Privacy Policy
SmartTutor Privacy Policy
Last updated: 27 July 2026
This Privacy Policy is issued by AETHERGATE AI PTE. LTD. (UEN: 202630662K, “we”) and explains how your personal data is collected, used, disclosed, stored and protected when you use the Platform. We comply with Singapore's Personal Data Protection Act 2012 (PDPA) and its subsidiary regulations. Please read it carefully before using the Platform.
1.Scope
This Policy applies to all access to and use of the SmartTutor platform (including https://smarttutor.sg and its subdomains, APIs and services). Where personal-data content in other Platform rules conflicts with this Policy, this Policy prevails.
2.Data Controller
The personal data you submit is processed by AETHERGATE AI PTE. LTD. as the data controller defined under the PDPA. For any question, request or complaint, contact us via the “Data Protection Officer (DPO) contact” at the end of this Policy.
3.Personal Data We Collect
To provide matching and related operational services, we collect the corresponding categories of personal data according to your user role (Tutor / Parent) and the features you use.
3.1Personal data of Tutor users
- Identity: name, display name, gender, age range, nationality / residency status, phone, email, profile photo
- Education and credentials: highest qualification, school of graduation, results / certificate summaries, years of teaching experience
- Teaching profile: subjects, levels, availability, lesson modes, service areas, hourly rate range, teaching-style tags, kinds of students you teach best
- Uploaded supporting documents: copies of identity documents (where applicable), graduation certificates, teaching credentials and other verifiable files
- Account credentials: email and (where applicable) hashed password digest; if you sign in with Google, the corresponding Google account ID and tokens (see Section 5)
- Operational communications: messages with our operations team, review notes and matching feedback
3.2Personal data of Parent users and Students
When Parents submit a request, they submit information on behalf of the Student. We classify and handle Student information under the rules below.
- Parent's own information: name, phone, email, preferred contact method, locality
- Student information: level, school (optional), gender (optional), description of current learning situation, weak points and goals, lesson length preference, budget range
- Matching information: tutor preferences, willingness to do trial lessons, feedback on recommendations
3.3Automatically collected data
- Device and browser information: IP address, browser type and version, OS, screen size, language preference
- Usage logs: page visits, click events, recommendation impressions and interactions, form-submission timestamps
- Cookies and similar technologies: session cookies, login-state cookies, essential security cookies (see Section 9)
- Security signals: human-verification signals collected through services such as Cloudflare Turnstile (see Section 5)
4.How We Use Your Personal Data
We will not use your personal data for purposes outside those agreed, without your consent or unless permitted / required by law; we use your data only for the following purposes:
- Matching services: matching, recommending and introducing Tutors and Parents based on submitted information
- Account management: registration, sign-in, security protection, password and session management
- Operations and improvement: review and human screening, recommendation analytics, product iteration
- Communications: sending service-related notifications, review outcomes, matching feedback, policy updates
- Security and anti-abuse: preventing account takeover, bot abuse, fraud and circumvention
- Compliance: cooperating with lawful disclosures required by law or competent authorities
- Introduction Fee settlement: invoicing and collecting the Introduction Fee from Parents on Successful Matches, and reconciling the fee base and receipts with Tutors
5.Disclosure to Third Parties
We share your personal data with third parties only in the situations below, and only to the minimum extent necessary to achieve the purpose.
5.1With other Platform users
To complete matching, we display non-sensitive Tutor information (e.g. display name, teaching background, teaching style, rate range) to matched Parents. A Tutor's contact details are exchanged only after both parties confirm a match and are not publicly displayed.
5.2With service providers (data processors)
To keep the Platform running, our third-party providers are all bound by contract to protect your data to a standard no lower than this Policy:
- Google LLC: third-party sign-in (OAuth). Data involved: your Google account ID, email, name and profile photo. See Google's Privacy Policy.
- Cloudflare, Inc.: site acceleration, security protection and human verification (Turnstile). Data involved: IP address, browser fingerprint and human-verification signals. See Cloudflare's Privacy Policy.
- Hosting and database providers: server and database hosting required to run the Platform; may involve all of your account and matching-related data.
- Email-sending providers (where applicable): used to send account notifications, review outcomes and similar system emails.
