These updates are not yet in effect. The documents linked from each page remain the versions currently in force.
Upcoming changes to Tuturuuu's legal documents
We have prepared updates to our Terms of Service, Privacy Policy, Data Processing
Addendum, Service Level terms, Subprocessor list, Acceptable Use Policy and
Community Guidelines. These updates are not yet in effect. The documents linked
from each page remain the versions currently in force.
We will announce the effective date on this page and notify account holders
before any change takes effect.
2026-11-02-mobile
Mobile release date to be pinned
Mobile app: new section in the Privacy Policy. Firebase Analytics and Crashlytics start only after you choose Allow, and the app does not contact Firebase before you sign in. Push notifications use Google Firebase Cloud Messaging and Firebase Installations only after you sign in and turn push on, independently of your analytics choice. Takes effect with the mobile release.
2026-11-02
Processors: Google (Firebase Analytics and Crashlytics; Firebase Cloud Messaging and Firebase Installations) is added to our list of processors for these mobile features, effective 2 December 2026.
Terms of Service
2026-08-15
- Effective
- 2026-08-15
- Published
- 2026-07-27
Not yet in effect
Terms of Service
Plans, taxes, renewals, cancellation, and AI credits
Plans, included seats, quotas and prices are shown at purchase or in an order form. Applicable taxes may be added. Subscriptions renew for the selected period until cancelled; cancellation stops future renewal but ordinarily does not refund elapsed service unless required by law or stated in an order form.
Show the exact wording change
Plans, included seats, quotas and prices are shown at purchase or in an order form. Applicable taxes may be added. Subscriptions renew for the selected period until cancelled; cancellation stops future renewal but ordinarily does not refund elapsed service unless required by law or stated in an order form.
AI credits are usage units, not currency, and may expire or be limited by plan. Reservations, provider usage, streaming and billable failures may consume credits as disclosed. Previews can change or end. Tuturuuu may enforce rate, storage, model, retention and usage quotas.
Purchase terms and Polar
The checkout or signed order form identifies the plan, currency, billing interval, full amount due, seat basis, included allowances and applicable taxes. A monthly equivalent for annual billing is an illustration; the annual total is charged for the annual period. A pitch, roadmap, beta label or proposed price is not an offer or a promise of availability.
Show the exact wording change
The checkout or signed order form identifies the plan, currency, billing interval, full amount due, seat basis, included allowances and applicable taxes. A monthly equivalent for annual billing is an illustration; the annual total is charged for the annual period. A pitch, roadmap, beta label or proposed price is not an offer or a promise of availability.
Where checkout is provided by Polar, Polar acts as merchant of record and authorized reseller for that transaction. Tuturuuu supplies the product and service license. The Polar Buyer Terms govern Polar checkout and reseller services. Use the payment method, invoice, cancellation and refund channels identified on your receipt or billing portal. Do not send full payment-card details to Tuturuuu support.
Seats, renewals, changes and refunds
The purchased plan defines who is a billable member and whether guest access is included; an invitation alone does not authorize an undisclosed charge. Administrators are responsible for reviewing seat quantities, renewal dates and any displayed proration before confirming changes. Cancellation through the billing portal stops future renewal according to the displayed effective date; deleting an app or leaving a workspace is not a cancellation request.
Show the exact wording change
The purchased plan defines who is a billable member and whether guest access is included; an invitation alone does not authorize an undisclosed charge. Administrators are responsible for reviewing seat quantities, renewal dates and any displayed proration before confirming changes. Cancellation through the billing portal stops future renewal according to the displayed effective date; deleting an app or leaving a workspace is not a cancellation request.
A new list price does not itself change an existing subscription. Existing pricing, change notices and effective dates follow the applicable subscription, order form and mandatory law. Material adverse changes require the notice and consent applicable to the transaction. Refund requests may be made through the receipt or billing portal, or to legal@tuturuuu.com for routing. Polar processes refunds for Polar purchases; mandatory withdrawal, refund and other consumer rights remain available. No blanket no-refund rule overrides those rights or Polar's applicable buyer terms.
