FindMyTutor UAE — Data Retention & Processing Policy

Operated by Zyron FZE LLC

Effective Date: 1 May 2026
Last Updated: 20 September 2026

1. Introduction

This Data Retention & Processing Policy explains in detail how Zyron FZE LLC, trading as FindMyTutor UAE ("FindMyTutor", "we", "us", "our"), processes, stores, and retains personal data on the Platform. It supplements our Privacy Policy and should be read alongside it.

This Policy is issued in compliance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL").

2. Data Processing Principles

We process personal data in accordance with the following principles:

Lawfulness — we process personal data only on a valid legal basis under the UAE PDPL.
Purpose limitation — we use personal data only for the purposes for which it was collected, or for compatible purposes.
Data minimisation — we collect only the personal data we genuinely need.
Accuracy — we take reasonable steps to keep personal data accurate and up to date.
Storage limitation — we retain personal data only for as long as is necessary, in line with this Policy.
Integrity and confidentiality — we apply appropriate technical and organisational security.
Accountability — we maintain records and take responsibility for our processing.

3. Categories of Data Processed

We process the following categories of personal data.

3.1 Account Data

Full name, email address, phone number (optional), securely hashed password.
Account type (student, parent/guardian, tutor).
Sign-in method.
Confirmation of age and guardianship status (collected at signup, not displayed publicly).

3.2 Tutor Profile Data

Subjects, levels, and curricula taught.
Pricing, availability, and service area.
Biographical description and photograph (where uploaded).
Verification documents (where uploaded).

3.3 Student / Parent Request Data

Subject, level, curriculum, location, budget, schedule, and preferences.
Free-text descriptions of learning goals.
Privacy preferences for contact-detail sharing.

3.4 Messaging Data

Message content, sender, recipient, timestamps, read status.
Conversation metadata.

3.5 Subscription and Payment Data

Subscription plan, billing period, status.
Stripe customer and subscription identifiers.
Transaction records and invoices.

3.6 Technical Data

IP address, device, browser, operating system.
Session identifiers and authentication tokens.
Server logs and diagnostic information.

3.7 Support Data

Support emails, attachments, and notes.
Records of complaints and resolutions.

4. Purposes of Processing

We process the categories of data listed above for the purposes set out in our Privacy Policy, including:

Operating the Platform and providing the contracted service.
Processing subscriptions and payments.
Communicating with users.
Improving the Platform.
Preventing fraud, abuse, and safeguarding risks.
Complying with legal and regulatory obligations.
Marketing where you have opted in.

5. Retention Periods

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable UAE law. The table below summarises our standard retention periods. Where law requires longer retention, the legal requirement prevails.

5.1 Account Data

Active accounts: retained while the account is open.
Closed or deleted accounts: most personal data deleted or anonymised within 12 months of account closure.
Limited identifiers may be retained longer to prevent re-registration of suspended accounts and to protect against fraud.

5.2 Tutor Profiles

Active profiles: retained while the account is open.
Inactive profiles (no login for 24 months): may be archived or hidden from public view, then deleted in line with the account-closure schedule.

5.3 Student and Parent Requests

Active requests: retained while open and matched.
Closed or expired requests: retained for up to 12 months after closure for analytics, dispute resolution, and abuse-prevention purposes, then deleted or anonymised.

5.4 Messaging Data

Retained for up to 24 months after the most recent message in a conversation, then deleted or anonymised.
May be retained longer where reasonably necessary to investigate a specific complaint, dispute, or breach.

5.5 Subscription and Payment Records

Retained for at least 5 years to comply with UAE financial, tax, and accounting requirements.
Some records may be retained longer where required by law.

5.6 Verification Documents

Retained for up to 12 months after a verification decision, then deleted unless retention is required by law or to investigate a specific concern.

5.7 Support Communications

Retained for up to 24 months after the matter is resolved.

5.8 Server, Security and Audit Logs

Retained for up to 12 months for security, fraud-prevention, and operational purposes.
Free-trial and fraud-prevention records (card fingerprints, card type, cardholder names, normalised email addresses, device identifiers and related trial records): retained while your account is open and for up to 3 years after it is closed, so that free trials cannot be reused by closing and reopening accounts.
Internal logs of our team's access to messages: up to 24 months.

5.9 Legal and Regulatory Records

Retained for the period required by the relevant law or regulation.

6. Deletion and Anonymisation

When personal data reaches the end of its retention period, we either:

Securely delete it; or
Anonymise it (so that the data can no longer be linked to an identifiable individual) for analytical or statistical purposes. Where deletion is not technically possible immediately (for example, in long-term backups), we securely store the data and delete it on the next applicable schedule.

7. Security Measures

We apply appropriate technical and organisational measures, including:

TLS/HTTPS encryption for data in transit.
Industry-standard hashing for passwords (we never store plain-text passwords).
Role-based access controls and the principle of least privilege.
Server-side input validation and protection against common web vulnerabilities.
Logging and monitoring of access to personal data.
Use of reputable third-party providers with strong security practices.
Regular review of security configurations and procedures.

8. Access Controls

Access to personal data is limited to authorised personnel of Zyron FZE LLC and authorised personnel of our service providers, in each case on a need-to-know basis. All such personnel are subject to confidentiality obligations.

9. International Transfers

Some service providers may process personal data outside the UAE. We rely on the safeguards set out in Section 9 of our Privacy Policy to ensure an appropriate level of protection.

10. Legal and Regulatory Holds

Notwithstanding the retention periods above, we may retain personal data where:

It is required for legal, regulatory, tax, or accounting purposes.
It is necessary for the establishment, exercise, or defence of legal claims.
It is the subject of a lawful request by an authority or court.
It is necessary to investigate or prevent fraud, abuse, or safeguarding risks.

11. Your Rights

Your rights in relation to personal data are set out in Section 12 of our Privacy Policy. Where you exercise a right (for example, to deletion), we will apply that right consistently with this Policy and any legal obligations to retain certain data.

12. Changes to This Policy

We may update this Policy from time to time. The most current version will be available on the Platform with an updated "Last Updated" date. Material changes will be communicated as set out in our Privacy Policy.

Contact Us

If you have any questions about this policy, please contact us using the details below:

Zyron FZE LLC
Trading as FindMyTutor UAE
BC-892423, 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates
Email: [email protected]
Phone: +971 50 247 5166
Website: https://findmytutoruae.com