5.3Where required by law or to protect legitimate interests
In the following situations, we may disclose your personal data to the extent reasonably necessary:
- Where required by Singapore law, regulation or by a court or competent authority
- To prevent, investigate or address fraud, security incidents or breaches of this Policy or our Terms of Service
- To protect the personal safety or property of users, third parties or the public
- In the context of a merger, acquisition, restructuring or asset transfer, to the relevant counterparties (who must agree to handle your data to a standard no lower than this Policy)
6.Data Retention
We retain personal data only for as long as necessary to fulfil the purposes of this Policy, following the retention principles below:
Active account: we retain your account and related business data.
After deregistration: identifiable personal data is deleted or anonymised generally within 30 days; financial records required by law (such as commission settlement records) are typically kept for at least 5 years, except the minimum records needed to handle disputes.
Student data: parents may request deletion of their child's information at any time and, save where retention is required by law, it will be completed within a reasonable period.
7.Cross-Border Transfers
The Platform mainly serves users in Singapore. As some third-party providers use global data centres, some personal data may be transferred outside Singapore for processing. All cross-border transfers follow the PDPA's “comparable protection” requirement to ensure comparable protection abroad.
8.Your Rights under the PDPA
Under Singapore's Personal Data Protection Act (PDPA), you have the following rights. You may submit a request via the DPO contact at the end of this Policy, and we typically respond within 30 days. Data access and correction requests may incur a reasonable cost fee, notified in advance if charged.
- **Access**: you may request a copy of the personal data we hold about you and the parties to whom that data has been disclosed
- **Correction**: you may request correction of personal data we hold about you that is inaccurate or incomplete
- **Withdraw consent**: you may withdraw any prior consent to a particular processing; this may affect the availability of related features
- **Deletion**: you may request deletion of some or all of your personal data; we will give effect to such requests to the extent permitted by law
9.Cookies and Similar Technologies
We use cookies and similar browser-storage technologies to maintain login state, provide security protection and optimise the basic experience.
Our cookies fall broadly into the following categories:
- **Essential cookies**: required for sign-in, CSRF protection, human verification and similar core functions. Disabling these cookies will break parts of the Platform.
- **Functional cookies**: used to remember your preferences, e.g. language setting.
- **Security cookies**: set by services such as Cloudflare to identify and block malicious traffic.
You can manage or delete cookies through your browser settings, but this may affect some Platform functions.
10.Security Measures
Matching the sensitivity level of the data, we adopt reasonable technical and organisational measures to protect your personal data, including:
- Transport encryption: HTTPS / TLS for site traffic
- Storage encryption: AES-256-GCM encryption for sensitive credentials including OAuth tokens
- Access control: least-privilege restrictions on internal access to personal data
- Anti-abuse protection: Cloudflare and similar services to defend against common web attacks and bots
- Audit logs: retained for sign-in events and key operational actions
- Staff and provider training: confidentiality obligations for personnel handling personal data
No internet transmission or storage is absolutely secure. If a personal-data security incident occurs, we will notify you and the relevant authority in the manner and within the time required by the PDPA.
11.Children and Minors (important)
The Platform is not intended for minors under 18. Students should not register accounts or submit personal information themselves.
All Student information must be submitted by a parent or lawful guardian on the Student's behalf, with the Student's age-appropriate consent; the parent is primarily responsible for the truthfulness and lawful authority of the information submitted.
We protect Student information to an equal or higher standard, and parents may request access, correction or deletion of their child's information at any time. If we find an account used independently by a minor without a guardian, we will promptly suspend it and delete the related information.
12.Third-Party Links and Services
The Platform may contain links to third-party sites or services; this Policy does not apply to third-party sites. We recommend reading the relevant site's privacy policy before visiting.
13.Changes to this Policy
We may update this Policy in response to legal requirements, product iteration or operational needs. Routine updates are notified by Platform announcement or account email; material changes to core data processing are notified at least 30 days in advance. If you do not accept a change, you may close your account before it takes effect.
14.Data Protection Officer (DPO) and Contact
As required by the PDPA, we have designated a Data Protection Officer (DPO) to handle all queries, requests and complaints relating to personal data.
- Data Protection Officer: the Data Protection Officer designated by AETHERGATE AI PTE. LTD.
- Email: admin@smarttutor.sg
- Mailing address: AETHERGATE AI PTE. LTD., 68 Circular Road, #02-01, Singapore 049422, marked “For the attention of the Data Protection Officer”
We will respond within a reasonable period. If you believe our data processing violates the PDPA, you may lodge a complaint with the Personal Data Protection Commission (PDPC); see https://www.pdpc.gov.sg.