Usage budgets, limits and data after downgrade
Allowances belong to the account or workspace identified in the purchased plan; paid workspace capacity is not automatically shared across independent workspaces. Usage counters, reset periods, reservation rules, credit expiry and any billable failures must be disclosed for the relevant feature. AI credits are service usage units, not money, deposits or transferable financial assets. Included and purchased credits may have different expiry rules stated before purchase.
Show the exact wording change
Allowances belong to the account or workspace identified in the purchased plan; paid workspace capacity is not automatically shared across independent workspaces. Usage counters, reset periods, reservation rules, credit expiry and any billable failures must be disclosed for the relevant feature. AI credits are service usage units, not money, deposits or transferable financial assets. Included and purchased credits may have different expiry rules stated before purchase.
An upgrade does not bypass security, abuse, per-file or provider safety limits. Additional paid consumption requires the applicable purchase or enabled spending authorization. When a lower allowance applies, Tuturuuu may restrict new consumption while preserving existing data access and export where technically and legally available. A quota reduction alone is not permission to delete customer content. Security incidents, unlawful content and legal obligations may require separate restrictions.
Privacy Policy
Regional rights, children, and requests
Individuals retain applicable privacy rights. Workspace administrators and educational institutions must provide appropriate notices and obtain any required guardian consent before using the Services with children. AI and third-party integrations may impose additional age restrictions. Contact privacy@tuturuuu.com for assistance.
Show the exact wording change
Depending on location and applicable thresholds or exemptions, individuals may request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or appeal.
Rights under Vietnam's Decree 13/2023, the GDPR and UK GDPR, and applicable United States state laws—including California access, correction, deletion, portability, opt-out and non-discrimination rights—apply only to the extent the relevant law governs the processing.
Users should normally contact their workspace administrator first for customer-controlled content.
Tuturuuu will assist controllers under the DPA.
The Services are not directed to children below the minimum lawful age; administrators and guardians must obtain required consent, and AI features may have higher age restrictions.
Individuals retain applicable privacy rights.
Workspace administrators and educational institutions must provide appropriate notices and obtain any required guardian consent before using the Services with children.
AI and third-party integrations may impose additional age restrictions.
Contact privacy@tuturuuu.com for assistance.
Billing, metering and connected services
Billing and entitlement operations use customer or workspace identifiers, member counts, plan and product references, invoice and payment status, usage totals, timestamps and support records. These records support access decisions, reconciliation, fraud prevention and billing disputes. Where Polar handles a transaction as merchant of record, it also processes transaction data for its own payment, tax and compliance responsibilities under its privacy notice.
Show the exact wording change
Billing and entitlement operations use customer or workspace identifiers, member counts, plan and product references, invoice and payment status, usage totals, timestamps and support records. These records support access decisions, reconciliation, fraud prevention and billing disputes. Where Polar handles a transaction as merchant of record, it also processes transaction data for its own payment, tax and compliance responsibilities under its privacy notice.
Workspace administrators may see membership and usage information needed to administer their workspace. Connecting an app does not make all workspace content public. Shared links, recordings, AI context and integrations require appropriate permissions and user notices. Do not put secrets, full payment-card details or unrelated sensitive content into usage metadata.
Current law and requests
Applicable privacy rights depend on the individual, processing activity and governing law. Vietnam's Law on Personal Data Protection No. 91/2025/QH15 took effect on 1 January 2026; implementing rules and other applicable laws must also be considered. Where GDPR or UK GDPR applies, rights and transfer safeguards follow those laws. This policy does not claim universal applicability or certified compliance.
Show the exact wording change
Applicable privacy rights depend on the individual, processing activity and governing law. Vietnam's Law on Personal Data Protection No. 91/2025/QH15 took effect on 1 January 2026; implementing rules and other applicable laws must also be considered. Where GDPR or UK GDPR applies, rights and transfer safeguards follow those laws. This policy does not claim universal applicability or certified compliance.
Contact privacy@tuturuuu.com for a rights request, processing question or applicable complaint route. We may verify identity proportionately. For customer-controlled workspace content, we coordinate with the relevant controller. Retention, deletion, provider configuration and training claims require verification for the specific service; a higher plan does not remove an individual's statutory rights.
