MerlionMinds ("we", "us") is committed to protecting your personal data in accordance with Singapore's Personal Data Protection Act (PDPA).
1. Data we collect
- Account data: name, email, password hash, role (student/tutor/admin), avatar.
- Tutor profile data: headline, bio, subjects, levels, regions, qualifications, hourly rate, availability, sample work.
- Booking & messaging data: lesson schedules, notes, messages between students and tutors.
- Payment data: handled by Stripe. We store transaction IDs and last 4 of bank for payouts; we do not store full card or bank credentials.
- Verification data: documents you submit for tutor verification (held only as long as needed).
- Usage data: log-in times, pages viewed, device info for security and analytics.
2. How we use it
- To operate the marketplace, process bookings and payments, and enable messaging.
- To verify tutors and maintain trust & safety.
- To send transactional emails (booking confirmations, payment receipts, support replies).
- To improve the product and prevent fraud.
3. Who we share it with
- Other users where necessary for a booking (e.g., tutors and students see each other's name and lesson details after a booking is accepted).
- Stripe for payment processing and tutor payouts (Stripe Connect).
- Service providers for hosting, email delivery, video classroom, and AI session-notes (only data needed for the service).
- Authorities when required by Singapore law.
We do not sell your personal data.
4. AI session notes
For TutorPlus lessons conducted in our live classroom, audio is transcribed and summarised to generate session notes for the student and tutor. Recordings are processed by our AI provider under a data processing agreement and are not used to train their models.
5. Retention
We retain personal data for as long as your account is active and as required to comply with legal, accounting, or reporting obligations under Singapore law.
6. Your rights under PDPA
- Access — request a copy of personal data we hold about you.
- Correction — ask us to correct inaccurate data.
- Withdrawal of consent — close your account (subject to ongoing booking obligations).
Email privacy@merlionminds.app to exercise these rights.
7. Security
We use encryption in transit (HTTPS), row-level security on the database, and access controls. No system is 100% secure; please use a strong unique password.
8. Children
MerlionMinds is intended for use by adults (parents and tutors). Lesson recipients may be minors but accounts are held by the parent/guardian or by the student aged 16+ with consent.
9. Changes
We may update this policy; material changes will be notified by email or in-app banner.
10. Data Protection Officer
Contact our DPO at dpo@merlionminds.app.
This is a starter Privacy Policy template and is not legal advice. Please have it reviewed by a Singapore-qualified lawyer before launching commercially.