PDPA Compliance · v2.1 · Updated 29 May 2026

Your data, protected.

AL1 Tutor is built for Singapore families. Singapore's Personal Data Protection Act (PDPA) sets the bar for how your information must be handled — and we hold ourselves to it. This page summarises how we do that, in plain language.

Our six commitments

No advertising. Anywhere.

There is no advertising on AL1 Tutor. Not to you. Not to your child. We have no ad partners, no ad cookies, no ad tracking pixels.

No AI training on children's content.

Your child's chats, compositions, and uploads are not used to train any external AI model. Our enterprise contracts with Anthropic, Google, and other providers prohibit it.

No selling, no sharing for marketing.

We do not sell, rent, or share your personal data with third parties for their marketing. Service providers (e.g. Stripe, Twilio) receive only what's necessary to do their job.

Minimal data, by design.

We don't collect dates of birth, NRIC, school names, profile photos, or location data. We collect what the AI tutor needs — and nothing more.

Singapore-region storage.

Our application and database are hosted in Singapore. AI processing routes via the providers' nearest enterprise regions, under contractual data-protection commitments.

You're in control.

View everything we hold. Correct what's wrong. Delete what you want gone. Export to take with you. All on request, within 30 days.

What we collect — and why

We collect personal data on two distinct paths: data about you, the parent or guardian, and data about your child's learning. They are treated separately and with different safeguards.

From parents (you)

Email and password (hashed)
Singapore mobile (verified at signup; for trial-fraud prevention)
Stripe payment fingerprint (we never see your card)
Billing history and credit ledger
Referral codes you generate or redeem
IP and device hash (security only)

From children (via you)

A nickname and educational level
Subjects they are studying
Chats with the AI tutor
Composition drafts you submit
Photos of spelling lists or worksheets
Progress and mastery scores

Your rights under the PDPA

Under the PDPA, you have the following rights — for your own data and, as the legal representative of your child, for your child's data. To exercise any of these, email our Data Protection Officer.

Right of access: Request a copy of the personal data we hold about you or your child.
Right of correction: Ask us to correct anything inaccurate. Most fields you can edit yourself in settings.
Right to withdraw consent: Withdraw consent to our processing — usually by closing your account.
Right to deletion: Request that we delete your data within 30 days, subject to legal retention for tax records.
Right to data portability: Request an export of your data in machine-readable format (JSON).
Right to lodge a complaint: Contact the Personal Data Protection Commission at pdpc.gov.sg. We'd appreciate the chance to address concerns first.

Where your data goes

Our application and database live in Singapore. The AI providers we use are based in the United States. Under PDPA Section 26, we ensure all overseas transfers are subject to contractual protections comparable to the PDPA. The full list of our service providers and what they receive is in the Privacy Policy, Section 7.

We minimise what each provider sees. Anthropic receives your child's chat content, for example, but never their name, your name, or your payment details.

Contact our Data Protection Officer

For data requests, complaints, or questions

Data Protection Officer

Email: [email protected]

We respond to verified requests within 30 days. We may need to confirm your identity before processing.