Mobile app
Push notifications. If you sign in and turn on push notifications, your device is registered with Google Firebase Cloud Messaging and Firebase Installations so we can deliver notifications. This sends a push token and an installation identifier to Google; we link the push token to your account on our servers so we can send you notifications, and Google delivers the notification content to your device. It happens only after you sign in and turn on push, and it does not depend on your analytics choice. Before you sign in, the app does not contact Firebase. You can turn push off in the app or in your device settings.
Show the exact wording change
Push notifications. If you sign in and turn on push notifications, your device is registered with Google Firebase Cloud Messaging and Firebase Installations so we can deliver notifications. This sends a push token and an installation identifier to Google; we link the push token to your account on our servers so we can send you notifications, and Google delivers the notification content to your device. It happens only after you sign in and turn on push, and it does not depend on your analytics choice. Before you sign in, the app does not contact Firebase. You can turn push off in the app or in your device settings.
Analytics and crash reports. Firebase Analytics and Crashlytics are off until you choose Allow. If you do not allow, no analytics or crash data is sent. If you allow, we receive app and device identifiers (including a Firebase installation identifier), usage events, crash reports and device and operating-system information to understand how the app is used and to fix crashes. Google keeps this data for at most two months at the user level; we have turned off Google's advertising and data-sharing features for it. You can change your choice at any time in Settings > Preferences > Privacy > Share analytics and crash reports; when you turn it off, collection stops and unsent crash reports are deleted. Test builds do not collect.
Data Processing Addendum
Incidents and data-subject assistance
Tuturuuu will notify the customer without undue delay after confirming a personal data breach affecting customer data, consistent with legal and security constraints. Tuturuuu will reasonably assist with data-subject requests, impact assessments and regulatory consultation, taking account of processing nature and available information.
Show the exact wording change
Tuturuuu will notify the customer without undue delay after confirming a personal data breach affecting customer data, consistent with legal and security constraints. Tuturuuu will reasonably assist with data-subject requests, impact assessments and regulatory consultation, taking account of processing nature and available information.
Processing particulars and independent roles
Processing may involve workspace members, guests, customers, contacts, learners and other people whose data the customer submits. It covers hosting, storage, retrieval, access control, transmission, support, deletion and configured AI or integration processing for the service term and applicable return/deletion period. Data categories are described in the Privacy Policy and customer instructions. The customer must not submit data prohibited by its agreement and must identify any special processing requirements before use.
Show the exact wording change
Processing may involve workspace members, guests, customers, contacts, learners and other people whose data the customer submits. It covers hosting, storage, retrieval, access control, transmission, support, deletion and configured AI or integration processing for the service term and applicable return/deletion period. Data categories are described in the Privacy Policy and customer instructions. The customer must not submit data prohibited by its agreement and must identify any special processing requirements before use.
A provider acting as an independent controller for its own billing, legal or payment obligations is not a subprocessor for those activities merely because it appears in the provider registry. Executed agreements must identify the applicable roles, locations, transfer mechanism and security annex. A registry entry alone is not an executed international-transfer agreement.
Incident assistance and exit
Where processor obligations apply, Tuturuuu notifies the customer without undue delay after becoming aware of a personal data breach affecting customer data; notification is not postponed solely to await a completed investigation. Available information may be provided in stages, with reasonable assistance for the customer's reporting and rights-response obligations.
Show the exact wording change
Where processor obligations apply, Tuturuuu notifies the customer without undue delay after becoming aware of a personal data breach affecting customer data; notification is not postponed solely to await a completed investigation. Available information may be provided in stages, with reasonable assistance for the customer's reporting and rights-response obligations.
On termination, the customer may request return or deletion of customer-controlled personal data under the agreement. Backup cycles and legally required retention must be explained, and retained data remains protected and limited to the permitted purpose. Account-level billing records retained under an independent legal obligation are handled under the Privacy Policy. Plan downgrade or credit exhaustion does not override these obligations.
