Most online tutoring platforms record lessons by default, store those recordings for an unspecified period, and describe their security as “industry standard” without saying what that means. For a service whose users are overwhelmingly children, that is a thin answer. Recording a minor is a decision, not a default, and a provider who cannot tell you where the file lives, how long it stays there and who can open it has not thought about the problem. Six direct questions will separate the providers who have from the ones who have not.
Why this is different from other software
A tutoring platform holds an unusual combination: video and audio of a minor, their academic performance over time, their weaknesses in detail, a parent’s contact information and payment details, and often the name of their school.
Assembled, that is a richer profile than most services ever build about an adult. It is also a profile of someone who cannot consent to its creation.
In the UAE, processing of personal data is governed by Federal Decree-Law No. 45 of 2021, which sets rules on collection, storage, processing and cross-border transfer. It applies to organisations processing the data of people in the UAE regardless of where the organisation itself sits, which matters when your tutor is in another country and the servers are in a third.
The six questions
Are lessons recorded, and can we opt out? Recording is usually on by default and usually justified as being for the student’s benefit, which is often true. The question is whether it is a choice. A provider who cannot switch it off has designed for their convenience rather than yours.
Where is it stored and for how long? Ask for a retention period in months. “Securely” is not an answer, it is a reassurance. Indefinite retention of video of a child should give you pause regardless of how good the encryption is.
Who can watch it? The honest answer names a role: the tutor, a named safeguarding lead, an engineer with production access. “Authorised personnel” means nobody has drawn up the list.
Is any of it used to train software? Increasingly relevant and rarely volunteered. Some platforms use session data to improve matching, transcription or automated feedback. That may be fine. You should be told.
Which country is the data held in? Cross-border transfer of personal data carries specific requirements under UAE law. A provider should know which jurisdiction their storage sits in and be able to say so immediately.
How do we delete everything if we leave? A provider who has thought about data has a deletion process. One who has not will treat the question as unusual, which is itself the answer.
What a good answer sounds like
You are not looking for a legal document. You are testing whether anyone has considered the question.
A good answer is specific and slightly boring. Recordings are optional and can be disabled per student. They are encrypted at rest and retained for a defined period, then deleted automatically. Access is limited to the assigned tutor and a named safeguarding role, and access is logged. Storage sits in a named region. Deletion can be requested and completed within a stated window.
A poor answer uses the words “industry standard,” “bank-level encryption” and “fully compliant” without naming a regime, a region or a retention period. Bank-level encryption is a marketing phrase. Every serious service uses the same handful of ciphers.
Services built specifically for school-age tutoring, such as platforms teaching the Cambridge curriculum online, generally document safeguarding and data handling because schools and parents ask. General-purpose video tools repurposed for tutoring usually do not, because their design never assumed a child on one end.
The tell is specificity. Providers who have done the work answer in nouns and numbers. Those who have not answer in adjectives.
The technical bits worth understanding
Encryption in transit is universal and not a differentiator. Every platform running over HTTPS and WebRTC encrypts the connection. A provider highlighting this as a feature is telling you they have nothing better to point at.
Encryption at rest is the meaningful one. Recordings sitting on a server should be encrypted there, with keys managed separately from the data. Ask specifically about at rest rather than accepting a general claim.
Access logging matters more than access control. Every system has an engineer who could technically reach the data. The question is whether doing so leaves a record that someone reviews.
Third-party processors inherit your risk. Most platforms use external services for video infrastructure, transcription, payments and analytics. Each is another organisation holding some portion of the data. A provider should be able to list them.
Automatic deletion beats manual deletion. A retention policy enforced by code runs whether or not anyone remembers. One enforced by process does not.
Practical steps
Ask before the first lesson, not after. Once sessions have accumulated, the recordings exist and your leverage is gone.
Get it in writing. Email is sufficient. A provider comfortable stating their retention period in writing is a provider who has one.
Check the privacy policy actually mentions minors. Many are generic templates that never acknowledge the users are children. That absence is informative.
Prefer providers who publish their approach. A provider who documents safeguarding and data handling has usually been asked before, by schools if not by parents.
Decide what you actually want recorded. Some families want every session captured for revision. Others want none. Both are reasonable and the platform should support either.
The wider point
The tutoring sector grew quickly, and much of it was built by education people rather than security people. That is not a scandal, it is a stage. But it means the baseline is uneven in a way parents cannot see from a pricing page.
Regulation is tightening. The UAE framework continues to develop, and international attention to children’s data has increased sharply. Providers who treat this seriously now will find a compliance routine. Those who do not will be retrofitting under pressure.
For a parent, none of that is the point. The point is narrower: your child is about to be recorded, repeatedly, in their own home. Six questions and ten minutes will tell you whether anyone at the other end has thought carefully about what happens to those files. If the answers come back in adjectives, keep looking.
