PRIVACY POLICY
Last updated 31 August 2026
This Privacy Notice for Somewhat Tiger Parents Pte. Ltd. (doing business as Toshi) ('we', 'us', or 'our') describes how and why we might access, collect, store, use, and/or share ('process') your personal information when you use our services ('Services'), including when you:
Capitalised terms used but not defined in this Privacy Notice (such as Organiser, Attendee, Event, Ticket, Merchant Account, Routine, and Content Partner) have the meanings given to them in our Terms of Use at heytoshi.com/terms.
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you have questions or concerns, please contact us at [email protected].
SUMMARY OF KEY POINTS
This summary provides key points from our Privacy Notice. You can find out more detail about any of these topics in the relevant section below.
TABLE OF CONTENTS
WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
Personal information you disclose to us
In short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, participate in activities on the Services (including creating or registering for an Event), or otherwise contact us. The personal information we collect may include:
Event registration information
When you register for or purchase a Ticket to an Event as an Attendee, we always disclose your username, mobile phone number, and email address to the Event's Organiser, as this information is associated with your Account and is necessary for the Organiser to administer the Event and communicate with you. An Organiser may configure additional fields in its registration form to collect further information reasonably necessary for the Event, which may include, for example, the name or age of a child attending, dietary requirements or allergies, or emergency contact details. We collect this additional information on the Organiser's behalf and disclose it to the Organiser as part of enabling your registration; we do not otherwise use it. Please see 'WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?' below for more on the Organiser's role.
Information you provide to organise an event
If you use the Events Portal to create and list an Event, we collect the information in your Event listing (such as its title, description, images, date, time, location, capacity, and pricing) and information about your brand or organisation if you set up a brand page. If your Event offers a Paid Ticket, you will need to create a Merchant Account with our payment processor, Stripe. Stripe, and not us, collects the verification information it requires to open a Merchant Account, which may include your name, date of birth, government identification number, business registration details, and bank account information, in order to comply with its own know-your-customer and anti-money-laundering obligations. We do not collect, store, or have access to this verification information; it is held by Stripe in accordance with Stripe's own privacy notice (https://stripe.com/privacy). We only receive limited transaction information from Stripe that is necessary to calculate and collect our Platform Fee, provide you with support, and detect fraud.
Sensitive information
We do not ourselves request or use sensitive personal information (such as information about racial or ethnic origin, religious beliefs, sexual orientation, or health) for our own purposes. However, depending on the custom registration fields an Organiser chooses to set up for an Event, some limited information of this nature may be collected in connection with a registration (for example, a dietary requirement that discloses a religious practice, or an allergy that discloses health information). Where this occurs, that information is collected for disclosure to the Organiser as described above, and we encourage Organisers not to request more such information than is reasonably necessary for the Event.
Payment data
We collect data necessary to process a payment if you choose to make a purchase, such as your payment instrument number and associated security code. Payment data relating to a subscription purchased through our App is handled and stored by Apple or Google; you may find their privacy notices at https://www.apple.com/sg/legal/privacy/en-ww/ and https://policies.google.com/privacy?hl=en. Payment data relating to a Ticket, and any Merchant Account verification data, is handled and stored by Stripe as described above.
Application data
If you use our App, we may also collect the following information if you choose to provide us with access or permission:
This information is primarily needed to maintain the security and operation of our App, for troubleshooting, and for our internal analytics and reporting purposes. All personal information you provide to us must be true, complete, and accurate, and you must notify us of any changes.
Routine information
When you set up a Routine for yourself or your child (such as our meal-planning, spelling, 听写, or study and revision Routines), we collect the information needed to run it. This may include your child's name, age, or grade level, and Routine-specific inputs you provide, such as a spelling word list, a meal preference, or a study topic.
Where the Routine is an Internal Routine, we and our AI Service Providers (see 'DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?' below) use this information to generate the Routine's content for you, such as a personalised worksheet or audio recording. Where the Routine is an External Routine, the Content Partner supplies content to us for publication within the Routine, but we do not disclose your or your child's name, profile, or contact details to the Content Partner. We may share limited, aggregated, or anonymised usage or completion data relating to an External Routine (for example, how many users completed a lesson) with the relevant Content Partner, for purposes such as calculating royalties owed to them or reviewing the quality of their content, under our separate agreement with that Content Partner.
Information automatically collected
In short: Some information, such as your IP address and browser and device characteristics, is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services. The information we collect includes:
In short: We process your information to provide, improve, and administer our Services, facilitate Event registrations and payments, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes only with your prior explicit consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including to:
In short: We only process your personal information when we believe it is necessary and we have a valid legal basis to do so under applicable law, such as with your consent, to comply with laws, to fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.
If you are located in the EU or UK, this section applies to you.
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on to process your personal information. We may rely on the following:
If you are located in Canada, this section applies to you.
