A1 AL1 Tutor

Privacy Policy

Last updated: 21 May 2026 · Version 2.0

This Privacy Policy explains what personal data AL1 Tutor collects, why we collect it, how we use it, with whom we share it, and what rights you have. It is written in plain language for parents. If you want a quick summary, read the box below.

1. Who We Are

For the purpose of Singapore's Personal Data Protection Act 2012 ("PDPA") and equivalent legislation, the data controller for personal data collected via AL1 Tutor is:

Etiglo may transfer the operation of AL1 Tutor — and the data controller role — to a successor entity (such as a Pte Ltd company) at a future date, as described in Section 1 of our Terms of Service.

2. What Personal Data We Collect

From parents / guardians (account holders)

• Account info: name, email address, password (hashed, never stored in plain text).
• Contact info: Singapore mobile number (required for trial fraud prevention and account recovery), verified via SMS one-time password.
• Payment info: credit/debit card details are handled directly by our PCI-DSS-compliant payment processor; we do not store card numbers, CVVs, or expiry dates. We retain a customer reference ID issued by our payment processor and a payment method fingerprint (a non-identifying token used to prevent trial abuse).
• Billing history: subscription tier, renewal dates, invoice records, top-up purchases, credit ledger entries.
• Referral information: codes you generate, codes you redeem, who you referred (and who referred you), discount balances.
• Technical info: IP address, browser user-agent (truncated), device hash, login timestamps. Used for security and fraud prevention.
• Communication: emails and messages you send to support, feedback you submit.

From children (via student profiles created by parents)

• Profile info: name or nickname (chosen by parent), educational level (e.g. "Primary 4"), subjects taken, mother tongue. We do not require date of birth or NRIC.
• Learning content: chat messages with the AI tutor, composition drafts, spelling lists uploaded as photographs, voice recordings (where applicable), worksheet images.
• Progress data: attempts at practice items, mastery scores, time spent, vocabulary saved, mistakes flagged.
• Generated content: mock exam papers generated for your child, model essays produced for feedback, vocabulary lookups requested.

We do not collect:

• your child's date of birth, NRIC, FIN, or any government-issued ID;
• your child's school name, class, or teacher's name;
• biometric data (face, fingerprint, voiceprint) — voice recordings, where applicable, are processed for speech-to-text only and not used as biometric identifiers;
• location data beyond country-level inference from IP address;
• contacts, social media graphs, or browsing history outside AL1 Tutor.

3. Lawful Basis Under the PDPA

Under the PDPA, we process personal data on the following bases:

Consent

You consent to the collection and use of your data — and your child's data — when you register an account and accept these Terms. You can withdraw consent at any time by emailing our DPO. Withdrawal of consent will result in termination of the service for that account.

Contractual necessity

Some processing is necessary to deliver the service you've subscribed to — including billing, providing AI tutoring, and maintaining your child's progress records.

Legal obligation

We may process data to comply with applicable laws, court orders, or regulatory requirements, including tax records under Singapore law.

Legitimate interest

We may process limited technical and security data (e.g. IP address, device hash) to prevent fraud, abuse, and unauthorised access, where such processing is proportionate and does not override your interests.

4. How We Use Your Personal Data

• To deliver the service: provide AI tutoring, track progress, generate practice papers, deliver compositions feedback, manage student profiles.
• To bill you: process subscription charges and top-ups via our payment processor, send invoices and receipts.
• To communicate with you: send transactional emails (receipts, important account notices, invite codes, password resets), respond to support enquiries, and — only with your separate consent — send occasional product updates.
• To improve the service: analyse aggregate, de-identified usage patterns to identify which features work well and where to invest. We do not use children's personally identifiable content for this purpose.
• To prevent abuse: enforce trial limits, detect referral abuse, prevent account compromise, and protect users.
• To comply with the law: respond to lawful requests from authorities, satisfy tax record-keeping obligations.

5. AI Processing

AL1 Tutor uses third-party large language models to power its tutoring. When your child sends a question or submits a composition, the content is sent to one or more of these AI providers for processing, then the response is returned to your child. See Section 7 for the categories of service providers we work with and their data-location regions.

We take the following precautions:

• We never include your child's name, your name, or other identifying information in prompts sent to AI providers, unless strictly necessary for the response and explicitly approved by you.
• We use AI providers' enterprise APIs, under terms that prohibit them from using your content to train their own models. The major AI providers we work with offer this by default for API customers.
• We retain transcripts of AI conversations within AL1 Tutor's database for the purpose of progress tracking and review. These are accessible to you and your child via the in-app history.
• For features that require voice recording (e.g. oral practice with reading verification, where applicable), audio is processed for speech-to-text by the relevant provider and then deleted from their servers in accordance with their data retention policies. We do not retain audio recordings beyond the immediate session unless you opt in.

6. Children's Personal Data

AL1 Tutor primarily serves children from Primary 1 (age ~7) through Junior College (age ~18). Children's data is treated with heightened protection.

• Children do not create their own accounts. A parent or guardian creates the family account and sets up student profiles. The parent is the legal representative for the child's personal data and exercises all PDPA rights on the child's behalf.
• We do not use children's User Content to train any external AI model.
• We do not show advertising to children. There are no ads anywhere in AL1 Tutor.
• We do not profile children for marketing purposes.
• We do not permit children to communicate with other children or with strangers through AL1 Tutor. The platform is one-to-one between your child and the AI.
• If a child reports distress, indicates harm, or asks AL1 to help them with non-academic matters that exceed our safety thresholds, the AI is configured to redirect them to seek help from a trusted adult. We do not use these moments to engage children further.

For more on our child safety approach, see the Child Safety page.

