Last updated Sat Oct 31 2026 00:00:00 GMT+0000 (Greenwich Mean Time)

Privacy Policy

Draft prepared for review — have a Singapore lawyer review before publishing.

Privacy Policy

This policy explains what personal data micro.sg collects, why, and what you can do about it. We follow Singapore’s Personal Data Protection Act 2012 (PDPA) and the PDPC’s guidance.

Who we are: micro.sg is operated by [Legal entity name, UEN] (“we”, “us”). Data Protection Officer (DPO): [DPO email, e.g. privacy@micro.sg]

1. What we collect

  • Account and onboarding: name, email, school, JC year, grade goal, and how much time you plan to study each day.
  • Learning progress: steps completed on the roadmap, XP, streaks and similar activity.
  • AI tutor conversations: what you type to Cateris and her replies.
  • Uploaded essays: essays you submit for live marking (“script surgery”).
  • Classes: class bookings and attendance. If you join a live class, your name, voice, video and chat may appear in the class and in its recording.
  • Payments: Stripe handles card details. We only store your Stripe customer and subscription IDs, subscription status, and the payer’s email. We never see or store full card numbers.
  • Guest cookie ID: if you use micro.sg without signing in, a random ID so your progress can be saved.
  • Usage analytics: pages visited, features used, device and browser type.

2. Why we use it

We use your data to run your account and save progress; personalise your roadmap; answer questions through the AI tutor; run classes, mark essays and give members access to recordings and the Telegram group; take payments; send service emails (sign-in links, receipts, class reminders); improve micro.sg; and keep it secure and meet legal, tax and accounting duties.

We only use your data for these purposes, or for new purposes we tell you about and get consent for where required.

By creating an account or using micro.sg, you consent to us collecting, using and disclosing your data as described here.

Withdrawing consent: email our DPO at any time. We will explain the consequences (for example, we may not be able to keep running your account without certain data) and act on your request within a reasonable time.

4. Students under 18 and parents

Most of our users are JC students aged 16–19, so many are under 18.

  • Under 13s should not register. If we learn that a child under 13 has created an account, we will delete it.
  • Students aged 13 and above can generally consent for themselves under PDPC guidance, but we take extra care: we collect only what we need and do not use students’ data for third-party advertising.
  • Parents and guardians may contact our DPO about their child’s data, including to ask for access, correction or deletion.
  • Payments: the paid tier is usually paid for by a parent or guardian. If you are under 18, please get a parent or guardian’s permission before subscribing. The payer’s email is stored with the subscription.

5. The AI tutor (Cateris)

Cateris is powered by Anthropic’s Claude, accessed through an API. When you chat with Cateris, your messages (and relevant context, such as the topic you are studying) are sent to Anthropic so it can generate an answer.

  • Do not share sensitive personal data with the AI tutor, such as your NRIC number, health information, passwords, or details about other people.
  • micro.sg does not use your AI tutor conversations to train AI models. Under our agreement with our AI provider, conversations sent through the API are processed to provide the service to us, not to train the provider’s models.
  • We may review conversations to fix errors, improve answer quality and keep the service safe.

6. Who we share data with

We do not sell your personal data. We share it only with service providers who help us run micro.sg, and only as needed:

Supabase (database and sign-in, Singapore region), Fly.io (app hosting, Singapore region), Cloudflare (network and security), Stripe (payments), Anthropic (AI tutor), PostHog (analytics), Resend (emails), Bunny Stream (class recordings), YouTube (public videos), Zoom (live classes) and Telegram (members’ group).

We may also disclose data if the law requires it, or to protect the safety of users or others.

Telegram and Zoom: other participants can see your display name and anything you share. These apps also apply their own privacy policies.

7. Transfers outside Singapore

Our main database and app servers are in Singapore. Some providers (for example Anthropic, PostHog, Resend, Stripe, Cloudflare, Bunny, Zoom and Telegram) may store or process data in other countries. When data leaves Singapore, we take steps required under the PDPA’s Transfer Limitation Obligation to make sure it gets protection comparable to the PDPA, such as contracts with data protection terms.

8. Cookies

  • Essential sign-in cookie: keeps you signed in. The site will not work properly without it.
  • Guest ID cookie: a random ID that saves progress for signed-out visitors.
  • Analytics cookies (PostHog): help us understand how micro.sg is used. [Decision: state whether analytics runs only after cookie consent, or by default with an opt-out.]

You can clear or block cookies in your browser settings, but parts of micro.sg may stop working.

9. Marketing

Service emails are part of running your account. We only send marketing (such as promotions or new courses) if you opt in. Every marketing email has an unsubscribe link, or you can opt out by emailing our DPO.

We do not send marketing to Singapore phone numbers by call, SMS or messaging app. If we ever do, we will follow the PDPA’s Do Not Call rules.

10. Access and correction

You can ask us:

  • what personal data we hold about you, and how it has been used or disclosed in the past year; and
  • to correct data that is wrong or incomplete.

Email our DPO. We aim to reply within 30 days, or tell you when we can. We may charge a reasonable fee for access requests and will tell you first.

Accuracy: please keep your details up to date; we make reasonable efforts to keep the data we use accurate.

11. How we protect your data

We use reasonable security measures such as encrypted connections, access controls and limited staff access. No system is completely secure, so keep your sign-in details private.

Data breaches: if a breach is likely to cause significant harm to you, or affects a large number of people, we will notify the PDPC within 3 calendar days of deciding it is notifiable, and notify affected individuals as required by the PDPA.

12. How long we keep data

We keep data only as long as we need it for the purposes above or as the law requires. Proposed defaults, to be confirmed:

  • Account, onboarding, progress, bookings and attendance: while your account is active + 2 years
  • AI tutor conversations: 12 months
  • Uploaded essays: 12 months
  • Payment and billing records: 5 years (tax and accounting)
  • Class recordings: [To confirm]
  • Guest cookie data: [To confirm, e.g. 12 months of inactivity]
  • Analytics data: [To confirm, per PostHog settings]

You can ask us to delete your account at any time by emailing our DPO. We will delete or anonymise your data, except where we must keep it by law (for example, payment records).

13. Changes to this policy

We may update this policy and will tell you about significant changes by email or on the site.

14. Contact us

Questions, requests or complaints: [DPO email, e.g. privacy@micro.sg] [Legal entity name, UEN]

If you are not satisfied with our response, you may contact the Personal Data Protection Commission (PDPC).