We may process your information if you have given specific permission (express consent), or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time. In certain exceptional cases we may be permitted by law to process your information without consent, including for fraud detection and prevention, business transactions, or if the information is publicly available and specified by regulation.
In short: We may share information in the specific situations and with the specific third parties described in this section.
Event Organisers
As described in Section 1, when you register for or purchase a Ticket to an Event, we share your username, phone number, email address, and any additional information requested by the Organiser's registration form, with that Organiser. The Organiser receives and uses this information as an independent controller, and not as our processor. The Organiser's own privacy practices, and its obligations under applicable data protection law (including Singapore's Personal Data Protection Act 2012), govern its further use of your information; we are not responsible for the Organiser's handling of it, and we encourage you to review an Event's listing or ask the Organiser about its privacy practices before registering.
Stripe
If you purchase a Paid Ticket, your payment information is shared with and processed by Stripe. If you are an Organiser accepting Paid Tickets, your Merchant Account verification information is collected and held directly by Stripe, and we only receive limited transaction information from Stripe as described in Section 1.
Content Partners
As described in Section 1, if you or your child use an External Routine, we do not share your or your child's name, profile, or contact details with the relevant Content Partner. We may share limited, aggregated, or anonymised usage or completion data about an External Routine with its Content Partner, for royalty calculation or content quality purposes, under our agreement with that Content Partner. A Content Partner does not otherwise have access to your Account or personal information.
Public and private event visibility
If an Organiser publishes an Event as a Public Event, the Event listing (including the Organiser's brand page, name, and any public reviews or ratings) may be viewed by any visitor to the Events Portal, including people who are not registered users. A Private Event is only accessible to a person who has the direct link; an Organiser is responsible for controlling who that link is shared with. If you choose to post a public comment, review, or other Contribution, that Contribution may be viewed by other users and the public.
Other sharing situations
Mobile numbers and SMS opt-in data
We do not share your mobile phone number with third parties or affiliates for marketing or promotional purposes. Your text messaging opt-in information and consent are kept confidential and not shared with any third party. We deliver SMS messages through AWS Notify, which does not share end-user phone numbers with third parties for marketing purposes.
In short: We may use cookies and other tracking technologies to collect and store your information.
We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some tracking technologies help us maintain security, prevent crashes, fix bugs, save your preferences, and support basic site functions. We also permit third parties and service providers to use tracking technologies for analytics and advertising. To the extent these are deemed a 'sale' or 'sharing' under applicable US state laws, you can opt out as described in Section 13 below. You can also refuse certain cookies through your browser settings, although this may affect your ability to use parts of the Services.
Google Analytics
We may share your information with Google Analytics to track and analyse use of the Services. To opt out, visit https://tools.google.com/dlpage/gaoptout. For more on Google's privacy practices, see https://policies.google.com/privacy.
In short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.
As part of the Calendar App, we offer features powered by artificial intelligence, machine learning, or similar technologies (collectively, 'AI Products'). For example, we use AI Products to interpret screenshots, photos, documents, and messages that you choose to upload, in order to suggest calendar entries and to-dos, and, within our Internal Routines (such as our Spelling and 听写 Routines), to generate personalised practice material, such as worksheets and audio, based on information you provide (for example, your child's name, age, or a list of words to practise). The terms in this Privacy Notice govern your use of the AI Products within our Services.
Use of AI technologies
We provide the AI Products through third-party service providers ('AI Service Providers'), including OpenAI and other providers of text, image, and speech-generation technology. Your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products, for the purposes outlined in Section 3 above. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.
Our AI Products
Our AI Products are designed for functions including: interpreting screenshots, photos, and documents into suggested calendar entries; generating personalised worksheets, practice material, and audio for Internal Routines; natural language processing; and text, image, and video analysis.
How we process your data using AI
All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with our AI Service Providers.
In short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice, unless otherwise required by law.
We will only keep your personal information for as long as necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law. No purpose in this notice will generally require us to keep your personal information for longer than twelve (12) months after termination of your Account, except that we and Stripe may retain records relating to Ticket purchases and other payment transactions for as long as required under applicable tax, accounting, and anti-money laundering laws, which in Singapore may require records to be kept for at least five (5) years. When we have no ongoing need to process your personal information, we will delete or anonymise it, or, where that is not possible (for example because it is stored in backup archives), securely isolate it from further processing until deletion is possible.
In short: We aim to protect your personal information through a system of organisational and technical security measures.
We have implemented appropriate and reasonable technical and organisational security measures designed to protect the personal information we process. However, no electronic transmission over the internet or information storage technology can be guaranteed 100% secure, so we cannot promise that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security. Transmission of personal information to and from our Services is at your own risk; you should only access the Services within a secure environment.
In short: We do not knowingly collect data directly from children under 18 years of age.
