Toshi.

PRIVACY POLICY

Last updated 20 September 2026


This Privacy Notice for Somewhat Tiger Parents Pte. Ltd. (doing business as Toshi) ('we', 'us', or 'our') describes how and why we might access, collect, store, use, and/or share ('process') your personal information when you use our services ('Services'), including when you:

  • Download and use our mobile application (the 'App'), or any other application of ours that links to this Privacy Notice;
  • Use our Calendar App, through which we help you plan and organise your family's schedule and track your children's learning and development, including through a Routine (which may be an Internal Routine or an External Routine involving a Content Partner);
  • Use our Events Portal (available at heytoshi.com/events), through which you may, as an Organiser, create and list an Event, or, as an Attendee, discover, register for, and purchase a Ticket to an Event;
  • Use The Red Pen (available at heytoshi.com/the-red-pen), through which you may book a Slot in a Run for your child, submit your child's completed work to an independent Teacher, and receive marked work and explanation videos back; or
  • Engage with us in other related ways, including any sales, marketing, or events.

Capitalised terms used but not defined in this Privacy Notice (such as Organiser, Attendee, Event, Ticket, Merchant Account, Routine, Content Partner, Teacher, Run, Slot, Student, Student Work, Marked Work, Run Content, and Service Improvement Purposes) have the meanings given to them in our Terms of Use at heytoshi.com/terms.

By using the Services, by booking a Slot in a Run, or by registering for an Event, you agree to this Privacy Notice and, where this Privacy Notice says so, you consent to the collection, use, and disclosure of personal information described in it. This applies whether or not you hold an account with us.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you have questions or concerns, please contact us at [email protected].


SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice. You can find out more detail about any of these topics in the relevant section below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the products and features you use, including whether you use the Calendar App, register for an Event, organise an Event, or book a Slot on The Red Pen. Where you use The Red Pen, this includes your child's completed work and the Teacher's marking of it.

Do we process any sensitive personal information? Some information may be considered 'special' or 'sensitive' in certain jurisdictions, such as racial or ethnic origin, sexual orientation, religious beliefs, or health information. We do not ourselves solicit sensitive personal information, but an Organiser may collect limited sensitive-adjacent information (such as dietary requirements or allergies) where reasonably necessary for an Event, as described below.

Do we collect any information from third parties? Other than information we receive from Stripe in connection with processing a payment, information a Teacher provides to us about themselves and uploads in connection with a Run, and standard analytics or advertising providers, we do not collect information from third parties.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, facilitate Event registrations, Run bookings, and payments, for security and fraud prevention, to develop and improve our products including through artificial intelligence and machine learning, and to comply with law.

Do we use children's work to train AI? Yes, to develop and improve our own models and features, in the ways described in Sections 6 and 7. We use completed work and marking primarily in de-identified or aggregated form, from which your child cannot reasonably be identified. No third-party AI provider is given your child's work to use for its own purposes or to train its own models. Section 7 explains what this means and what your choices are.

In what situations and with which parties do we share personal information? We may share information with Event Organisers, with the Teacher delivering a Run you have booked, with Stripe for payment processing, with our AI Service Providers, and with other specific third parties described below.

How do we keep your information safe? We have organisational and technical measures in place to protect your personal information, although no system can be guaranteed 100% secure.

What are your rights? Depending on where you are located, including if you are in Singapore, the EEA, UK, Switzerland, Canada, Australia, New Zealand, or certain US states, you have certain rights over your personal information.

How do you exercise your rights? The easiest way is to contact us at [email protected]. We will consider and act on any request in accordance with applicable data protection law.


TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
7. DE-IDENTIFIED AND AGGREGATED DATA, AND PUBLISHED RESEARCH
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. DO WE COLLECT INFORMATION FROM MINORS?
11. WHAT ARE YOUR PRIVACY RIGHTS?
12. CONTROLS FOR DO-NOT-TRACK FEATURES
13. DO SINGAPORE USERS HAVE SPECIFIC PRIVACY RIGHTS?
14. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
15. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?
16. DO WE MAKE UPDATES TO THIS NOTICE?
17. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
18. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?


1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, participate in activities on the Services (including creating or registering for an Event, or booking a Slot in a Run), or otherwise contact us. The personal information we collect may include:

  • names;
  • email addresses;
  • usernames;
  • mobile phone numbers (where provided for SMS verification or other service-related messaging).

