Privacy Policy

1. Who We Are

Triune AI Pte. Ltd. is a Singapore-incorporated company (UEN 202611798H) that provides an AI-powered tutoring platform for students preparing for national examinations including PSLE, GCE O-Level, and GCE A-Level.

Our platform, operated at triune-ai.com, delivers personalised learning sessions guided by Dr Julian Sterling, our AI tutor persona, using advanced AI models.

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Parent / Guardian Data

• Full name and email address (for account creation and billing)
• Billing information processed by Stripe (we do not store card details)
• Communication history with our support team

2.2 Child (Student) Academic Data

• Child's full name, preferred name, and school year level
• Child's login email address (used only for platform access)
• Examination target date and enrolled subjects
• Session responses, answers, and performance data across Bloom's Taxonomy levels
• Banyan Shillings, streak data, shield achievements, and learning progress metrics
• Photographs or handwriting submitted for analysis (processed in memory only — never written to disk or database, and never stored)
• AI conversation transcripts with Dr Sterling (retained for continuity of personalised learning)

2.3 Technical Data

• IP address, browser type, device type (for security and fraud prevention)
• Session logs and access timestamps
• Cookies and similar tracking technologies (see Section 9)

3. Purpose of Collection and Use

We collect and use personal data for the following purposes:

• Personalised tutoring: To adapt learning sessions, question difficulty, and study plans to each child's specific strengths, gaps, and examination timeline.
• Account management: To create and maintain parent and student accounts, authenticate logins, and manage subscription billing.
• Parent reporting: To send post-session summaries, trial expiry reminders, and progress updates to parents.
• Platform improvement: To analyse aggregated (anonymised) usage patterns and improve our AI models and question banks.
• Legal and compliance: To comply with applicable Singapore laws and respond to lawful requests from authorities.
• Security: To detect, prevent, and investigate fraud, abuse, or unauthorised access.

We will not use your child's data for advertising, sell it to third parties, or use it to train general-purpose AI models without explicit consent.

4. Disclosure of Personal Data

We share personal data only with the following categories of third parties, each bound by appropriate data protection obligations:

• Supabase Inc. — Database and authentication infrastructure (data stored in Singapore/Asia-Pacific region)
• Anthropic PBC — AI processing for tutoring responses (conversation content sent to Anthropic API; Anthropic's API data is not used to train models per their commercial terms)
• Stripe Inc. — Payment processing (Stripe handles card data; Triune AI does not store card numbers)
• Alibaba Cloud — Transactional email delivery (Singapore region)
• Vercel Inc. — Web hosting and edge infrastructure

We do not sell, rent, or trade personal data. We may disclose data to government authorities or law enforcement if required by Singapore law.

5. Data Retention

• Active accounts: Retained for the duration of the subscription plus 3 years for legal and audit purposes.
• Cancelled accounts: Core account data retained for 3 years from cancellation date, then securely deleted.
• Trial accounts (no subscription): Data retained for 90 days after trial expiry, then deleted.
• Uploaded images / handwriting: Processed in memory and never stored — there is nothing to retain or delete.
• Billing records: Retained for 7 years as required by Singapore accounting law.

You may request earlier deletion — see Section 7 (Your Rights).

6. Data Security

We implement industry-standard safeguards including:

• TLS encryption for all data in transit
• AES-256 encryption for data at rest in Supabase
• Row-level security policies ensuring parent data is isolated per account
• Passwordless sign-in via one-time email codes — there are no passwords stored that could be leaked
• Regular security audits and penetration testing

For a plain-language overview, see our Security & Data Protection page.

No system is 100% secure. In the event of a data breach affecting your personal data, we will notify you within 3 business days as required under the PDPA Notification of Data Breach regulations.

7. Your Rights Under the PDPA

As a data subject under the Singapore PDPA, you have the right to:

• Access: Request a copy of the personal data we hold about you or your child.
• Correction: Request correction of inaccurate or incomplete personal data.
• Withdrawal of consent: Withdraw consent to the collection, use, or disclosure of personal data. Note that withdrawal may result in inability to use the platform.
• Data portability: Request your data in a machine-readable format (where technically feasible).
• Erasure: Request deletion of personal data, subject to our legal retention obligations.

To exercise any of these rights, contact our Data Protection Officer (see Section 10). We will respond within 30 calendar days.

8. Consent

By registering an account on Triune AI, you confirm that you are the parent or legal guardian of the child whose data you provide, and you consent on behalf of that child to the collection and processing of their academic data for personalised tutoring as described in this policy.

Children may not register accounts independently. Student login credentials are created by parents and used only for platform access.

9. Cookies and Tracking

We use the following types of cookies:

• Essential cookies: Required for authentication and session management (cannot be disabled).
• Analytics cookies: Anonymous usage analytics to improve the platform. You may opt out via your browser settings.

We do not use advertising or cross-site tracking cookies.

10. Data Protection Officer

Our appointed Data Protection Officer (DPO) can be contacted at:

You also have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) at pdpc.gov.sg if you believe we have not handled your data appropriately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to you by email at least 14 days before taking effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.