any breach of security.

How long do we keep your personal information?

We will keep your personal information only for as long as necessary to provide you with our Services, unless a longer retention period is required by law or specified in our retention policy. When you request deletion of your data or your account, we ensure it is deleted from our systems, except where retention is necessary to comply with legal obligations, resolve disputes, or maintain security.

Chats with Ask Clastor are deleted automatically 90 days after their last message, and you can delete a chat sooner from your list of chats.

Your rights in relation to information

You may seek access, correct or update personal information we hold about you by contacting us as described in the "How to contact us" section below. You may have the following rights:

  • Access: Request access to personal information we hold about you;
  • Correction: Request correction of inaccurate data;
  • Deletion: Request erasure of personal information we hold about you;
  • Withdraw Consent: Withdraw consent where we relied on your consent to process your personal information;
  • Restrict Processing: Request that we restrict our use of your personal information;
  • Data Portability: Request a copy of your personal information in a structured, machine-readable format;
  • Opt-out: Opt-out of marketing communications at any time.

We may require that the person requesting access provide suitable identification and where permitted by law we may charge a fee for giving access to your personal information. These rights apply to the extent required under applicable privacy laws.

Your responsibilities

When you add information about your students or their guardians to Clastor, you are responsible for making sure you have the right to share that information with us for the purpose of providing the Services. This may include obtaining consent from those individuals and complying with the privacy laws that apply to you and your tutoring business.

Compliance and Best Practices

We follow industry best practices and implement appropriate technical and organisational measures to protect your personal information. Our privacy and security practices are aligned with OWASP guidelines and industry standards. Our privacy practices are designed to align with the principles of:

  • Data Minimisation: We collect only the information necessary to provide our services;
  • Transparency: We provide clear information about our data practices;
  • User Control: We give you control over your personal information;
  • Security by Design: We implement security measures from the ground up;
  • Regular Review: We regularly review and update our privacy and security practices.

How can you complain about a privacy issue?

You may make a privacy complaint in relation to personal information we hold about you by contacting us as described in the "How to contact us" section below.

If you make a privacy complaint, our team will investigate the matter and attempt to resolve it as soon as reasonably possible (usually within 30 days of receipt of your complaint).

If you believe your concerns have not been resolved satisfactorily by us, or you wish to obtain more information on privacy requirements you can contact your regulatory authority. This may be:

How to contact us

If you have a query, concern or complaint about the manner in which your personal information has been collected or handled by us or would like to request access to or correction of the personal information we hold about you, please contact us:

Clastor
Attention: Privacy Officer

Email: info@xamify.com.au

International Data Transfers

We store personal information in secure data centers. Where we transfer personal information internationally, we take appropriate steps to ensure that overseas recipients that we disclose personal information to have adequate safeguards in place. For example, our product analytics provider, PostHog, processes analytics data in the United States, and our AI provider, Anthropic, may process the information our AI features send it in the United States. This may include assessing the privacy laws in the country where the information is disclosed or putting in place contractual clauses with third party service providers regarding data handling practices.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.