Event registration information

When you register for or purchase a Ticket to an Event as an Attendee, we always disclose your username, mobile phone number, and email address to the Event's Organiser, as this information is associated with your Account and is necessary for the Organiser to administer the Event and communicate with you. An Organiser may configure additional fields in its registration form to collect further information reasonably necessary for the Event, which may include, for example, the name or age of a child attending, dietary requirements or allergies, or emergency contact details. We collect this additional information on the Organiser's behalf and disclose it to the Organiser as part of enabling your registration; we do not otherwise use it. Please see 'WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?' below for more on the Organiser's role.

Information you provide to organise an event

If you use the Events Portal to create and list an Event, we collect the information in your Event listing (such as its title, description, images, date, time, location, capacity, and pricing) and information about your brand or organisation if you set up a brand page. If your Event offers a Paid Ticket, you will need to create a Merchant Account with our payment processor, Stripe. Stripe, and not us, collects the verification information it requires to open a Merchant Account, which may include your name, date of birth, government identification number, business registration details, and bank account information, in order to comply with its own know-your-customer and anti-money-laundering obligations. We do not collect, store, or have access to this verification information; it is held by Stripe in accordance with Stripe's own privacy notice (https://stripe.com/privacy). We only receive limited transaction information from Stripe that is necessary to calculate and collect our Platform Fee, provide you with support, and detect fraud.

The Red Pen information

This subsection describes information we collect when you book a Slot in a Run and when a Run is delivered. It concerns your child's work, so please read it carefully.

Booking information. When you book a Slot, we collect your name, email address, and, where you provide it, your mobile phone number, together with the name of the Student for whom the Slot is booked and the Student's level or year. You may book a Slot without an Account, but you must create one to receive the Run; the information above is associated with that Account.

Student Work. When your child completes a Practice Paper and you upload it through the Services, we collect the completed paper as you submit it. This is a scan or file of your child's actual work and will typically contain your child's handwriting, their answers and working, and any name, class, school, or other detail written on the paper by you or your child. It may also show which questions your child answered correctly or incorrectly and how they approached them.

Marked Work and Videos. When the Teacher marks that work, we collect and store the marked paper, including the Teacher's corrections, annotations, scoring, and written feedback, and the Correction Video and Concluding Video the Teacher records for your child. A Video may include the Teacher's voice and, where the Teacher records it that way, the Teacher's image, and may show or refer to your child's work and your child's first name.

Run activity information. We collect information about how a Run progresses, including when a Practice Paper was made available, when Student Work was submitted, whether it was submitted by the deadline, when Marked Work and Videos were delivered, and whether and when you accessed them.

Teacher information. Where you are a Teacher, we collect the information you provide about your identity, teaching background, qualifications, and experience, the materials you upload, your marking and Videos, and the payout information needed to pay you. Some of this information, including your name, background, and photograph, is published on the Run Listing so that parents can decide whether to book. Further terms apply between us and each Teacher separately.

Please note that Section 6A.9 of our Terms of Use restricts what you may do with Run Content, including a prohibition on sharing it or posting it on social media.

Sensitive information

We do not ourselves request or use sensitive personal information (such as information about racial or ethnic origin, religious beliefs, sexual orientation, or health) for our own purposes. However, depending on the custom registration fields an Organiser chooses to set up for an Event, some limited information of this nature may be collected in connection with a registration (for example, a dietary requirement that discloses a religious practice, or an allergy that discloses health information). Where this occurs, that information is collected for disclosure to the Organiser as described above, and we encourage Organisers not to request more such information than is reasonably necessary for the Event.

We do not ask for, and you should not submit, any information about your child's health, diagnoses, learning needs, or similar matters as part of Student Work or a Run booking. If you choose to provide such information, we will treat it in accordance with this Privacy Notice, but we would prefer that you did not.

Payment data

We collect data necessary to process a payment if you choose to make a purchase, such as your payment instrument number and associated security code. Payment data relating to a subscription purchased through our App is handled and stored by Apple or Google; you may find their privacy notices at https://www.apple.com/sg/legal/privacy/en-ww/ and https://policies.google.com/privacy?hl=en. Payment data relating to a Ticket or a Slot Fee, and any Merchant Account verification data, is handled and stored by Stripe as described above.

