Talora ("we," "our," or "us") operates the Talora mobile application and the website at talora.online (together, the "Service"). This Privacy Policy describes what personal data we collect, why we collect it, how we use and protect it, who we share it with, and the choices available to you.
By using the Service you agree to the practices described below. If you do not agree, please do not use the Service.
1. Personal Data We Collect
Data you provide
- Account data — name, email address, phone number, date of birth, and password when you create an account
- Profile data — bio, profile photo, skills, certifications, teaching experience, and hourly rates (teachers)
- Identity verification — government-issued ID and selfie submitted during teacher onboarding, processed by our verification partner
- Payment data — payment method details processed and stored by Stripe. Talora does not store full card numbers on our servers
- Communications — messages sent to other users through the Service, and emails or support requests sent to us
- Reviews and ratings — written reviews, star ratings, and feedback you provide about teachers or students
- Waitlist data — email address and zip code submitted through the waitlist form
Data collected automatically
- Location data — approximate location based on your IP address or the zip code you provide, used to match you with nearby teachers. We do not track precise GPS location in the background
- Device data — device type, operating system, app version, unique device identifiers, and push notification tokens
- Usage data — pages and screens viewed, features used, search queries, booking history, session durations, and interaction patterns within the app
- Log data — IP address, browser type, access times, referring URLs, and crash or error reports
- Performance data — app load times, network errors, and diagnostic information used to maintain service quality
Data from third parties
- Sign-in providers — if you sign in with Google or Apple, we receive your name and email address from that provider. We do not access your contacts, calendar, or other account data from those providers
- Background check providers — for teachers, we receive screening results (pass/fail) from our background check partner. We do not receive the underlying criminal records
- Stripe — provides transaction status, payout details, and fraud risk signals. We do not receive your full card number from Stripe
2. How We Use Your Data
We use the data we collect for the following purposes:
- Providing the Service — matching students with teachers based on skill, location, and availability; processing bookings and schedule management; facilitating secure payments and payouts; delivering in-app messages and notifications
- Safety and trust — verifying teacher identities, running background checks, detecting fraudulent activity, enforcing our Terms of Service, and investigating user reports of misconduct
- Improving the Service — analyzing usage patterns and feedback to fix bugs, improve existing features, and develop new functionality
- Transactional communications — sending booking confirmations, payment receipts, lesson reminders, schedule changes, and account security alerts via email and push notification
- Customer support — responding to your questions, resolving disputes between users, and troubleshooting technical issues
- Marketing — with your consent, sending product updates, new feature announcements, and promotional offers. You can opt out at any time via the unsubscribe link in any email or through your account settings
- Legal compliance — complying with applicable laws, regulations, and legal processes; responding to lawful requests from public authorities
We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.
5. Data Retention
We retain your personal data for as long as your account is active and as needed to provide the Service. When you delete your account:
- Your profile, messages, and booking history are permanently deleted within 30 days
- Reviews you wrote remain visible but are anonymized (author name removed)
- Payment and transaction records are retained for 7 years as required by U.S. tax and financial regulations
- Anonymized, aggregated data (with no way to identify you) may be retained indefinitely for service analytics
- Data involved in an active dispute, investigation, or legal hold is retained until resolution
You can request account deletion at any time through the app settings or by emailing privacy@talora.online.
6. Data Security
We protect your data using industry-standard security measures:
- All data is encrypted in transit using TLS/HTTPS and at rest using AES-256 encryption
- User authentication is managed through Firebase Auth with support for Google Sign-In, Apple Sign-In, and email/password with email verification
- Passwords are never stored in plain text — they are hashed and salted by Firebase
- Role-based access controls limit employee access to personal data on a need-to-know basis
- Payment processing is PCI DSS compliant through Stripe — card data never touches our servers
- Infrastructure is hosted on Google Cloud Platform with automated security patching and monitoring
- We conduct regular security reviews and address vulnerabilities promptly
No system is 100% secure. If we discover a breach that affects your personal data, we will notify you and applicable regulatory authorities within the timeframes required by law.
7. Your Rights and Choices
Depending on your jurisdiction, you may have the following rights:
- Access — request a copy of the personal data we hold about you
- Correction — request that we correct inaccurate or incomplete data
- Deletion — request deletion of your account and associated personal data
- Portability — request your data in a structured, commonly used, machine-readable format
- Restriction — request that we limit how we use your data in certain circumstances
- Objection — object to our use of your data for certain purposes, including marketing
- Marketing opt-out — unsubscribe from marketing emails via the link in any email, or adjust preferences in your account settings
- Push notifications — disable through your device's notification settings at any time
To exercise any of these rights, email privacy@talora.online. We will verify your identity and respond within 30 days. We will not charge a fee for processing your request unless it is manifestly unfounded or excessive. We will never discriminate against you for exercising your privacy rights.
8. California Privacy Rights
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
- Right to know — you can request the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties we have shared it with
- Right to delete — you can request that we delete your personal information, subject to certain legal exceptions
- Right to correct — you can request correction of inaccurate personal information
- Right to opt out of sale or sharing — we do not sell personal information or share it for cross-context behavioral advertising
- Right to limit use of sensitive data — we only use sensitive personal information for purposes permitted under the CCPA
- Right to non-discrimination — we will not deny you services, charge different prices, or provide a different quality of service because you exercised your privacy rights
To submit a request, email privacy@talora.online with the subject "CCPA Request." We will verify your identity before processing. You may also designate an authorized agent to make a request on your behalf by providing written authorization.
In the preceding 12 months, we have not sold personal information. For details on the categories of data we collect and how we use them, see Sections 1 and 2 above.
9. Children and Minors
The Service is available to users aged 13 and older. Users between 13 and 17 must have a parent or guardian manage their account through our Parent Dashboard feature. Parents can monitor their child's bookings, messages, and account activity.
We do not knowingly collect personal data from children under 13 without verified parental consent. If you believe a child under 13 has provided us with personal information, please contact us at privacy@talora.online and we will delete it within 48 hours.
For users aged 13–17, we limit the collection and use of data to what is necessary to provide the Service. We do not send marketing communications to minors, and we do not share their data with third parties for marketing purposes.
10. International Users
Talora is based in the United States and our servers are located in the U.S. If you access the Service from outside the United States, your data will be transferred to and processed in the United States, where data protection laws may differ from those in your country.
By using the Service, you consent to the transfer of your data to the United States. We take reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notification at least 30 days before the changes take effect and update the "Effective" date at the top of this page. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. If you disagree with a change, you may delete your account before it takes effect.
12. Contact Us
If you have questions, concerns, or requests related to this Privacy Policy or how we handle your data, you can reach us at: