Your data, handled transparently.

1. Introduction and scope

This Privacy Policy explains how Tuitionable Pte. Ltd. (UEN 202609593W) ("we", "us", "our") collects, uses, discloses and protects personal data on sg.tuitionable.com (the "Platform"), a direct-booking marketplace connecting students and parents in Singapore with independent tutors. It is written to meet our obligations under Singapore's Personal Data Protection Act 2012 (PDPA) and the advisory guidelines issued by the Personal Data Protection Commission (PDPC).

This policy applies to students, parents or guardians booking on a student's behalf, and tutors using the Platform. It covers sg.tuitionable.com only — it does not extend to third-party sites the Platform links to, such as our payment processor's own site.

2. Personal data we collect

We do not see or store your full card number — Airwallex, a licensed and PCI DSS-compliant payment institution, collects and processes that directly.

3. How we use your personal data

We use personal data to:

• Create and manage your account, and match students with suitable tutors
• Verify tutor identity via SMS verification, to protect trust and safety on the Platform
• Process bookings, payments, payouts, wallet credits and referral rewards
• Run the booking calendar, assignments, quizzes and video sessions
• Send service communications: booking confirmations, session reminders, and account or security notices
• With your consent, send product updates and marketing emails, which you can unsubscribe from at any time
• Measure and improve the Platform, including through analytics and advertising-performance tools
• Detect and prevent fraud, referral-programme abuse, and other misuse
• Meet our legal and regulatory obligations

We rely on your consent for these purposes, or, where the PDPA permits, on deemed consent or the legitimate-interests and business-improvement exceptions (for example, aggregated analytics that do not single you out for a decision). You can withdraw consent at any time — see "Your rights" below.

4. Who we share your data with

Full contact details between a student/parent and a tutor are only released once a booking is paid for — our "hard contact gate", designed to protect both sides. We do not sell, trade or rent your personal data to third parties for their own marketing purposes.

5. Cookies and marketing

We use cookies and similar technologies, grouped into four categories that you choose from our cookie preferences panel:

• Essential — always on. These keep you logged in, protect forms from cross-site request forgery, and remember your cookie choice itself. The Platform cannot function without them.
• Functional & Preferences — remembers choices such as your light/dark theme.
• Analytics & Performance — helps us understand how the Platform is used, only when this category is enabled.
• Marketing & Offers — used for advertising and promotional purposes, only when this category is enabled.

You can accept all, reject everything but essential, or pick exactly which categories to allow, at any time, from cookie preferences. See our cookie policy for what each category sets.

We only send you marketing emails or messages with your consent, and you can opt out with one click. In line with the PDPA's Do Not Call provisions, we do not send marketing calls, texts or faxes to your Singapore phone number without your consent; transactional messages about your bookings or account, including SMS verification codes, are not marketing messages and fall outside the Do Not Call Registry.

6. How long we keep your data

We keep personal data only as long as it serves the purpose it was collected for. In practice, that means: for as long as your account is active, plus a further period afterwards to meet legal, accounting or dispute-resolution needs (for example, financial and transaction records are typically kept for at least five years to satisfy IRAS record-keeping requirements). Once neither applies, we securely delete or anonymise the data.

7. Your rights

Under the PDPA, you can:

• Access the personal data we hold about you and how it has been used or disclosed
• Correct errors or outdated information in your profile
• Withdraw consent for any use of your data that relies on consent (this stops that use going forward, but doesn't undo what was already done lawfully)
• Delete your account and associated data, subject to what we must legally retain
• Opt out of marketing emails or messages at any time, with one click

Most of this you can do directly from your profile settings. For anything else, contact our Data Protection Officer (Section 8). We aim to respond as soon as reasonably possible, and in any event within 30 days. If you're unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

Note: the PDPA's data-portability obligation has been legislated but is not yet in force, pending the PDPC's implementing regulations — this policy will be updated once it takes effect.

8. Data Protection Officer

Our Data Protection Officer can be reached at hello@tuitionable.com. You can contact our DPO about any data-protection matter, including requests to access, correct or delete your personal data.

9. Overseas transfer of your data

Some of our service providers — including our web hosting provider and vendors such as Airwallex, Google, TikTok and Brevo — may store or process personal data outside Singapore. Where this happens, we take steps required under Section 26 of the PDPA to ensure the data receives a standard of protection comparable to the PDPA, for example through contractual clauses, the vendor's own binding data-protection commitments (many of these vendors are independently certified under frameworks such as the APEC Cross-Border Privacy Rules system or the GDPR), or binding corporate rules where applicable.

10. Data security

We protect personal data with technical and administrative safeguards, including: encrypted connections (TLS/SSL) across the Platform, hashed passwords, signed sessions, and payment data that is handled directly by Airwallex, our payment processor, and never touches our own servers.

If we become aware of a data breach, we assess it within 30 days. Where the breach is likely to cause you significant harm, or affects 500 or more individuals, we will notify the PDPC within 3 calendar days of completing that assessment, and notify affected individuals as soon as practicable where significant harm is likely.

11. Children's privacy

Many students on the Platform are under 18, so this section follows the PDPC's Advisory Guidelines on Children's Personal Data, which define a "child" as anyone aged 18 or under.

• For a student under 13, a parent or legal guardian must create and manage the account, book sessions, and give consent on the child's behalf.
• A student aged 13 to 17 may create their own account and give their own consent, provided they understand what they're consenting to; we've written this policy in plain language with that in mind.
• A parent or guardian may access, correct, or request deletion of their child's data at any time by contacting our DPO (Section 8).

12. Changes to this policy

We'll notify you by email at least 30 days before any material change to this policy takes effect. Minor clarifications may be posted without advance notice; the "last updated" date at the top of this page always reflects the current version.

13. Contact us

Privacy questions, requests, or complaints can go to our Data Protection Officer at hello@tuitionable.com, or through our contact form. We aim to reply within two business days.

Tuitionable Pte. Ltd. (UEN 202609593W)
60 Paya Lebar Rd, #06-28 Paya Lebar Square, Singapore 409051