Application data

If you use our App, we may also collect the following information if you choose to provide us with access or permission:

  • Mobile Device Data: your mobile device ID, model and manufacturer, operating system and version, device and application identification numbers, browser type, hardware model, internet service provider and/or mobile carrier, and IP address (or proxy server).
  • Push Notifications: we may request to send you push notifications regarding your Account, an Event, a Run, or certain features of the App. You may opt out in your device settings.

This information is primarily needed to maintain the security and operation of our App, for troubleshooting, and for our internal analytics and reporting purposes. All personal information you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Routine information

When you set up a Routine for yourself or your child (such as our meal-planning, spelling, 听写, or study and revision Routines), we collect the information needed to run it. This may include your child's name, age, or grade level, and Routine-specific inputs you provide, such as a spelling word list, a meal preference, or a study topic.

Where the Routine is an Internal Routine, we and our AI Service Providers (see 'DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?' below) use this information to generate the Routine's content for you, such as a personalised worksheet or audio recording. Where the Routine is an External Routine, the Content Partner supplies content to us for publication within the Routine, but we do not disclose your or your child's name, profile, or contact details to the Content Partner. We may share limited, aggregated, or anonymised usage or completion data relating to an External Routine (for example, how many users completed a lesson) with the relevant Content Partner, for purposes such as calculating royalties owed to them or reviewing the quality of their content, under our separate agreement with that Content Partner.

Information automatically collected

In short: Some information, such as your IP address and browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services. The information we collect includes:

  • Log and Usage Data: service-related, diagnostic, usage, and performance information our servers automatically collect, including your IP address, device information, browser type and settings, and information about your activity in the Services (such as date/time stamps, pages and files viewed, and features used).
  • Device Data: information about the computer, phone, or tablet you use to access the Services, such as IP address, device identification numbers, browser type, hardware model, and operating system.
  • Location Data: information about your device's location, which can be precise or imprecise, for example to show you Events near you. You can opt out by disabling location services on your device, but certain features (such as location-based Event discovery) may not work.

2. HOW DO WE PROCESS YOUR INFORMATION?

In short: We process your information to provide, improve, and administer our Services, facilitate Event registrations, Run bookings, and payments, communicate with you, develop and improve our products including through artificial intelligence, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including to:

  • facilitate Account creation and authentication and otherwise manage your Account;
  • deliver and facilitate delivery of the Services you request, including creating or registering for an Event, and booking and delivering a Run;
  • process a Ticket purchase or Slot Fee and calculate and collect our Platform Fee;
  • disclose your registration information to an Event's Organiser as described in Section 1;
  • make Student Work available to the Teacher delivering your Run, and make Marked Work and Videos available to you, as described in Section 4;
  • respond to your inquiries and offer support;
  • send administrative information to you, including about changes to our terms and policies, and notifications about the progress of a Run;
  • fulfil and manage your orders, payments, and any refunds or credits facilitated through us;
  • enable user-to-user communications, including between an Organiser and an Attendee, and between a Teacher and a Customer;
  • request feedback and contact you about your use of our Services;
  • send you marketing and promotional communications, where this is in accordance with your preferences (you can opt out at any time, see 'WHAT ARE YOUR PRIVACY RIGHTS?' below);
  • carry out quality assurance, moderation, and dispute handling, including reviewing Run Content where a complaint is made;
  • protect our Services, including fraud monitoring and prevention on the Events Portal and The Red Pen;
  • identify usage trends and improve our Services;
  • develop, train, evaluate, and improve our products and features, including artificial intelligence and machine learning models, as described in Sections 6 and 7; and
  • save or protect an individual's vital interest, such as to prevent harm.

In short: We only process your personal information when we believe it is necessary and we have a valid legal basis to do so under applicable law, such as with your consent, to comply with laws, to fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.

If you are in Singapore. We process personal information on the basis of your consent, given when you accept our Terms of Use and this Privacy Notice, and in reliance on the exceptions available under the Personal Data Protection Act 2012 where they apply, including the business improvement and research exceptions described in Section 13.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on to process your personal information. We may rely on the following:

  • Consent: where you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time.
  • Performance of a Contract: where we believe it is necessary to fulfil our contractual obligations to you, including providing the Calendar App, the Events Portal, or The Red Pen, facilitating your registration for or organisation of an Event, or delivering a Run you have booked.
  • Legitimate Interests: where we believe it is reasonably necessary to achieve our legitimate business interests, such as to develop and improve our Services and our artificial intelligence and machine learning features, support our marketing activities, or diagnose problems and prevent fraud, and those interests do not outweigh your interests and fundamental rights.
  • Legal Obligations: where we believe it is necessary for compliance with our legal obligations.
  • Vital Interests: where we believe it is necessary to protect your vital interests or those of a third party.

If you are located in Canada, this section applies to you.

We may process your information if you have given specific permission (express consent), or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time. In certain exceptional cases we may be permitted by law to process your information without consent, including for fraud detection and prevention, business transactions, or if the information is publicly available and specified by regulation.


4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In short: We may share information in the specific situations and with the specific third parties described in this section.

Event Organisers

As described in Section 1, when you register for or purchase a Ticket to an Event, we share your username, phone number, email address, and any additional information requested by the Organiser's registration form, with that Organiser. The Organiser receives and uses this information as an independent controller, and not as our processor. The Organiser's own privacy practices, and its obligations under applicable data protection law (including Singapore's Personal Data Protection Act 2012), govern its further use of your information; we are not responsible for the Organiser's handling of it, and we encourage you to review an Event's listing or ask the Organiser about its privacy practices before registering.

Teachers on The Red Pen

When you book a Slot in a Run, we disclose to the Teacher delivering that Run the Student's name and level, the Student Work you submit, and information necessary for the Teacher to deliver the Run and communicate with you about it through the Services, which includes your name and the email address associated with your Account. This disclosure is necessary for the Run to be delivered at all: the Teacher cannot mark work they cannot see.

A Teacher receives this information as an independent controller, and not as our processor. Under our agreement with each Teacher, a Teacher must use it only for the purpose of delivering the Run, must keep it confidential, must not disclose it to any third party, must not use it to contact you outside the Services or to market their own services to you, and must delete or return it when the Run is complete. We are not, however, responsible for a Teacher's own handling of that information beyond the obligations we impose on them.

We do not disclose your payment information, your mobile phone number, or your other Toshi Account activity to a Teacher.

Stripe

If you purchase a Paid Ticket or book a Slot, your payment information is shared with and processed by Stripe. If you are an Organiser accepting Paid Tickets, or a Teacher receiving payouts, your Merchant Account or payout verification information is collected and held directly by Stripe, and we only receive limited transaction information from Stripe as described in Section 1.

AI Service Providers

As described in Section 6, we use third-party providers of artificial intelligence and machine learning technology to deliver certain features of the Calendar App. Where a feature requires it, the information you provide for that feature is shared with and processed by those providers. At present this applies to the screenshots, photos, documents, and messages you upload for us to turn into calendar entries and to-dos, and to the inputs you provide for an Internal Routine.

Run Content is treated differently. We do not send Student Work, Marked Work, or Videos to any AI Service Provider in order to deliver a feature to you, and no AI provider is given Run Content to use for its own purposes or to train its own general-purpose models.

We may, however, share Run Content with AI Service Providers, cloud computing providers, and similar technology providers acting on our behalf and under contract with us, for the purpose of developing, training, and improving our own models and features as described in Section 6. Where we do this, that provider may use the information only to perform that work for us, must keep it confidential, and may not use it for its own purposes. Wherever we can, we provide such information in the de-identified or aggregated form described in Section 7.

Content Partners

As described in Section 1, if you or your child use an External Routine, we do not share your or your child's name, profile, or contact details with the relevant Content Partner. We may share limited, aggregated, or anonymised usage or completion data about an External Routine with its Content Partner, for royalty calculation or content quality purposes, under our agreement with that Content Partner. A Content Partner does not otherwise have access to your Account or personal information.

Public and private event visibility

If an Organiser publishes an Event as a Public Event, the Event listing (including the Organiser's brand page, name, and any public reviews or ratings) may be viewed by any visitor to the Events Portal, including people who are not registered users. A Private Event is only accessible to a person who has the direct link; an Organiser is responsible for controlling who that link is shared with. If you choose to post a public comment, review, or other Contribution, that Contribution may be viewed by other users and the public.