Service Level Agreement
Exclusions, incidents, and maintenance
The executed order defines maintenance windows, exclusions, incident communications and dependency treatment. Exclusions must be applied consistently with that order and mandatory law. Tuturuuu prioritizes restoration and accurate incident assessment.
Show the exact wording change
Downtime excludes previews, free tiers, customer configuration, third-party providers outside Tuturuuu control, internet or device failure, force majeure, abuse, suspension, emergency security work and announced maintenance.
Tuturuuu communicates material incidents through available status and support channels and prioritizes restoration and accurate post-incident review.
The executed order defines maintenance windows, exclusions, incident communications and dependency treatment.
Exclusions must be applied consistently with that order and mandatory law.
Tuturuuu prioritizes restoration and accurate incident assessment.
Credits and claim procedure
The executed order specifies eligibility, credit limits, claim deadlines and the supported remedy. Submit claims through the designated support channel with incident dates, impact and request identifiers. Tuturuuu assesses claims in good faith. Billing adjustments must be supported by the merchant of record; mandatory legal remedies remain available.
Show the exact wording change
When activated, the order form specifies credit tiers and maximum credit.
Credits are the sole contractual SLA remedy, are applied to future invoices, cannot exceed affected recurring fees and are not cash.
Claims must be submitted by an authorized customer contact within 30 days with dates, impact and supporting request identifiers.
Tuturuuu will validate measurements in good faith.
The executed order specifies eligibility, credit limits, claim deadlines and the supported remedy.
Submit claims through the designated support channel with incident dates, impact and request identifiers.
Tuturuuu assesses claims in good faith.
Billing adjustments must be supported by the merchant of record; mandatory legal remedies remain available.
Coverage, dependencies and credits
A plan name, pricing card or pitch does not activate an SLA. An executed order must name the covered production services, measurement window, availability target, support hours, severity definitions, exclusions and claim procedure. Preview products and unapproved roadmap capabilities are outside coverage unless explicitly included.
Show the exact wording change
A plan name, pricing card or pitch does not activate an SLA. An executed order must name the covered production services, measurement window, availability target, support hours, severity definitions, exclusions and claim procedure. Preview products and unapproved roadmap capabilities are outside coverage unless explicitly included.
The order must explain treatment of dependencies and provider outages; the fact that infrastructure is supplied by a third party does not by itself decide whether an outage is excluded. Service credits are distinct from AI usage credits, refunds and mandatory legal remedies. Where a merchant of record issues invoices, any approved service credit must use a supported billing adjustment or another agreed method rather than promising an unsupported invoice operation.
Subprocessor Registry
Provider roles and feature-specific processing
The registry identifies providers that may process data; it is not a statement that every customer uses every provider or that every provider acts as a processor for every activity. Polar may act independently for merchant-of-record transactions. AI, communications and integration providers depend on enabled functionality and routing.
Show the exact wording change
The registry identifies providers that may process data; it is not a statement that every customer uses every provider or that every provider acts as a processor for every activity. Polar may act independently for merchant-of-record transactions. AI, communications and integration providers depend on enabled functionality and routing.
Cloudflare services may support application execution, durable collaboration state, file storage and realtime/media delivery in addition to network security. Confirm the service-specific data flow, enabled region and contractual safeguards before making residency, retention or no-training commitments. Material changes follow applicable contractual notice and objection rights; requests can be sent to privacy@tuturuuu.com.
Firebase Analytics and Crashlytics (Google)
Mobile app usage analytics and crash reporting, only after the user chooses Allow in the app.
Show the exact wording change
Mobile app usage analytics and crash reporting, only after the user chooses Allow in the app.
app and device identifiers (including a Firebase installation identifier); usage events; crash reports and diagnostics; device and operating-system metadata. Retention at the provider: up to 2 months at user level.
Provider-operated regions
2026-12-02
Firebase Cloud Messaging and Firebase Installations (Google)
Delivery of push notifications to the mobile app, only after the user signs in and turns on push notifications.
Show the exact wording change
Delivery of push notifications to the mobile app, only after the user signs in and turns on push notifications.
push notification token; installation identifier; notification payload (the content delivered).
Provider-operated regions
2026-12-02