Privacy policy

1. Who we are

AL1 Top Online Tuition runs this website, al1toponlinetuition.yumeevent.com: Maths papers, marking and reports for primary school children in Singapore. AL1 Top Online Tuition is run by Yume Ventures Pte Ltd (UEN 202605625Z). In this policy, "we" and "us" mean AL1 Top Online Tuition.

Our Data Protection Officer looks after the personal data we hold and answers questions about it, at [email protected].

2. What we collect, and why

Accounts

When a parent or guardian creates an account for a child, we keep:

• the email address used to sign in, which can be the parent's or the child's
• the child's name
• the child's level and school, if you give them
• that consent was given, when, and to which wording
• whether you asked for emails about new papers, packs and classes
• when the account was created and last signed in

We use these to sign the account in, to put the child's name on their papers and reports, and, only if you said yes, to email you about new papers, packs and classes. We don't ask for a phone number, a password, photos or a home address.

Signing in

Each sign-in uses a 6-digit code sent to the account's email. We store the code only in a scrambled form that cannot be turned back into the code, with the number of wrong tries made with it. To stop people guessing codes, we also keep a scrambled form of the network address each request came from. Each signed-in device is shown on the account page with a short label, such as "iPhone, Safari".

Papers and answers

When a child sits a paper in their account, we keep their answers, their marks and the mistakes our marking finds, when each paper was opened and handed in, and how long it was open on screen. A paper can be sat again, and every attempt is kept, so that progress can be seen. We use these to mark the paper, to explain each mistake, to write the report, which is shown on screen and emailed to the account's address, and to show the tutor how the paper went.

The shop: carts, orders and brothers and sisters

Until payments open, the shop is a preview and nothing can be bought. What you put in the cart, and any promo code you enter, is kept with the account until you change it.

When you make an order, we keep it with the account: its reference, the products it is for, their prices, any offer or code, the total, and when it was made, paid and, if it was, refunded. An order names only products, never the child. We use it to open what was bought, to email the receipt, to answer questions about it and to keep our accounts.

To link brothers' and sisters' accounts, the account page sends a 6-digit code to the other account's email, and typing it in links the two. We keep which accounts are linked and, for each code, the email it went to, the code in scrambled form and when it was sent. Linked accounts show each child's name on the other's account page, and nothing else. Either account can unlink itself at any time, and deleting an account erases its cart, its links and its codes.

Paying

Payments are made by PayNow through HitPay, our payment provider. For each order, HitPay receives only the order's reference and the amount: never the account's email, the child's name or anything else about the account. You pay from your own bank's app, so your bank and HitPay handle the payment itself, under their own terms. We never see or keep your bank details.

From HitPay we keep its references for the payment, the amount and currency it reports, and when it came. We use them to match the payment to its order, and to handle refunds.

Live classes and consultations

These open after papers and plans. When you book one, we keep the booking with the account, and email the account's address the confirmation and the link to join.

If a class is recorded, only the tutor's screen and voice are recorded. The recording is shown only to the families who booked that class, on their account pages, and is deleted at the end of that term. Booking a class asks a parent or guardian to tick that they agree to the recording.

Free topic papers sat without an account

To have a free topic paper's full diagnosis emailed, a parent gives their email address and mobile number, and the child's name and school. We use these only to send the report and to contact you about it, as the form says. A copy of each request also comes to our inbox, so that we can follow up.

To limit how many papers can be started from one place in a day, we keep a scrambled form of the network address that started each paper.

The forum

Posts are anonymous. A writer is shown only as "Parent" or "Student" with a number, and the tutor reads every post before it appears. Please don't put personal details in a post.

To limit spam and stop abuse, we keep a scrambled form of the network address and of the browser that sent each post. Each post also has an edit key, kept in scrambled form, so that only its writer can change it.

When you contact us

If you email us or message us on WhatsApp, we keep what you send so that we can reply.

Visiting the site

Our host, Cloudflare, handles the network address of every visit to deliver the pages and to protect the site from attacks. We don't run analytics, advertising trackers or social media pixels.

3. Children

Accounts are for children, but a parent or legal guardian creates each one and gives the consent for it.

We use a child's personal data only to run their papers, marking and reports. We don't show advertising, we don't sell or rent personal data, and we don't build profiles of children for anyone else.

