Last updated: October 3, 2026
1. Who is responsible for your information
Upper Hand Tutoring and Test Prep is run by Kristen Amendola, a sole proprietor based in Connecticut, United States. For the purposes of European and UK data protection law, I am the data controller.
Contact: [email protected]
2. What I collect
| When | What |
|---|---|
| You book a consultation or send an inquiry | Parent name, email, country and town, time zone, optional WhatsApp number, student's first name, school year and what they need help with |
| You take the quiz or download a study guide | Email address and your quiz answers. A student taking the quiz is asked for a parent's email, not their own |
| You apply for an Access Seat | Household size, an income range you choose yourself, and anything you add in your note. No documents are requested |
| Your student enrolls | Parent and student names, contact details, school and year, goals and test dates, an emergency contact, your consent choices, and any learning needs you choose to tell me about |
| During tutoring | Lesson notes, diagnostic results, practice scores, progress reports and messages between us |
| You pay | Billing name, amount and date. Card details are handled by the payment provider and never reach me |
| You visit the site | Basic technical data and cookies, as described in section 9 |
3. How I use it, and the legal basis
- To provide tutoring: scheduling, teaching, progress reports and payment. Legal basis: performing our contract.
- To reply to you before enrollment. Legal basis: steps taken at your request before a contract.
- To send the study guides, quiz result and occasional emails you asked for. Legal basis: your consent, which you can withdraw with one click.
- To consider an Access Seat application. Legal basis: your consent.
- To support a learning need you tell me about. Legal basis: your explicit consent. This is always optional.
- To keep financial records. Legal basis: legal obligation.
- To keep the site secure and working. Legal basis: legitimate interest.
I do not use your information for automated decisions or profiling, and I do not sell or rent it to anyone.
4. Children and students
My students are minors, so a parent or legal guardian makes every enrollment and gives every consent. I do not knowingly collect personal information directly from a child under 13 (or under 16 in the EU) without a parent's consent. If you believe a child has given me information without your knowledge, contact me and I will delete it.
Lessons are not recorded unless you ask for a recording. A parent may sit in on any lesson. The lesson link is sent to the parent.
5. Who I share it with
I will not share student information with anyone outside your family. The only other parties that handle your information are the service providers I use to run the practice, each under its own privacy terms:
- Google (Meet for lessons, Calendar, email, and Drive for each family's private folder of reports and resources)
- Cal.com for consultation and lesson scheduling
- Stripe for payments, and Wave for bookkeeping
- Forminit (London, data stored in the EU) for the Access Seat and enrollment forms
- MailerLite for study guide and quiz emails
- WhatsApp, where you choose to message me there
- Google Analytics and Meta, only if you accept analytics or advertising cookies
- Cloudflare, which hosts the website and runs its spam check (Turnstile) on the forms
I may also disclose information where the law requires it, or where it is necessary to protect a child from harm.
6. Transfers outside your country
I am based in the United States, and so are most of the providers above. If you live in the EU, the EEA, the UK or Switzerland, your information is therefore transferred to the United States. Where required, these transfers rely on the provider's certification under the EU-US Data Privacy Framework or on standard contractual clauses.
7. How long I keep it
- Inquiries that do not lead to enrollment: 12 months.
- Access Seat applications: deleted after 12 months if your student does not enroll.
- Student records, lesson notes and progress reports: for as long as your student is enrolled, then two years, so that a returning student can pick up where they left off. Ask at any time and I will delete them sooner.
- Payment and tax records: seven years, as required for tax purposes.
- Email list: until you unsubscribe.
- Lesson recordings made at your request: 90 days unless we agree otherwise.
8. Your rights
Wherever you live, you can ask me what I hold about you and your student, ask me to correct or delete it, and unsubscribe from emails.
Families in the EU, EEA and UK also have the right to access, rectify and erase their data, to restrict or object to its use, to data portability, and to withdraw consent at any time. You may complain to your data protection authority, for example the CNPD in Portugal or the ICO in the United Kingdom.
Families in the United States: I do not sell personal information or share it for targeted advertising. Connecticut and other state residents may ask to access, correct or delete their information.
To use any of these rights, email [email protected]. I reply within 30 days.
9. Cookies
The site always uses the few cookies it needs to work. Everything else is optional. If you visit from the EU, EEA, UK or Switzerland, optional cookies stay off until you accept them in the cookie notice, and rejecting them is one click. Visitors elsewhere can switch them off at any time. Use the "Cookie settings" link at the bottom of any page to change your choice.
| Type | Set by | What it is for | How long |
|---|---|---|---|
| Necessary | This site (cs_consent, kept in your browser) | Remembers your cookie choice | 12 months |
| Necessary | This site (cs_geo, kept in your browser) | Remembers whether the cookie notice applies in your region | Until you close the browser tab |
| Necessary | Stripe (__stripe_mid, __stripe_sid), set on Stripe's own checkout pages, not on this site | Secure payment and fraud prevention at checkout | __stripe_mid 1 year; __stripe_sid 30 minutes |
| Analytics | Google Analytics (_ga, _ga_*) | Counts visits and shows which pages are useful, in aggregate | Up to 2 years |
| Advertising | Meta pixel (_fbp) | Measures and tailors ads on Facebook and Instagram | 3 months |
| Booking tools | Cal.com (only after you load the calendar) | Shows the booking calendar inside the page | Set by Cal.com |
The study guide and quiz sign-up forms send your answers to MailerLite directly and set no cookies on this site.
10. Security
Records are kept in password-protected accounts with two-step sign-in. No system is perfectly secure; if a breach ever affected your information, I would tell you promptly and notify the relevant authority where the law requires.
11. Changes to this policy
If this policy changes in a way that matters, I will email enrolled families before the change takes effect. The date at the top shows the latest version.