Data policy · version of 7 October 2026

How we handle your data

We teach with your real work, so the tools see real work. This page says what we keep, where we keep it, who sees it, how long we hold it and how to have it deleted. It covers the student area at tutto.one/learn, the Praxis tools (the use case card, the AI charter, the agent scorecard and the hand-over check), the enquiries you send us and calls to our phone assistant.

What stays with you

The tools keep your work in your own browser. Nothing you type in them reaches us unless you press "Share with Tutto".

Your browser wipes the work after 30 days if you don't open it. It doesn't follow you to another computer or browser, and clearing your browser data wipes it too.
To keep it, open "Your work" and save it to a file (a CSV you can open in Excel). You can open that file in the tool later on any computer and carry on where you left off.
Documents the tools make, like your AI charter or your printed card, are yours. We don't keep them. Save them where you keep your other work.
On a shared computer, save your file and then choose "Clear from this browser" before you leave.

What we keep, and why

Your student account on /learn: your name, email, role, LinkedIn, background, the AI accounts you have, the task you'd like help with, your computer and, if you give one, someone else we can contact. We keep it so we can prepare for you and run your sessions. Please ask that other person first: we only contact them if a session moves and we can't reach you.
Our notes about you, written by your trainer to prepare your sessions. You can ask to see them.
Your progress: which sessions you've ticked off, and when you signed in.
Work you share with us from the tools: one copy each time you press "Share with Tutto", with your name, email and organisation, so we can read it before we meet.
Enquiries and mailing list sign-ups from the contact forms, so we can reply.
Bookings for our evenings, like the ones at Rieuzal: your name, email, company and how many of you are coming, so we can hold your place, run the waiting list and send you the reminder.
Calls to our phone assistant on 05 36 08 02 89: a transcript of the call and a short summary, including any name, company or email you give. We don't keep the number you call from, and calls last 2 minutes at most. We don't record the sound of the call: it's turned into text as you speak, and only the text is kept. The transcript and summary are stored on our server in France and emailed to Daniel after the call so he can answer your questions. The assistant is an AI (Voxtral, from Mistral AI). Before you ask anything, it tells you that and says the call is passed on to Daniel. If you'd rather it wasn't, hang up and email us instead.
When you agreed to this policy, and which version, so we can show it later.

We don't sell any of it, use it for advertising or put it into AI tools to train them.

How long we keep it

Your student account, progress, our notes and anything you shared: for the length of your programme and 6 months after your last session. That covers the review period after the course and any questions about it. Then it's deleted automatically.
If your organisation's contract sets a different period, the contract wins and we set that date on your programme.
Work shared by someone who isn't on a programme: 6 months after it was sent.
Bookings for an evening: 6 months after it took place.
Call transcripts and summaries: deleted from our server automatically 6 months after the call. The summary emailed to Daniel stays in his mailbox like any other email, until you ask us to delete it.
Sign-in links: a day after they're used or expire.
Enquiries and mailing list sign-ups: until you ask us to delete them or unsubscribe.
Deleted data can stay in our database host's backups for up to 7 days, and then it's gone too.

Where it's kept and who sees it

Only Daniel and the trainers on your programme see your data. These services hold it for us, under their own data protection terms:

Replit runs the website and holds its database, in North America.
Resend sends the sign-in, welcome and booking emails. It also sends Daniel the call summaries.
For the phone assistant: OVH, in France, provides the phone line and the server the assistant runs on, where the transcripts are stored. LiveKit carries the sound of the call, in the European Union (Frankfurt). Mistral AI, in the European Union, turns your voice into text and back (Voxtral) and writes the assistant's answers and the summary.
Google Workspace holds our email, calendar invites, meeting notes and Google Meet calls.

Some of these are in the United States. Where data leaves the UK or the European Union, it's covered by the standard contract clauses those services sign up to.

For organisations

Until your organisation's AI rules say what may go into AI tools, use placeholders for client names, personal details and real figures. Writing those rules is session 1.
What your team shares with us about your business is yours. We use it only to run your programme, and we follow your instructions about it. Your contract with us sets this out.
At the end of the programme you can ask us to delete everything from your team straight away, and we send you confirmation.

During your programme, and at the end

After each session, save your work from each tool to a file.
When you'd like feedback before a session, share a copy with us from "Your work".
At the end, keep your files and the documents you made, and clear the tools from your browser if the computer is shared.
If you leave your organisation or switch computers, open your saved files on the new one. Anything left only in the old browser is lost.

Your rights

You can ask for a copy of everything we hold about you, ask us to correct it or ask us to delete it. Email daniel@tutto.one from the address we know you by. We reply within a month, usually much sooner.

When we delete your data, we email you a confirmation with a reference number, the date and what kinds of record went. We keep a note that the deletion happened, with that reference, but not your details. We also clear what we hold about you in our email, calendar and meeting notes.

If you're unhappy with how we've handled your data, tell us first so we can put it right. You can also complain to the data protection regulator where you live: the ICO in the UK, the CNIL in France or the Garante in Italy.

If something goes wrong

If your data is lost, stolen or seen by someone who shouldn't see it, we tell you as soon as we know and we tell the regulator within 72 hours where the law requires it.

Changes to this policy

When we change what this policy means, we change the version date at the top and ask you to agree again the next time you sign in or open a tool.

Tutto, Daniel Forsthofer · daniel@tutto.one