4. Who else handles it

We use a small number of service providers. They handle personal data only on our instructions, to provide their service to us:

• Cloudflare hosts the site and its database, and runs the bot check when you sign in or send a form.
• Resend sends our emails: sign-in codes, reports, receipts and account emails.
• HitPay takes PayNow payments for us. It receives only each order's reference and amount.
• The video tool that live classes and consultations run on, once they open. We will name it here before they do.
• Google Fonts supplies the site's typeface, so your browser fetches it from Google.
• Our email provider holds the emails you send us, and the copies of report requests.
• WhatsApp carries any message you send us there, under WhatsApp's own privacy policy.

Some of these providers store or process data outside Singapore. We use only providers that are bound to protect it to a standard comparable to the PDPA.

We don't sell, rent or trade personal data, and we don't share it for advertising. We disclose it to anyone else only where the law requires or allows it, for example to comply with a court order.

5. Cookies and storage on your device

• Signing in sets one cookie, which keeps the account signed in on that device for 30 days. We set no advertising or tracking cookies.
• The free paper keeps a link to each paper you start in your browser's storage, so that you can come back to it.
• The forum keeps your posts from the last 30 days, with their edit keys, in your browser's storage, and a random number that tells your browser's posts apart from others'.
• The paper page remembers that its short guide has been shown.
• The bot check, Cloudflare Turnstile, looks at your browser to tell people from bots when you sign in or send a form.

You can clear cookies and site storage in your browser's settings at any time. Doing so signs you out and forgets those links and keys.

6. How long we keep it

• Accounts, and every paper sat in them: until the account is deleted.
• Deleted accounts: the email, the child's name, level and school, and every paper the child sat, with its answers, are erased at once. We keep only a record that consent was given and later withdrawn, and when, without those details, and the account's paid orders, as below.
• Paid orders and their payment records: 5 years from the payment, the period Singapore's tax rules (IRAS) ask businesses to keep records for. They name only products and amounts, never the child, and if the account is deleted they stay without its details.
• Orders that were never paid: they name only products and amounts. They stay with the account, and if it is deleted, they stay without its details.
• Class recordings: until the end of the term the class was in.
• Sign-in codes, wrong tries and their scrambled network addresses: one day.
• Free topic papers sat without an account: 12 months after the report is sent, we erase the parent's email and mobile number, the child's name and school, and the answers, including the copy in our inbox. A paper started without asking for a report is erased 12 months after it was started.
• Forum posts: until they are removed. Ask us and we will remove a post you wrote.
• Messages you send us: as long as we need them to reply and follow up.

If the law requires us to keep a record for longer, we keep it for as long as the law says, and no longer.

7. Your choices and rights

• See and correct: the account page shows the account's details, and you can change them there. For a copy of anything else we hold about you or your child, or to correct it, email us.
• Withdraw consent and delete: choose "Delete this account" on the account page. It takes effect at once. You can also email us to withdraw consent for anything else, such as being contacted about a free paper report. Without consent, we can't run papers or reports for that child.
• Emails about new papers, packs and classes: we send them only if you ticked the box for them. Untick it on the account page at any time.
• Free topic papers sat without an account: reply STOP to the report email and we won't contact you again.

We reply to requests as soon as we can, and within 30 days. If you are unhappy with how we have handled your data, please tell us so that we can put it right. You can also complain to the Personal Data Protection Commission at pdpc.gov.sg.

8. How we keep it safe

• Every page and every request is encrypted (HTTPS).
• Sign-in codes are stored only in scrambled form, work once, and expire after 10 minutes, and wrong guesses are limited.
• An account is signed in on one device at a time, and every request is checked, so signing out or deleting the account takes effect at once.
• Only the tutor can open the tutor console, where the details are shown.

No system is perfectly secure, but these steps keep the risk low.

9. If there is a data breach

If personal data is lost, stolen or seen by someone who shouldn't see it, we act at once to stop it and to limit the harm.

If the breach is likely to cause significant harm, or affects 500 or more people, we notify the Personal Data Protection Commission within 3 calendar days of assessing it, as the PDPA requires. Where it is likely to cause you or your child significant harm, we also tell you as soon as we can: what happened, what data was involved, and what you can do.

10. Changes to this policy

We update this page before we change what we collect or who handles it, and the date at the top shows the latest version. If a change affects what you agreed to, we email account holders before it applies, and ask for consent again where it is needed.

11. Contact

Data Protection Officer, AL1 Top Online Tuition
[email protected]

We reply within 2 working days.