Privacy Policy — Singapore Education Pathways

This Privacy Policy explains how Singapore Education Pathways (the “Service”, “we”, “us”) collects, uses, discloses, and protects personal data, in accordance with the Singapore Personal Data Protection Act 2012 (“PDPA”).

By using the Service you consent to the practices described here. If you do not agree, please do not use the Service.

1. Data we collect

We collect only the data necessary to operate the Service:

a) Account data (via Clerk)

Email address (required)
Name (optional, if you provide it)
Sign-in provider identifier (e.g. Google account ID, if used)
Sign-in timestamps and IP address (for security and abuse prevention)

b) Payment data (via Stripe)

Billing email and country
Transaction history and plan purchased
We do not see, store, or process your full card details. Card data is collected and processed directly by Stripe under their own security standards.

c) Profile and tracking data (you enter)

Your child’s school, cohort year, and current secondary level
Subject grades, term scores, projections you input into the grade tracker
Course watchlists, school presets, calculator inputs

This data is provided by you and is stored against your account. We treat it as personal and confidential.

d) Usage data

While signed in: page categories visited, feature actions and their timestamps, linked to your account
Signup and sign-in dates, and counts of saved profiles, subjects, scores and watchlist items, visible to the service owner
New usage events contain no search text, grades, child names, URL query strings or form contents

We use these records to understand whether people return and which tools are useful. You can turn optional usage analytics off using the footer control in your browser. We also respect your browser’s Do Not Track setting. Turning analytics off does not disable authentication records, saved work or payment records needed to run the Service.

Free preview before signup

Grades entered in the public preview are calculated in your browser and are not sent to our server or analytics. If you choose “Save to a free profile”, a temporary copy is stored in this tab’s session storage to carry it through signup. The copy is accepted for up to two hours, and can be cleared with “Clear my grades” or “Discard temporary browser copy”. Browser session restoration can retain storage after closing a tab; expired copies are rejected and removed when next opened. Only an explicit import while signed in sends those grades to your account. On shared devices, discard the temporary copy when finished.

Optional visitor analytics

Visitor analytics are off until you choose “Allow visitor analytics” in the footer. If enabled, a first-party cookie groups page and tool actions into a 30-minute browsing session. We keep only page categories, actions, timestamps and a broad referral category such as Google or WhatsApp. Campaign labels come from a fixed list. We do not record full referrer URLs, query strings, names, child grades, search text or form contents in these events.

If you sign in during a measured session, events are associated with your account so the owner can understand registration and tool use. Visitor records are removed after 90 days by our daily maintenance job. This is separate from essential authentication and payment records.

You can withdraw using the footer control. We stop collection and clear the session cookie; your browser remembers the preference. Browser Do Not Track, Global Privacy Control and the app usage opt-out also disable visitor collection. We use our existing Supabase database, with no advertising network or session recordings. Analytics consent does not enrol you in emails.

2. Why we collect it (purposes)

Provide the Service — calculate aggregates, save your child’s data, display personalised results
Process payments — execute one-time purchases through Stripe
Communicate with you — payment receipts, account notifications, optional cut-off update emails
Improve the Service — analyse usage patterns, fix bugs, prioritise features
Security and fraud prevention — detect abuse, prevent unauthorised access, comply with law
Legal compliance — respond to lawful requests, enforce our Terms

3. Legal basis (PDPA)

Under the PDPA, our processing is based on:

Consent — when you create an account, make a purchase, or submit data through the Service.
Legitimate interests — to operate the Service, prevent fraud, and improve product quality, where these do not override your rights.
Legal obligations — to comply with applicable Singapore law and lawful regulatory requests.

4. Third-party processors

We rely on the following providers to operate the Service. Each acts as a data intermediary on our behalf:

Clerk — authentication and account management
Stripe — payment processing (PCI-DSS Level 1 compliant)
Supabase — primary database (hosted in Singapore where supported by the plan)
Vercel — application hosting and content delivery
Resend — delivery of transactional emails and optional onboarding reminders

Each provider has its own privacy practices. We use them under standard data-processing terms and do not authorise them to use your data for their own marketing.

5. International data transfers

Some of our processors store data outside Singapore (for example, in the United States or European Union). Where this occurs, we rely on the providers’ own compliance arrangements (such as Standard Contractual Clauses or equivalent safeguards) to ensure your data receives protection comparable to that under the PDPA.

6. Data retention

Account data — retained for as long as your account is active.
Payment records — retained for at least 7 years for accounting and tax purposes, as required by Singapore law.
Profile and tracking data — retained while your account is active. Deleted within 30 days of account deletion (except payment records).
Usage records — these are account-linked, not anonymous. The usage dashboard shows the most recent 30 days; this display window is not an automatic deletion schedule. You can request deletion through the privacy contact below.

7. Your PDPA rights

Under the PDPA you may:

Access — request a copy of the personal data we hold about you;
Correct — ask us to correct inaccurate or incomplete data;
Withdraw consent — withdraw consent for future processing (note: this may limit your ability to use the Service);
Delete — request deletion of your account and associated data (subject to legal retention obligations above).

To exercise any of these rights, contact us via the feedback page with the subject “PDPA request”. We will respond within 30 days as required by the PDPA. We may request reasonable verification of your identity before acting on the request.

8. Children’s data

The Service is designed to be used by parents/guardians (or adult students) to plan a child’s education. We do not knowingly create accounts for children under 13. Any data about a child stored in the Service is provided by, and remains under the control of, the parent/guardian who created the account.

If you believe a child has independently created an account on the Service, please contact us and we will delete it.

9. Cookies and similar technologies

We use cookies and browser storage to:

Keep you signed in (authentication tokens)
Remember your theme preference (light / dark mode)
Detect suspicious sign-in attempts
Remember your optional usage-analytics preference and avoid counting duplicate page events

We do not use third-party advertising cookies. We do not sell your data to advertisers.

10. Security

We take reasonable security measures including HTTPS encryption in transit, encryption at rest for stored data, and the use of reputable third-party providers (Clerk, Stripe, Supabase, Vercel) with strong security postures. However, no online service is perfectly secure. You are responsible for protecting your account credentials.

If we become aware of a material data breach affecting you, we will notify you and the Personal Data Protection Commission of Singapore as required by law.

11. Marketing communications

We may send you transactional emails (payment receipts, account notices, security alerts) which you cannot opt out of while you have an account. Onboarding reminders require a separate, optional opt-in in email preferences. We store your preference, its timestamp and consent version, and delivery records to honour unsubscribes and prevent duplicate messages. We use recent account activity and whether setup is complete to decide whether a reminder is useful. Reminder emails do not contain your child’s name, grades or school. You can unsubscribe without signing in through the email link, or turn reminders off in your account. This does not affect access to the app. This opt-in does not enrol you in discounts or an ongoing newsletter.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date at the top of the page. For material changes that affect your rights, we will provide notice through the Service or via email where appropriate. Continued use after a change constitutes acceptance of the revised policy.

13. Data protection contact

For any privacy-related question or PDPA request, contact our Data Protection Officer via the feedback page (subject: “PDPA request”).

You may also lodge a complaint with the Personal Data Protection Commission of Singapore at www.pdpc.gov.sg.