Privacy policy

The short version

StudyLah is built for Singapore primary-school children, so we treat personal data carefully and collect only what we need.

A parent or guardian holds the account. Children practise through a profile that the parent sets up and controls, and a child's data belongs to the parent. We use the data to run the practice app, show parents their child's progress, manage accounts and billing, and keep the service safe and reliable. We do not sell personal data, and we do not use children's data for advertising.

You can ask to see, correct, or remove your data at any time. The rest of this notice explains the detail and your rights under Singapore's Personal Data Protection Act (PDPA).

1. Who we are

StudyLah is operated by StudyLah Learning Pte. Ltd. (UEN 202620010Z), a company incorporated in Singapore ("StudyLah", "we", "us", "our").

For any privacy question or request, including a request to access, correct, or delete personal data, contact us at hello@studylah.com.sg. This address also reaches the person responsible for data protection at StudyLah.

2. What this notice covers

This notice covers personal data we handle through the StudyLah website at studylah.com.sg, the StudyLah practice app, and related emails and messages. It applies to parents and guardians who hold accounts, to the children whose profiles sit under those accounts, and to people who visit our website. It also covers the limited details an account holder gives us about other people, such as a family cheering contact's email address or a referred friend's email address; we use those details only for the feature they were given for.

3. How accounts work, and what that means for children's data

The account model shapes everything else, so we explain it first.

A parent or guardian creates and holds the StudyLah account, and is responsible for billing, settings, consent, and communications.

A child does not have an independent account and does not log in on their own. A child practises through a profile that the parent creates and controls under the parent's account. That profile holds the child's own progress, streaks, and practice history.

A child's personal data is collected under, and belongs to, the parent's account. The parent gives consent on the child's behalf, can view and manage the child's data, and can ask us to correct or delete it. We do not allow children to create their own accounts or to give us personal data directly outside a parent-managed profile.

4. The personal data we collect

From the parent or guardian (account holder):

• Name.
• Email address.
• Sign-in details. StudyLah is passwordless: you sign in with a one-time code sent to your email, or through your Google account, so there is no StudyLah password for us to store.
• Billing information when you subscribe to a paid plan. Card payments are handled by our payment provider; we do not store full card numbers on our own systems.
• Messages you send us, such as support emails.
• Your communication and marketing preferences.
• Family cheering contacts, if you use that feature: the email address and relationship (for example, Grandma) of family members you invite to receive your child's progress updates. We only send them updates after they confirm they want them, and they can unsubscribe at any time.
• Referral details, if you share your referral link: the email address and signup status of friends who join through it, shown to you only in masked form.

For the child profile (provided and managed by the parent):

• A display name or nickname for the child.
• The child's level, for example P3 to P6, and the subjects they practise.
• Practice activity: questions attempted, answers given, scores, streaks, time spent, and similar learning records used to show progress.
• Avatar or cosmetic selections, where that feature is available.

We do not ask for a child's full legal name, date of birth, home address, photograph, or contact details.

Collected automatically when you use StudyLah:

• Device and browser information, such as device type, operating system, and browser version.
• IP address and the approximate location derived from it.
• Usage and interaction data, such as pages viewed and features used.
• Information from cookies and similar technologies (see Section 10 and our Cookie Policy).

5. How we collect personal data

We collect personal data directly from you when you sign up, set up a child profile, subscribe, or contact us; automatically as you use the website and app, through cookies and analytics; and from our service providers acting on our behalf, for example our payment provider confirming a successful payment.

6. Why we use personal data

We use personal data to:

• Create and manage parent accounts and child profiles.
• Provide the practice service and save a child's progress, streaks, and history.
• Show parents insights about their child's progress through the parent dashboard.
• Process subscriptions, payments, renewals, and cancellations where paid plans apply.
• Send service messages such as account confirmations, receipts, security notices, and important updates.
• Send optional updates or a parent newsletter, which you can stop at any time using the unsubscribe link or from your account settings.
• Maintain, secure, and improve the service, including fixing problems and understanding in aggregate how features are used.
• Detect and prevent fraud, abuse, and security incidents.
• Measure our advertising on our public marketing pages and free demo, so we know whether it works. This never uses children's data (see Section 10).
• Meet our legal obligations and enforce our Terms of Service.

We do not use children's data to build advertising profiles or to target advertising, and we do not sell personal data.

7. Consent, and how to withdraw it

When you create an account, set up a child profile, or send us information, you consent to our collecting, using, and disclosing personal data for the purposes in this notice. For a child's data, the parent or guardian gives this consent on the child's behalf.

You may withdraw consent for any purpose that is not needed to run the service or to meet a legal obligation, by contacting us at hello@studylah.com.sg. We will tell you the likely effect of withdrawing, such as no longer being able to provide a feature, and we will act on your request within a reasonable time. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

For marketing or newsletter messages, you can withdraw consent at any time using the unsubscribe link in the message or by contacting us.

8. Who we share personal data with

We do not sell personal data. We share it only as needed to run StudyLah, and only with parties bound to protect it.

Leaderboards show a nickname to other children. When your child plays a game in the arcade, their nickname, score and position can appear on a leaderboard that other children practising at the same level can see. Only people signed in to StudyLah can see a leaderboard, and none of it is public on the web. Nothing else appears there: no real name, no school, no age, no contact details. There is no way for one child to tap through to another child's profile, and children cannot message each other anywhere on StudyLah. If a nickname is missing, or does not pass our word filter, that row reads "Anonymous" instead.

You can change your child's nickname at any time in the app. You can also clear it, and their row will then read "Anonymous", with the score and position still shown but no name attached.

We use the following service providers to process personal data on our behalf, under contract and on our instructions:

• Hosting and infrastructure: Vercel.
• Database, authentication, and storage: Supabase.
• Transactional email: Resend.
• Product analytics: PostHog.
• Advertising measurement, on our public marketing pages and our free demo: Meta Platforms and Google.
• Payment processing, for paid plans: Stripe.

We may also disclose personal data where the law requires it, to respond to lawful requests from public authorities, to protect the rights, safety, or property of StudyLah, our users, or others, or in connection with a business transaction such as a merger or acquisition, in which case we will require the recipient to honour this notice.

9. Transfers outside Singapore

Some of our service providers store or process personal data on servers located outside Singapore. Where we transfer personal data outside Singapore, we take the steps required by the PDPA so that the data receives a standard of protection comparable to the protection under Singapore law, including through contractual commitments with our providers.

10. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the service secure, and understand how the site and app are used so we can improve them.

For analytics we use PostHog, served through our own domain. We send it usage events, such as pages viewed and features used, tied to a random identifier and, once you hold an account, to your parent account, so we can see how families move from the website into the app and improve the experience. We do not send children's names or profile details to analytics, we anonymise IP addresses, and we do not record your screen.

When we advertise StudyLah, we use advertising measurement tags from Meta and from Google on our public marketing pages and on the free demo an ad can lead to, never inside the practice app, to measure whether our ads work. We may also confirm to Meta, in hashed form, that a parent account was created, so ad results can be counted. We do not send children's names, profiles, or practice data to Meta or to Google, and children's data is never used for advertising. You can turn this off from your account settings, through your browser's cookie controls, or in Meta's and Google's own ad settings.

You can turn analytics and advertising measurement off at any time from your account settings or through your browser's cookie controls, though blocking necessary cookies may stop parts of the service, such as staying signed in, from working. Because we keep to necessary cookies, privacy-first analytics, and advertising-measurement tags on our marketing pages and free demo, we do not show a separate cookie banner; this notice and our Cookie Policy explain what we collect and how to opt out.

11. How long we keep personal data

We keep personal data only as long as we need it for the purposes in this notice, or as the law requires.

• Account and child-profile data: kept while the account is active, and deleted or anonymised within twelve months after the account is closed, or sooner on request.
• Billing and transaction records: kept for the period Singapore tax and accounting law requires, which is currently five years.
• Analytics data: kept for up to twenty-four months, then deleted or aggregated.

When personal data is no longer needed, we delete it or anonymise it.

12. How we protect personal data

We take reasonable steps to protect personal data against unauthorised access, use, disclosure, loss, and similar risks. These include access controls, encryption of data in transit, passwordless sign-in so there is no StudyLah password to steal, and limiting access to what each role needs. No method of transmission or storage is completely secure, so we cannot promise absolute security, but we work to keep your data safe and to respond quickly if something goes wrong. If a data breach affects you and meets the thresholds under the PDPA, we will notify the Personal Data Protection Commission and affected individuals as the law requires.

13. Your rights

Under the PDPA you may:

• Access the personal data we hold about you and ask how it has been used or disclosed.
• Correct personal data that is inaccurate or incomplete.
• Withdraw consent as described in Section 7.

Parents may exercise these rights for their child's profile. To make a request, contact us at hello@studylah.com.sg. We may need to verify your identity before we act, and we will respond within the timeframes set by the PDPA. Where the law allows a reasonable fee for an access request, we will tell you before we proceed.

14. Children

StudyLah is meant for primary-school children, used through a parent-managed profile as described in Section 3. We design the service to collect as little data about children as possible, we do not use children's data for advertising, and we follow the higher standard of care expected for services likely to be used by children, in line with the PDPC Advisory Guidelines for Children's Personal Data in the Digital Environment.

Where children can be seen by other children, we keep it to the minimum the feature needs. The arcade leaderboards show a nickname, a score and a position, and nothing that identifies a child in the real world. Section 8 explains how to change or clear that nickname.

If you believe a child has given us personal data outside a parent-managed profile, contact us at hello@studylah.com.sg and we will remove it.

15. Changes to this notice

We may update this notice from time to time. When we make a material change, we will update the date at the top and, where appropriate, let you know. Continuing to use StudyLah after an update means you accept the updated notice.

16. How to contact us, and how to complain

For any question or request about this notice or your personal data, contact us at hello@studylah.com.sg.

If you are not satisfied with how we have handled your personal data, you may contact the Personal Data Protection Commission of Singapore (PDPC) at www.pdpc.gov.sg.