Run Content is never made public and is never visible to other users of the Services. It is accessible only to you, to the Teacher delivering your Run, and to our authorised personnel for the purposes described in this Privacy Notice.

Other sharing situations

  • Business Transfers: we may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business.
  • Other Users: when you share personal information by posting comments, reviews, or other content to the Services, that information may be viewed by other users and, for Public Events, the public. This does not apply to Run Content.

Mobile numbers and SMS opt-in data

We do not share your mobile phone number with third parties or affiliates for marketing or promotional purposes. Your text messaging opt-in information and consent are kept confidential and not shared with any third party. We deliver SMS messages through AWS Notify, which does not share end-user phone numbers with third parties for marketing purposes.


5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some tracking technologies help us maintain security, prevent crashes, fix bugs, save your preferences, and support basic site functions. We also permit third parties and service providers to use tracking technologies for analytics and advertising. To the extent these are deemed a 'sale' or 'sharing' under applicable US state laws, you can opt out as described in Section 14 below. You can also refuse certain cookies through your browser settings, although this may affect your ability to use parts of the Services.

Google Analytics

We may share your information with Google Analytics to track and analyse use of the Services. To opt out, visit https://tools.google.com/dlpage/gaoptout. For more on Google's privacy practices, see https://policies.google.com/privacy.


6. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In short: Yes. We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies, and we also use information generated through the Services to develop and improve those technologies.

As part of the Services, we offer features powered by artificial intelligence, machine learning, or similar technologies (collectively, 'AI Products'). For example, we use AI Products to interpret screenshots, photos, documents, and messages that you choose to upload, in order to suggest calendar entries and to-dos, and, within our Internal Routines (such as our Spelling and 听写 Routines), to generate personalised practice material, such as worksheets and audio, based on information you provide (for example, your child's name, age, or a list of words to practise). The terms in this Privacy Notice govern your use of the AI Products within our Services.

Two different things, kept separate

This section covers two distinct uses of artificial intelligence, and it is worth keeping them apart:

  1. AI we use to deliver a feature to you. Here, information you provide is sent to a third-party AI provider so that a feature works. This currently applies only to the Calendar App.
  2. Information we use to develop and improve our own products. Here, we use information generated through the Services to build and improve our own models and features. Some of that work may involve technology providers acting on our behalf, but the resulting models and features are ours, and no provider is permitted to use the information for its own purposes. This is what applies to The Red Pen.

1. AI we use to deliver a feature to you

We provide these AI Products through third-party service providers ('AI Service Providers'), including OpenAI and other providers of text, image, and speech-generation technology. The information you provide for the relevant feature is shared with and processed by these AI Service Providers so that the feature can work, for the purposes outlined in Section 3 above. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

What this currently covers. Two features:

  • Calendar entry extraction. When you upload a screenshot, photo, PDF, document, or message so that we can turn it into a calendar entry or to-do, that file and its contents are sent to an AI Service Provider to be read and interpreted.
  • Internal Routines. When you set up an Internal Routine such as our Spelling or 听写 Routine, the inputs you provide (for example your child's name, age, or a word list) are sent to an AI Service Provider so that the personalised worksheet, practice material, or audio can be generated.

What this does not cover. It does not currently cover The Red Pen. We do not send Student Work, Marked Work, or Videos to an AI Service Provider in order to deliver a feature to you. If we later introduce a feature that uses AI to assist with marking, correction, or explanation, we will update this Privacy Notice and tell you before that feature applies to your Run Content. Our separate use of Run Content to develop and improve our own models is described immediately below and is not affected by this paragraph.

Whether these providers train on your information. We access these providers through their developer and business platforms rather than their consumer products. On those platforms, the provider does not use inputs or outputs to train its own general-purpose models by default. A provider may retain data for a limited period for abuse monitoring and security under its own policies. If we ever adopt a service or tier on which a provider would train on your information, we will update this Privacy Notice and tell you before doing so.

2. Information we use to develop and improve our own products

Separately from the above, we use information generated through the Services to develop, train, fine-tune, evaluate, benchmark, and improve our own models, features, and products. We refer to these collectively as the Service Improvement Purposes, which are defined in Section 6A.8 of our Terms of Use and include:

  • training, fine-tuning, evaluating, and improving machine learning and artificial intelligence models;
  • developing automated or assisted marking, feedback, explanation, and recommendation features;
  • building question banks, error taxonomies, difficulty models, and benchmarks;
  • generating statistics, insights, research, benchmarks, and published reports on learning, assessment, and education trends; and
  • personalising or adapting the Services for you or for other users.

