Privacy Policy

PenPal Education Pte. Ltd. ("PenPal", "we", "our", "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the PenPal platform, in accordance with Singapore's Personal Data Protection Act 2012 (PDPA).

By using PenPal, you consent to the data practices described in this Policy. If you are registering on behalf of a child, you consent on their behalf as their parent or legal guardian.

1. Data Controller

PenPal Education Pte. Ltd. is the data controller responsible for your personal data. You can contact our data protection officer at hello@penpal.sg.

2. Information We Collect

Parent account information

• Name and email address (provided at registration)
• Billing information (processed by Stripe — we do not store card numbers)
• Communication preferences

Student information

• Student's first name and school year (Primary level)
• Compositions submitted, including planning pad notes and essay text
• Challenge responses and scores
• Progress data including streaks, levels, and submission history

Usage information

• Pages visited, features used, and time spent on the platform
• Device type, browser, and IP address
• Error logs and performance data

3. How We Use Your Data

We use your data to:

• Provide, operate, and improve the PenPal platform
• Process payments and manage subscriptions
• Generate AI marking feedback on submitted compositions
• Track student progress and generate parent reports
• Send service-related emails (account confirmation, subscription receipts, reminders)
• Respond to support requests
• Verify eligibility for the 3-Month Guarantee
• Improve the accuracy of our AI marking system using anonymised and aggregated data

We will not use your data for purposes beyond those listed above without your explicit consent.

4. Children's Data

PenPal is used by children aged 9 to 12. We collect only the minimum data necessary from students to deliver the Service. We do not allow students to create accounts independently — all accounts are created and managed by a parent or guardian.

We do not display advertising to children, sell children's data, or use children's compositions for any purpose other than delivering feedback and tracking progress within their account.

AI-generated feedback is produced automatically and is not reviewed by human staff unless a parent or guardian specifically contacts us with a support request.

5. How We Share Your Data

We do not sell your personal data. We share data only with:

• Stripe — for payment processing. Stripe's privacy policy applies to data shared with them.
• Supabase — for secure database hosting. Data is stored on servers within secure cloud infrastructure.
• Google (Gemini API) — composition text is sent to Google's Gemini API for AI marking. Prompts are not used to train Google's models under our API agreement.
• Vercel — for hosting and delivery of the platform.

We may disclose your data if required to do so by law or in response to a valid request from a Singapore government authority.

6. Data Retention

• Active account data is retained for as long as your subscription is active.
• If you cancel your account, we retain your data for 90 days before deletion to allow for account recovery or Guarantee claims.
• After 90 days, all personal data and compositions are permanently deleted.
• Anonymised, aggregated data (e.g., average scores by grade level) may be retained indefinitely for product improvement.

7. Data Security

We implement industry-standard security measures including encrypted data transmission (TLS), secure authentication via Supabase, and access controls limiting who within our team can access user data. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

8. Your Rights Under PDPA

Under Singapore's Personal Data Protection Act, you have the right to:

• Access — request a copy of the personal data we hold about you or your child.
• Correction — request that we correct any inaccurate or incomplete data.
• Withdrawal of consent — withdraw your consent to our collection or use of your data. Note that withdrawal may affect your ability to use the Service.
• Deletion — request deletion of your account and associated data.

To exercise any of these rights, email us at hello@penpal.sg. We will respond within 10 business days.

9. Cookies

We use essential cookies to maintain your login session and remember your preferences. We do not use advertising cookies or third-party tracking cookies. You can disable cookies in your browser settings, but this may affect the functionality of the platform.

10. Links to Third-Party Sites

Our platform may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email. Your continued use of PenPal after changes take effect constitutes acceptance of the updated Policy.

12. Contact Us

For any questions or concerns about this Privacy Policy or how we handle your data, please contact us at hello@penpal.sg.