This policy explains how TutorDeck Pte. Ltd. ("we", "us") collects, uses, discloses and protects personal data through TutorDeck (the "Service"), in line with Singapore's Personal Data Protection Act 2012 (PDPA).
For the student and payment records you enter, you are the organisation responsible for that personal data under the PDPA, and we act as a service provider (data intermediary) processing it on your behalf and on your instructions. You are responsible for having a proper basis to collect and use that data — including, where the data concerns a minor, the consent of a parent or guardian.
We use personal data only to provide and maintain the Service: to run your account, store and display your records, generate invoices and reminders you initiate, and keep the Service secure. We do not sell personal data.
By creating an account you consent to the collection and use of your account and business data as described here. You may withdraw consent by deleting your account (in Settings) or by emailing us, subject to any records we must keep by law.
Data is hosted on our infrastructure provider, Supabase, on secure cloud servers in Singapore. The website itself is served by Vercel. We share data with third parties only as needed to run the Service, or where required by law. Messages you choose to send (e.g. WhatsApp reminders) are sent through the channel you select, at your instruction.
If you choose to sign in with Google, we receive your name, email address and profile picture from Google to create and run your account.
If you choose to connect Google Calendar, TutorDeck asks Google for permission to:
The events TutorDeck creates contain lesson details you entered in TutorDeck, such as the student's name, subject, level, lesson time, lesson fee and whether it has been paid. Calendar sync runs in your browser: the access Google gives TutorDeck is held only in your browser for the session and is not stored on our servers, and we do not copy your calendar contents into our database.
We use Google data only to provide calendar sync to you. We do not sell it, use it for advertising, share it with anyone else, or use it to train AI models. TutorDeck's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can stop calendar sync at any time by removing TutorDeck's access in your Google Account permissions. Events already added to your calendar stay there until you delete them.
Our database is hosted in Singapore. Some of the providers we rely on (such as Vercel for serving the website and Google for sign-in and calendar sync) may process limited data outside Singapore. Where that happens, we take steps intended to ensure a standard of protection comparable to the PDPA.
We apply reasonable security measures (including access controls and encryption in transit) to protect personal data. We keep data for as long as your account is active or as needed to provide the Service, and delete or anonymise it when no longer needed.
You may request access to, or correction of, your personal data, and ask how it has been used or disclosed. To make a request, contact us at tutordeckadmin@gmail.com.
If a data breach occurs that is likely to result in significant harm, we will notify the Personal Data Protection Commission and affected individuals as required by the PDPA.
Questions about this policy or your data can be sent to our Data Protection Officer at tutordeckadmin@gmail.com.
We may update this policy. Material changes will be notified, and continued use of the Service after changes take effect means you accept the updated policy.
← Back