7. Third-Party Service Providers

To run AL1 Tutor, we rely on the following categories of service providers. Each provider is a data processor acting on our instructions, under a contract or terms of service that includes appropriate confidentiality and data protection commitments. Specific providers within each category may change from time to time, but the categories, purposes, and data-location regions below remain the framework we work within.

Category	Purpose	Region / data location
Cloud hosting	Application hosting (web servers)	Singapore
Managed database & authentication	Database (Postgres), authentication, file storage	Singapore
AI model providers	Large language models for tutoring, composition marking, and audit checks; text embeddings for semantic search of MOE content	United States
Text-to-speech provider	Audio generation for oral practice and Mother Tongue subjects	United States / Asia-Pacific
Payment processor	Subscription billing and top-up purchases; card data routed via PCI-DSS-compliant infrastructure	Singapore entity; PCI-DSS-compliant infrastructure
SMS provider	One-time passwords for mobile verification	United States; delivered via local Singapore telco
Transactional email provider	Account notifications, receipts, and parent communications	United States

We may add, remove, or substitute providers from time to time. Material changes (such as a new AI provider receiving children's content) will be communicated by email with at least 30 days' notice, in line with our updates policy.

8. International Transfers of Personal Data

As you can see from the table above, some of our service providers process personal data outside Singapore — primarily in the United States. Under Section 26 of the PDPA, we are required to take reasonable steps to ensure that data transferred overseas receives a level of protection comparable to the PDPA.

We do this through:

• Standard contractual commitments: all our overseas providers are signed to data processing terms that include confidentiality, security, breach notification, and limits on further sub-processing.
• Minimisation: we send only the data strictly necessary for each provider's role. For example, our AI providers receive the chat content but not your child's name, your email, or your payment details.
• Encryption in transit: all data transferred to providers is encrypted via TLS.
• Vendor selection: we prefer providers with established privacy programmes that publish PDPA-compatible data processing addenda.

If you do not consent to international transfers of your or your child's personal data, we are unable to provide the service.

9. How Long We Keep Your Data

Data type	Retention period
Account info (parents)	Until you request deletion, plus a 30-day grace period for accidental cancellation reversal.
Student profile data (children)	For the duration of the family account, or until you delete the profile. Up to 30 days after deletion for backup purges.
Chat transcripts, compositions, spelling lists	Visible to you in-app indefinitely while your account is active. Deleted within 30 days when an account is closed.
Voice recordings	Not retained beyond the immediate session unless you opt in.
Billing records	5 years from the end of the financial year, in accordance with the Singapore Income Tax Act.
Trial-redemption identity fingerprints	Indefinitely, for the lifetime enforcement of the one-trial-per-identity rule. Stored as one-way hashes where possible.
Security logs (IP, device hash)	12 months, then aggregated and de-identified.

10. Your Rights

Under the PDPA, you have the following rights with respect to your personal data and your child's data:

Right of access

You may request a copy of the personal data we hold about you or your child. We will respond within 30 days at no charge for reasonable requests.

Right of correction

You may request that we correct inaccurate or incomplete data. You may update most account details yourself via your account settings.

Right to withdraw consent

You may withdraw consent to our collection and use of your data at any time. This typically means closing your account, since we cannot deliver the service without processing the data.

Right to deletion

You may request that we delete your data. We will action this within 30 days, subject to retention obligations in the table above (e.g. billing records retained for tax purposes will be retained for the statutory period).

Right to data portability

You may request an export of your data in a structured, machine-readable format (typically JSON).

Right to lodge a complaint

If you believe we have breached the PDPA, you may lodge a complaint with the Personal Data Protection Commission of Singapore (PDPC) at www.pdpc.gov.sg. We would, however, appreciate the opportunity to address your concerns directly first.

To exercise any of these rights, email our DPO at [email protected]. We may ask you to verify your identity before processing the request.

11. Cookies & Similar Technologies

AL1 Tutor uses cookies and similar technologies for the following purposes only:

• Strictly necessary cookies: to keep you logged in, maintain session state, and protect against cross-site request forgery. These cannot be disabled.
• Preference cookies: to remember your settings (e.g. dark mode, language preference, sidebar state).
• Security cookies: to detect suspicious activity and protect your account.

We do not use advertising cookies, tracking pixels for third-party advertising networks, or fingerprinting technologies for profiling. We do not currently use analytics services that set persistent identifiers.

12. Security Measures

We take the following measures to protect your data:

• All traffic between your device and AL1 Tutor is encrypted via TLS 1.2 or higher.
• Passwords are hashed using industry-standard algorithms (bcrypt or argon2). We never store plain-text passwords.
• Database access requires strong authentication and is restricted to a small number of operational staff.
• Payment details are never stored on our servers; they are processed exclusively by our PCI-DSS-certified payment processor.
• Backups are encrypted and retained in the same Singapore region as the production database.
• We follow least-privilege principles for service-to-service authentication.

No system is perfectly secure. You can help by using a strong, unique password and keeping your account credentials confidential.

13. Data Breach Notification

If we become aware of a data breach that is likely to result in significant harm to you, or that affects 500 or more individuals, we will:

• notify the Personal Data Protection Commission within 72 hours of becoming aware of the breach, as required by the PDPA;
• notify affected individuals as soon as practicable, by the email address registered on your account, with information on what happened, what data was involved, and what steps we are taking;
• provide guidance on steps you can take to protect yourself.

14. Updates to This Policy

We may update this Privacy Policy from time to time. Material changes (such as a new third-party processor receiving children's data, or a change to retention periods) will be notified by email at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when the current version became effective.

15. Contact & DPO

For any privacy-related question, request, or concern, please contact our Data Protection Officer: