Privacy policy

The short version

StudyLah is built for Singapore primary-school children, so we treat personal data carefully and collect only what we need.

A parent or guardian holds the account. Children practise through a profile that the parent sets up and controls, and a child's data belongs to the parent. We use the data to run the practice app, show parents their child's progress, manage accounts and billing, and keep the service safe and reliable. We do not sell personal data, and we do not use children's data for advertising.

You can ask to see, correct, or remove your data at any time. The rest of this notice explains the detail and your rights under Singapore's Personal Data Protection Act (PDPA).

1. Who we are

StudyLah is operated by StudyLah Learning Pte. Ltd. (UEN 202620010Z), a company incorporated in Singapore ("StudyLah", "we", "us", "our").

For any privacy question or request, including a request to access, correct, or delete personal data, contact us at hello@studylah.com.sg. This address also reaches the person responsible for data protection at StudyLah.

2. What this notice covers

This notice covers personal data we handle through the StudyLah website at studylah.com.sg, the StudyLah practice app, and related emails and messages. It applies to parents and guardians who hold accounts, to the children whose profiles sit under those accounts, and to people who visit our website.

3. How accounts work, and what that means for children's data

The account model shapes everything else, so we explain it first.

A parent or guardian creates and holds the StudyLah account, and is responsible for billing, settings, consent, and communications.

A child does not have an independent account and does not log in on their own. A child practises through a profile that the parent creates and controls under the parent's account. That profile holds the child's own progress, streaks, and practice history.

A child's personal data is collected under, and belongs to, the parent's account. The parent gives consent on the child's behalf, can view and manage the child's data, and can ask us to correct or delete it. We do not allow children to create their own accounts or to give us personal data directly outside a parent-managed profile.

4. The personal data we collect

From the parent or guardian (account holder):

• Name.
• Email address.
• Account password, stored only in hashed form, never in plain text.
• Billing information when you subscribe to a paid plan. Card payments are handled by our payment provider; we do not store full card numbers on our own systems.
• Messages you send us, such as support emails.
• Your communication and marketing preferences.

For the child profile (provided and managed by the parent):

• A display name or nickname for the child.
• The child's level, for example P3 to P6, and the subjects they practise.
• Practice activity: questions attempted, answers given, scores, streaks, time spent, and similar learning records used to show progress.
• Avatar or cosmetic selections, where that feature is available.

We do not ask for a child's full legal name, date of birth, home address, photograph, or contact details.

Collected automatically when you use StudyLah:

• Device and browser information, such as device type, operating system, and browser version.
• IP address and the approximate location derived from it.
• Usage and interaction data, such as pages viewed and features used.
• Information from cookies and similar technologies (see Section 10 and our Cookie Policy).

5. How we collect personal data

We collect personal data directly from you when you sign up, set up a child profile, subscribe, or contact us; automatically as you use the website and app, through cookies and analytics; and from our service providers acting on our behalf, for example our payment provider confirming a successful payment.

6. Why we use personal data

We use personal data to:

• Create and manage parent accounts and child profiles.
• Provide the practice service and save a child's progress, streaks, and history.
• Show parents insights about their child's progress through the parent dashboard.
• Process subscriptions, payments, renewals, and cancellations where paid plans apply.
• Send service messages such as account confirmations, receipts, security notices, and important updates.
• Send optional updates or a parent newsletter, which you can stop at any time using the unsubscribe link or from your account settings.
• Maintain, secure, and improve the service, including fixing problems and understanding in aggregate how features are used.
• Detect and prevent fraud, abuse, and security incidents.
• Meet our legal obligations and enforce our Terms of Service.

We do not use children's data to build advertising profiles or to target advertising, and we do not sell personal data.

7. Consent, and how to withdraw it

When you create an account, set up a child profile, or send us information, you consent to our collecting, using, and disclosing personal data for the purposes in this notice. For a child's data, the parent or guardian gives this consent on the child's behalf.