Where The Red Pen is concerned, this means the following. Student Work submitted through The Red Pen, and the Marked Work a Teacher produces from it, are used for the Service Improvement Purposes. This is one of the reasons we collect them, alongside delivering the Run itself, and we want to be clear about it rather than leave it to be inferred.

We use this information primarily in de-identified or aggregated form. Section 7 explains what that means, what we may do with it, and why de-identification matters. Where we use Student Work or Marked Work in a form from which your child could reasonably be identified, we do so only:

  • to deliver the Run, including by making Student Work available to the Teacher;
  • for internal quality assurance, moderation, dispute handling, safety, and fraud prevention;
  • for the Service Improvement Purposes, to the extent permitted by the Personal Data Protection Act 2012, including the business improvement and research exceptions described in Section 13; and
  • where required or permitted by law.

We do not publish, sell, or otherwise make publicly available Student Work or Marked Work in a form from which your child can reasonably be identified. We do not use Student Work or Marked Work in identifiable form in advertising, marketing, or promotional material unless you give us separate, specific consent at the time.

Your choices

You may withdraw your consent to our use of identifiable personal data for the Service Improvement Purposes at any time by contacting us at [email protected]. Withdrawal takes effect going forward only. It does not affect anything already lawfully done before you withdrew, it does not require us to retrain or reverse a model that has already been trained, and it does not extend to de-identified or aggregated data as described in Section 7. Where withdrawal makes it impossible for us or a Teacher to deliver a Run you have booked, we may cancel your Slot, as described in Section 6A.8(f) of our Terms of Use.

How we process your data using AI

All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with our AI Service Providers.


7. DE-IDENTIFIED AND AGGREGATED DATA, AND PUBLISHED RESEARCH

In short: We convert information, including your child's work, into a form from which your child cannot reasonably be identified, and we use that de-identified information without restriction, including to train our models and to publish research.

What we do

We may convert Student Work, Marked Work, Routine inputs and outputs, and information about how the Services are used into de-identified or aggregated form, meaning a form from which neither you, nor your child, nor your child's school can reasonably be identified. We may then use, retain, disclose, publish, and commercialise that de-identified and aggregated data for any lawful purpose, without restriction, including for all of the Service Improvement Purposes.

This expressly includes publishing aggregated findings, statistics, research, and reports on learning, assessment, and education, whether free or paid, whether for our own purposes or together with or for third parties, and whether or not that publication promotes our business.

Our commitments when we do this

Nothing we publish under this Section will identify you, your child, your child's school, your child's Teacher, or any individual piece of Student Work. In particular:

  • we will not reproduce any image, scan, or excerpt of your child's actual work, including handwriting, in any published material;
  • we will not publish a figure derived from a group so small that an individual child could be picked out from it;
  • we will not publish results broken down by individual Teacher, or at a level of detail from which an individual Teacher's results could be worked out; and
  • we will pool data across multiple Runs, Teachers, and time periods rather than publishing results for a single Run or cohort.

Why this matters, and what it means for your rights

De-identified and aggregated data is not personal data, because it is no longer about an identifiable individual. This has two consequences you should understand:

  1. Our right to use it is perpetual. It survives the end of a Run, the closure of your Account, and the end of our agreement with you.
  2. It is not subject to a request to delete personal data, and it is not affected by a withdrawal of consent, because there is no longer any personal data in it to delete or to withdraw consent for.

If you are not comfortable with this, please do not submit Student Work through The Red Pen. Your rights in relation to identifiable personal data are unaffected and are set out in Sections 11 and 13.


8. HOW LONG DO WE KEEP YOUR INFORMATION?

In short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice, unless otherwise required by law.

We will only keep your personal information for as long as necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law. No purpose in this notice will generally require us to keep your personal information for longer than twelve (12) months after termination of your Account, except that:

  • we and Stripe may retain records relating to Ticket purchases, Slot Fees, payouts, and other payment transactions for as long as required under applicable tax, accounting, and anti-money laundering laws, which in Singapore may require records to be kept for at least five (5) years; and
  • de-identified and aggregated data as described in Section 7 is retained indefinitely, as it is no longer personal data.

Run Content. Deliverables remain accessible to you through your Account until ninety (90) days after the Run End Date, after which we may remove them from your Account, as set out in Section 6A.10 of our Terms of Use. You should download and save anything you wish to keep before then, within the limits of your licence. We may retain a copy of Run Content after that point for the purposes set out in Sections 2, 6, and 7, and for as long as needed to handle any dispute or comply with our legal obligations.

When we have no ongoing need to process your personal information, we will delete or anonymise it, or, where that is not possible (for example because it is stored in backup archives), securely isolate it from further processing until deletion is possible.


9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the personal information we process. Access to Run Content within our organisation is limited to personnel who need it for the purposes described in this Privacy Notice. However, no electronic transmission over the internet or information storage technology can be guaranteed 100% secure, so we cannot promise that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security. Transmission of personal information to and from our Services is at your own risk; you should only access the Services within a secure environment.


10. DO WE COLLECT INFORMATION FROM MINORS?

In short: We do not knowingly collect data directly from children under 18 years of age. Where our Services involve a child's information, including a child's schoolwork, it is provided to us by that child's parent or legal guardian through their own account.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18, or that you are the parent or legal guardian of a minor and consent to that minor's use of the Services under your Account.

If you are a parent or legal guardian, you may use your Account to add your child's activities to a shared calendar, to register your child as an Attendee for an Event, to provide information about your child to an Organiser (such as your child's name, age, or dietary requirements) where reasonably required for the Event, or to book a Slot on The Red Pen and submit your child's completed work. By doing so, you consent, on your child's behalf, to that information being collected, used, and disclosed for the purposes described in this Privacy Notice.

Specifically in relation to The Red Pen, by submitting Student Work you confirm that you are the parent or legal guardian of the Student, or are otherwise authorised to act on their behalf, and you consent on the Student's behalf to:

  • the disclosure of that work to the Teacher delivering the Run, so that it can be marked;
  • the storage of that work, and of the Teacher's marking of it, on the Services; and
  • the use of that work and that marking for the Service Improvement Purposes described in Sections 6 and 7, including in de-identified and aggregated form.

All such information is provided to us through the parent or guardian's own Account, and not directly by the child. A child may not hold an Account, book a Slot, or submit work directly.

If we learn that personal information from a person under 18 has been collected other than as described above, we will deactivate the associated account and take reasonable measures to promptly delete such data. If you become aware of any such data, please contact us at [email protected].


11. WHAT ARE YOUR PRIVACY RIGHTS?

In short: Depending on your state of residence in the US or the region you are located in, including Singapore, the European Economic Area (EEA), United Kingdom (UK), Switzerland, Canada, Australia, and New Zealand, you have rights that allow you greater access to and control over your personal information.

In some regions, you have certain rights under applicable data protection law, which may include the right to: (i) request access to and a copy of your personal information; (ii) request rectification or erasure; (iii) restrict processing of your personal information; (iv) data portability, where applicable; and (v) not be subject to solely automated decision-making that produces legal or similarly significant effects, without the ability to request human review. You can make such a request by contacting us using the details in 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below. We will consider and act on any request in accordance with applicable data protection law.

These rights apply to personal information. They do not apply to de-identified or aggregated data as described in Section 7, which is no longer personal information.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your Member State or the UK data protection authority. If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

If we are relying on your consent to process your personal information, you have the right to withdraw it at any time by contacting us. This will not affect the lawfulness of processing before its withdrawal. Please note that where you withdraw consent in a way that prevents us or a Teacher from delivering a Run you have booked, we may cancel your Slot, and no refund will be payable, as set out in Section 6A.8(f) of our Terms of Use.

Opting out of marketing communications

You can unsubscribe from our marketing and promotional communications at any time by clicking the unsubscribe link in our emails, or by contacting us. You will then be removed from marketing lists, although we may still send you service-related messages necessary for administering your Account, an Event you registered for, a Ticket you purchased, or a Run in which you have booked a Slot.

Account information

If you would like to review, change, or terminate your Account, you can contact us using the details provided. Upon your request to terminate your Account, we will deactivate or delete your Account and information from our active databases, although we may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, or comply with legal requirements, and we will retain de-identified and aggregated data as described in Section 7.