We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18, or that you are the parent or legal guardian of a minor and consent to that minor's use of the Services under your Account.
If you are a parent or legal guardian, you may use your Account to add your child's activities to a shared calendar, to register your child as an Attendee for an Event, or to provide information about your child to an Organiser (such as your child's name, age, or dietary requirements) where reasonably required for the Event. By doing so, you consent, on your child's behalf, to that information being collected and disclosed to the Organiser for that purpose. All such information is provided to us through the parent or guardian's own Account, and not directly by the child.
If we learn that personal information from a person under 18 has been collected other than as described above, we will deactivate the associated account and take reasonable measures to promptly delete such data. If you become aware of any such data, please contact us at [email protected].
In short: Depending on your state of residence in the US or the region you are located in, including Singapore, the European Economic Area (EEA), United Kingdom (UK), Switzerland, Canada, Australia, and New Zealand, you have rights that allow you greater access to and control over your personal information.
In some regions, you have certain rights under applicable data protection law, which may include the right to: (i) request access to and a copy of your personal information; (ii) request rectification or erasure; (iii) restrict processing of your personal information; (iv) data portability, where applicable; and (v) not be subject to solely automated decision-making that produces legal or similarly significant effects, without the ability to request human review. You can make such a request by contacting us using the details in 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below. We will consider and act on any request in accordance with applicable data protection law.
If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your Member State or the UK data protection authority. If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing your consent
If we are relying on your consent to process your personal information, you have the right to withdraw it at any time by contacting us. This will not affect the lawfulness of processing before its withdrawal.
Opting out of marketing communications
You can unsubscribe from our marketing and promotional communications at any time by clicking the unsubscribe link in our emails, or by contacting us. You will then be removed from marketing lists, although we may still send you service-related messages necessary for administering your Account, an Event you registered for, or a Ticket you purchased.
Account information
If you would like to review, change, or terminate your Account, you can contact us using the details provided. Upon your request to terminate your Account, we will deactivate or delete your Account and information from our active databases, although we may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, or comply with legal requirements.
Most web browsers and some mobile operating systems include a Do-Not-Track ('DNT') feature you can activate to signal your preference not to have data about your online browsing activities monitored and collected. As no uniform technology standard for recognising and implementing DNT signals has been finalised, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow, we will inform you in a revised version of this Privacy Notice.
In short: As a company established in Singapore, we process your personal information in accordance with Singapore's Personal Data Protection Act 2012 (as amended) ('PDPA').
If you are located in Singapore, or your personal information is otherwise processed by us in Singapore, the PDPA gives you certain rights, including the right to:
You can exercise these rights, or lodge a query or complaint about our handling of your personal information, by contacting our Data Protection Officer at [email protected]. If you remain dissatisfied, you may lodge a complaint with the Personal Data Protection Commission of Singapore (PDPC).
Marketing messages and the Do Not Call Registry
If you provide us with a Singapore telephone number, we will only send you marketing messages by SMS, voice call, or fax if you have given clear and unambiguous consent, in accordance with the PDPA's Do Not Call provisions and the Spam Control Act 2007. You may withdraw that consent at any time as described in 'WHAT ARE YOUR PRIVACY RIGHTS?' above. Service and transaction messages relating to your Account, an Event you have registered for or are organising, or a Ticket you have purchased are not marketing messages for this purpose and may still be sent to you.
In short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you, correct inaccuracies, obtain a copy of, or delete your personal information, and to withdraw your consent to our processing of it. These rights may be limited in some circumstances by applicable law.
We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months, other than as described in this Privacy Notice (for example, disclosures to an Event Organiser at your direction, and to Stripe for payment processing). We will not sell or share personal information belonging to website visitors, users, and other consumers.
Your rights
To exercise these rights, contact us at [email protected]. Under certain state laws you may designate an authorised agent to make a request on your behalf; we may require proof of authorisation. Upon receiving a request, we will need to verify your identity. If we decline to act on your request, you may appeal by emailing us; if your appeal is denied, you may submit a complaint to your state attorney general.
California 'Shine the Light' law
California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes in the preceding calendar year. To make such a request, contact us using the details in 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below.
In short: You may have additional rights based on the country in which you reside.
Australia and New Zealand
We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. This Privacy Notice satisfies the notice requirements defined in both Acts. At any time, you have the right to request access to or correction of your personal information by contacting us. If you believe we are unlawfully processing your personal information, you have the right to complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.
In short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated 'Last updated' date at the top of this Privacy Notice. If we make material changes, we may notify you by prominently posting a notice of the changes or by directly notifying you. We encourage you to review this Privacy Notice frequently.
If you have questions or comments about this notice, you may contact our Data Protection Officer by email at [email protected], or by mail at:
Somewhat Tiger Parents Pte. Ltd.
513 Balestier Road
Singapore 329850
Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please contact us by email at [email protected].