Privacy Policy

1 Information We Collect

The platform gathers the following types of information:

• Account Information: Name, email address and password for account creation and authentication.
• Usage Data: Platform interactions such as searches, uploads, grading and progress tracking.
• Assessment Data: Test responses, grades, AI-generated feedback and progress analytics.
• Device Information: IP address, device type, operating system and browser version.
• Child Users: Information collected from students under 18 only with explicit parental or guardian consent, as described in Section 3.

2 How We Use Your Information

Personal data is used only for the following specific purposes:

• Providing Services: Deliver grading, feedback and learning recommendations.
• Improving Platform Functionality: Analyse usage to enhance AI performance and overall platform experience.
• Tracking Progress: Provide personalised learning insights for students and parents.
• Support: Respond to inquiries or technical issues.
• Marketing & Communication (opt-in only): Send newsletters, updates or promotional materials only where you have given explicit prior consent. You may withdraw this consent at any time by clicking the unsubscribe link in any email or by contacting us at support@pickytic.ai. We will not send marketing communications to children’s accounts.

We will not use your personal data for any purpose not listed above without first obtaining your consent.

3 Parental Consent & Children’s Privacy

PickyTic is designed for students aged 7–18. Because our primary users are minors, all student accounts must be created and managed by a parent or guardian regardless of the student’s age.

• Parental Account Required: A parent or guardian must create the account, link the student profile and accept these terms on behalf of the student. Students may not register independently.
• Under-13 Enhanced Protection: For students under 13, we apply heightened protections consistent with PDPC advisory guidelines for children’s data, including stricter default privacy settings and no personalised marketing of any kind.
• Explicit Consent: By registering your child, you explicitly consent to the collection and use of their personal data for educational and assessment purposes as described in this Policy.
• Child-Friendly Language: Simple, clear explanations are provided for both children and parents throughout the platform.
• No Dark Patterns: Gamification avoids manipulative designs that pressure children into actions or additional spending.
• Privacy-Protective Defaults: Gamification and data sharing controls are restricted by default for all student accounts.
• Data Access & Correction: Parents or guardians can view, update or delete their child’s data at any time via the account dashboard or by contacting us.
• No Monetisation of Children: Children are never required to pay or unlock premium features through gamification mechanics.

4 Data Protection & Security

We implement robust measures to protect your data:

• Encryption: All data is encrypted in transit (TLS) and at rest (AES-256).
• Role-Based Access: Separated access controls for parents, children, educators and administrators ensure each role can only access data relevant to them.
• Cybersecurity Compliance: Follows the CSA Cybersecurity Code of Practice; hosted on AWS Singapore cloud infrastructure; regular vulnerability assessments conducted.
• Breach Response: A documented response plan is in place. The PDPC and affected users will be notified without undue delay if a data breach results in significant harm or affects more than 500 individuals, in accordance with PDPA mandatory breach notification obligations.

5 Data Retention & Accuracy

We retain personal data only for as long as necessary for the purposes for which it was collected. The following retention periods apply:

• Active Account Data: Retained for the duration of the account and for up to 2 years after the account is closed, to allow for account reinstatement and to comply with any legal obligations.
• Assessment & Progress Data: Retained for the duration of the account. Parents may request earlier deletion at any time via the account dashboard.
• Billing & Transaction Records: Retained for 7 years in accordance with Singapore accounting and tax regulations.
• Support Communications: Retained for up to 2 years from the date of the last communication.

Data is reviewed regularly for accuracy and securely deleted in accordance with the above periods. Data collected is limited to what is strictly necessary, in accordance with the data minimisation principle under the PDPA.

6 AI Transparency & Accountability

• AI Feedback: Our AI generates personalised feedback, learning insights and assessment scores based on student responses.
• Human Oversight: Users may request a human review or appeal AI-generated results within 14 days of receiving them by contacting support@pickytic.ai.
• Fairness & Bias Mitigation: AI models are regularly monitored for accuracy, fairness and equitable grading across different student groups.
• Explainability: Feedback is provided in simple, age-appropriate terms. Scores are learning indicators, not final academic judgments.
• Accountability: PickyTic takes full responsibility for AI system outcomes and adheres to Singapore’s Model AI Governance Framework.
• Third-Party AI: Our AI features are powered in part by third-party AI model providers. Student data submitted for grading or feedback is processed by these providers under strict data processing agreements that prohibit use of the data for any purpose other than providing the service. See Section 7 for details.