12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track ('DNT') feature you can activate to signal your preference not to have data about your online browsing activities monitored and collected. As no uniform technology standard for recognising and implementing DNT signals has been finalised, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow, we will inform you in a revised version of this Privacy Notice.


13. DO SINGAPORE USERS HAVE SPECIFIC PRIVACY RIGHTS?

In short: As a company established in Singapore, we process your personal information in accordance with Singapore's Personal Data Protection Act 2012 (as amended) ('PDPA').

If you are located in Singapore, or your personal information is otherwise processed by us in Singapore, the PDPA gives you certain rights, including the right to:

  • request access to the personal information we hold about you and how it has been or may have been used or disclosed in the past year;
  • request correction of an error or omission in your personal information;
  • withdraw any consent you have given to our collection, use, or disclosure of your personal information, subject to any legal or contractual restrictions and reasonable notice; withdrawing consent may mean we can no longer provide you with all or part of the Services; and
  • be notified of certain data breaches affecting your personal information, in accordance with the PDPA's data breach notification obligations.

Business improvement and research

In addition to processing personal information on the basis of your consent, we may rely on the exceptions in the First Schedule to the PDPA that permit the use of personal data without consent for business improvement purposes and for research purposes, in each case subject to the conditions in those provisions. We rely on these exceptions in connection with the Service Improvement Purposes described in Section 6, including improving and developing our products and services and understanding how they are used. Where we rely on an exception rather than your consent, we do so only within the limits that the PDPA allows, and we apply the de-identification practices described in Section 7 wherever we can.

Marketing messages and the Do Not Call Registry

If you provide us with a Singapore telephone number, we will only send you marketing messages by SMS, voice call, or fax if you have given clear and unambiguous consent, in accordance with the PDPA's Do Not Call provisions and the Spam Control Act 2007. You may withdraw that consent at any time as described in 'WHAT ARE YOUR PRIVACY RIGHTS?' above. Service and transaction messages relating to your Account, an Event you have registered for or are organising, a Ticket you have purchased, or a Run in which you have booked a Slot, are not marketing messages for this purpose and may still be sent to you.

You can exercise these rights, or lodge a query or complaint about our handling of your personal information, by contacting our Data Protection Officer at [email protected]. If you remain dissatisfied, you may lodge a complaint with the Personal Data Protection Commission of Singapore (PDPC).


14. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you, correct inaccuracies, obtain a copy of, or delete your personal information, and to withdraw your consent to our processing of it. These rights may be limited in some circumstances by applicable law.

We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months, other than as described in this Privacy Notice (for example, disclosures to an Event Organiser at your direction, to a Teacher in order to deliver a Run you booked, and to Stripe for payment processing). We will not sell or share personal information belonging to website visitors, users, and other consumers.

Your rights

  • Right to know whether we are processing your personal data;
  • Right to access your personal data;
  • Right to correct inaccuracies in your personal data;
  • Right to request deletion of your personal data;
  • Right to obtain a copy of the personal data you previously shared with us;
  • Right to non-discrimination for exercising your rights; and
  • Right to opt out of the processing of your personal data if used for targeted advertising, sale, or certain profiling.

To exercise these rights, contact us at [email protected]. Under certain state laws you may designate an authorised agent to make a request on your behalf; we may require proof of authorisation. Upon receiving a request, we will need to verify your identity. If we decline to act on your request, you may appeal by emailing us; if your appeal is denied, you may submit a complaint to your state attorney general.

California 'Shine the Light' law

California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes in the preceding calendar year. To make such a request, contact us using the details in 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below.


15. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

In short: You may have additional rights based on the country in which you reside.

Australia and New Zealand

We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. This Privacy Notice satisfies the notice requirements defined in both Acts. At any time, you have the right to request access to or correction of your personal information by contacting us. If you believe we are unlawfully processing your personal information, you have the right to complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.


16. DO WE MAKE UPDATES TO THIS NOTICE?

In short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated 'Last updated' date at the top of this Privacy Notice. If we make material changes, we may notify you by prominently posting a notice of the changes or by directly notifying you. We encourage you to review this Privacy Notice frequently.


17. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may contact our Data Protection Officer by email at [email protected], or by mail at:

Somewhat Tiger Parents Pte. Ltd. 513 Balestier Road Singapore 329850


18. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please contact us by email at [email protected].