Privacy Policy

1. Information We Collect

Account information: parent's email address, password (hashed), preferred language.

Child information: child nickname (no full name), grade level, target PSLE year, subjects of interest, optional learning goal.

Practice data: questions attempted, answers submitted, time spent, accuracy, weak topics inferred.

Communications: messages sent through Contact Advisor, customer-service emails, WhatsApp messages voluntarily sent to us.

Technical data: browser type, IP address (truncated), pages viewed, cookies necessary for session login. We do not use third-party advertising trackers.

2. How We Use Information

To deliver the practice service: select recommended questions, mark answers, generate basic and personalised reports.

To provide our advisor service: review practice history with parent consent, prepare personalised analyses, respond to enquiries.

To improve the platform: aggregate, anonymised analytics about question difficulty and learning patterns. We will never publish identifying information.

To operate the business: customer support, security monitoring, fraud prevention.

3. Information Sharing

We do not sell personal data. We share information only with:

(a) Sub-processors that operate the Service on our behalf — Supabase (authentication & database), Vercel (hosting), Resend (transactional email), PostHog EU (product analytics). All are contracted to appropriate data-processing terms.

(b) Authorised AcePSLE advisors providing your paid analysis service.

(c) Singapore authorities when required by law, court order, or regulatory request.

4. Data Storage & Security

Personal data is stored on infrastructure located primarily in Singapore (Supabase Singapore region, Fly.io Singapore region). Encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is restricted to authorised personnel and protected by 2FA where available.

We retain practice data for as long as your account is active. Upon account deletion (see Section 7) we retain anonymised aggregate metrics but delete personal identifiers within 30 days.

5. Children's Data

AcePSLE is intended for use by parents on behalf of their children. Children under 13 must not register their own account. By creating an account, the parent represents that they have authority to provide consent for the collection and processing of the child's information described in Section 1 (which excludes the child's full name, school, address, and contact details).

Parents may withdraw consent at any time by emailing privacy@acepsle.sg. Withdrawal will result in account closure within 7 days.

6. Your Rights (PDPA)

You may at any time:

(a) Access — request a copy of personal data we hold about you;

(b) Correct — ask us to amend inaccurate personal data;

(c) Withdraw consent — stop further processing;

(d) Delete account — request full deletion (see Section 4).

Contact privacy@acepsle.sg or our Data Protection Officer at dpo@acepsle.sg. We will respond within 30 calendar days.

7. Account Deletion

Email privacy@acepsle.sg from your registered email with subject "Delete my account". Within 30 days we will:

(a) Permanently delete your account, child profile, practice records, and analysis requests;

(b) Retain only what is required by Singapore law (e.g., financial transaction records, if any).

8. Cookies & Analytics

We use only first-party, strictly-necessary cookies for session authentication and language preference. We do not set third-party advertising cookies. We use PostHog (EU region) with anonymised event tracking; PostHog does not receive your email address or child information.

9. Changes to This Policy

We may update this Policy. Material changes will be notified via email at least 30 days in advance. Continued use of the Service after the effective date constitutes acceptance.

10. Contact

TAVATAR Technology Pte Ltd

(Singapore registered address — to be added)

Privacy queries: privacy@acepsle.sg

Data Protection Officer: dpo@acepsle.sg