7 Sharing Your Information & Third-Party Providers

We do not sell or rent your personal information. Data may be shared only in the following circumstances:

• With Consent: When you have given explicit approval for a specific purpose.
• AI Model Providers: Student responses and assessment data are processed by third-party AI model providers to deliver grading and feedback. These providers are bound by data processing agreements and are prohibited from using your data for training their models or for any purpose beyond providing the service to PickyTic.
• Cloud Hosting: The platform is hosted on Amazon Web Services (AWS) infrastructure located in Singapore.
• Payment Processing: Subscription and payment transactions are handled by Stripe, a globally trusted payment processor. PickyTic does not store card details. Stripe’s privacy policy is available at stripe.com/privacy.
• Other Service Providers: Trusted vendors who assist in operating the platform (e.g., email delivery, analytics) receive only the minimum data necessary to perform their function and are bound by confidentiality obligations.
• Legal Requirements: If required by law, court order or government request under applicable Singapore law.
• Children’s Data: Never shared for marketing purposes, behavioural profiling or with third parties beyond those described above.

Overseas Transfers: Some of the third-party providers described above may process data outside Singapore. Where this occurs, we ensure that appropriate contractual safeguards are in place to provide a comparable level of data protection, in accordance with PDPA Section 26 (Transfer Limitation Obligation).

8 Cookies & Tracking Technologies

We use cookies and similar technologies. These fall into the following categories:

• Strictly Necessary Cookies: Required for the platform to function (e.g., session authentication, security). These cannot be disabled.
• Functional Cookies: Remember your preferences and settings to improve your experience (e.g., language, display preferences).
• Analytics Cookies: Help us understand how users interact with the platform so we can improve it. These are only set with your consent.
• Marketing Cookies: Used to deliver relevant communications. Only set for adult account holders who have opted in to marketing. Never set for student or children’s accounts.

On your first visit to the platform, you will be shown a cookie preference banner allowing you to accept or decline non-essential cookies. You can update your preferences at any time via your account settings or your browser settings. Disabling certain cookies may limit platform functionality.

9 Your Rights

Under Singapore’s PDPA, you have the following rights with respect to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of any inaccurate or incomplete information we hold about you.
• Deletion: Request deletion of your personal data, subject to any legal or contractual retention obligations.
• Data Portability: Request that we transmit your personal data to another organisation in a commonly used machine-readable format, where technically feasible, in accordance with PDPA portability obligations (effective September 2022).
• Withdraw Consent: Withdraw consent for any processing that is based on consent (including marketing communications) at any time. Withdrawal of consent will not affect the lawfulness of processing before withdrawal. Note that withdrawing consent for essential processing may result in the inability to use certain platform features or may require account closure.
• Opt-Out of Marketing: Unsubscribe from promotional messages at any time via the link in any marketing email or by contacting us directly.

To exercise any of these rights, please contact us at support@pickytic.ai. We will respond within 30 days. We may need to verify your identity before processing your request.

10 Legal & Regulatory Compliance

This Privacy Policy is designed to comply with:

• Personal Data Protection Act (PDPA) 2012 and its 2021 amendments, including mandatory breach notification, data portability obligations and the deemed consent framework.
• PDPC Advisory Guidelines on the PDPA for children’s personal data and online safety.
• IMDA Online Safety Principles for platforms serving children and young persons.
• Singapore’s Model AI Governance Framework with respect to AI transparency and accountability.

This Policy applies to all users of the PickyTic platform in Singapore and to overseas users whose data is processed in Singapore.

11 Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements.

• Non-Material Changes: Minor updates (e.g., clarifications, formatting) take effect upon posting. The “Last Updated” date at the top of this page will be revised.
• Material Changes: Changes that materially affect how we collect or use personal data (including changes to third-party providers, new data uses or changes to children’s data handling) will be communicated to registered users by email at least 14 days before taking effect. Continued use of the platform after the effective date constitutes acceptance of the revised Policy. If you do not accept a material change, you may close your account before the effective date.

We encourage you to review this page periodically to stay informed of any changes.

12 Data Protection Contact

PickyTic has designated a data protection point of contact responsible for ensuring compliance with this Privacy Policy and the PDPA. For any data protection queries, requests or concerns, please contact:

• Data Protection Contact: support@pickytic.ai
• Subject line: “Data Protection Request” or “Privacy Concern”
• Response time: We aim to acknowledge your request within 3 working days and resolve it within 30 days.

If you are unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.