You may withdraw consent for any purpose that is not needed to run the service or to meet a legal obligation, by contacting us at hello@studylah.com.sg. We will tell you the likely effect of withdrawing, such as no longer being able to provide a feature, and we will act on your request within a reasonable time. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

For marketing or newsletter messages, you can withdraw consent at any time using the unsubscribe link in the message or by contacting us.

8. Who we share personal data with

We do not sell personal data. We share it only as needed to run StudyLah, and only with parties bound to protect it.

We use the following service providers to process personal data on our behalf, under contract and on our instructions:

• Hosting and infrastructure: Vercel.
• Database, authentication, and storage: Supabase.
• Transactional email: Resend.
• Product analytics: PostHog.
• Payment processing, for paid plans: Stripe.

We may also disclose personal data where the law requires it, to respond to lawful requests from public authorities, to protect the rights, safety, or property of StudyLah, our users, or others, or in connection with a business transaction such as a merger or acquisition, in which case we will require the recipient to honour this notice.

9. Transfers outside Singapore

Some of our service providers store or process personal data on servers located outside Singapore. Where we transfer personal data outside Singapore, we take the steps required by the PDPA so that the data receives a standard of protection comparable to the protection under Singapore law, including through contractual commitments with our providers.

10. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the service secure, and understand how the site and app are used so we can improve them.

For analytics we use PostHog, served through our own domain. We send it usage events, such as pages viewed and features used, tied to a random identifier and, once you hold an account, to your parent account, so we can see how families move from the website into the app and improve the experience. We do not send children's names or profile details to analytics, we anonymise IP addresses, and we do not record your screen.

You can turn analytics off at any time from your account settings or through your browser's cookie controls, though blocking necessary cookies may stop parts of the service, such as staying signed in, from working. Because we use only necessary cookies and privacy-first analytics, we do not show a separate cookie banner; this notice and our Cookie Policy explain what we collect and how to opt out.

11. How long we keep personal data

We keep personal data only as long as we need it for the purposes in this notice, or as the law requires.

• Account and child-profile data: kept while the account is active, and deleted or anonymised within twelve months after the account is closed, or sooner on request.
• Billing and transaction records: kept for the period Singapore tax and accounting law requires, which is currently five years.
• Analytics data: kept for up to twenty-four months, then deleted or aggregated.

When personal data is no longer needed, we delete it or anonymise it.

12. How we protect personal data

We take reasonable steps to protect personal data against unauthorised access, use, disclosure, loss, and similar risks. These include access controls, encryption of data in transit, hashed storage of passwords, and limiting access to what each role needs. No method of transmission or storage is completely secure, so we cannot promise absolute security, but we work to keep your data safe and to respond quickly if something goes wrong. If a data breach affects you and meets the thresholds under the PDPA, we will notify the Personal Data Protection Commission and affected individuals as the law requires.

13. Your rights

Under the PDPA you may:

• Access the personal data we hold about you and ask how it has been used or disclosed.
• Correct personal data that is inaccurate or incomplete.
• Withdraw consent as described in Section 7.

Parents may exercise these rights for their child's profile. To make a request, contact us at hello@studylah.com.sg. We may need to verify your identity before we act, and we will respond within the timeframes set by the PDPA. Where the law allows a reasonable fee for an access request, we will tell you before we proceed.

14. Children

StudyLah is meant for primary-school children, used through a parent-managed profile as described in Section 3. We design the service to collect as little data about children as possible, we do not use children's data for advertising, and we follow the higher standard of care expected for services likely to be used by children, in line with the PDPC Advisory Guidelines for Children's Personal Data in the Digital Environment.

If you believe a child has given us personal data outside a parent-managed profile, contact us at hello@studylah.com.sg and we will remove it.

15. Changes to this notice

We may update this notice from time to time. When we make a material change, we will update the date at the top and, where appropriate, let you know. Continuing to use StudyLah after an update means you accept the updated notice.

16. How to contact us, and how to complain

For any question or request about this notice or your personal data, contact us at hello@studylah.com.sg.

If you are not satisfied with how we have handled your personal data, you may contact the Personal Data Protection Commission of Singapore (PDPC) at www.pdpc.gov.sg.