Privacy Policy

Vocabulous! Privacy Policy

Effective date: 3 September 2026

Last updated: 3 September 2026

1. Introduction

Vocabulous! Education Pte. Ltd. — "Vocabulous!", "we", "us" — operates an online vocabulary tutoring platform. We take the privacy of our students, their parents, and our tutors seriously, and we have written this policy to explain plainly what we collect, why, who else sees it, how long we keep it, and what you can do about it.

This policy applies to the Vocabulous! related products. It does not apply to external websites we may link to.

We handle personal data in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA"). Because most of our users are children, we also apply the stricter protections set out in the PDPC's guidance on children's personal data and in the US Children's Online Privacy Protection Act ("COPPA"), even where those do not legally bind us. Where they go further than the PDPA, we follow the stricter standard.

By creating an account or using the platform, you agree to this policy. If your child is under 13, we will not collect anything from them until you have given consent — see section 5. We may update this policy from time to time; the date above always shows when it last changed.

If anything here is unclear, email dpo@vocabulous.sg for clarification.

2. What information do we collect?

Information you give us

If you are a parent of a child under 13. You give us your own name, email address, and a password when you create your account. You then create an account for your child, which holds their name, a username you choose for them, their date of birth, and a numeric PIN of six to nine digits that they use to sign in. We do not collect an email address, phone number, or home address from a child, and a child cannot create an account on their own. We also keep a record of your consent — that it was given, when, and from which account — because we must be able to show it existed.

If you are a student aged 13 or over. You give us your name, email address, date of birth, and a password. As you use the platform you also provide learning information: your responses to questions about how you learn, your assessment results, and any assignments you hand in, including documents, photos, or video. So that we can choose vocabulary that suits you, we ask for the language spoken at your home, your English vocabulary level, the topics that interest you, your daily goal, your country, your class or year group, and your school if you have one.

If you are a child under 13, we collect the same learning information described above. The only difference is that your parent, not you, holds the email address on the account.

If you are a tutor. You give us your login details, your profile, your qualifications and certifications, evidence of your right to work, a profile photo, and any introductory video. If you take payment through the platform, you give us your bank or payout account details.

We also need to verify your identity. If you verify through Singpass, you authorise us to retrieve the following from Myinfo, the Singapore Government's verified personal data service: your legal name, email address, sex, nationality, residential status, pass type, pass status and pass expiry, race, dialect, and date of birth. You cannot edit these, because they come from the Government rather than from you. We do not retain your NRIC or FIN number. If you cannot use Singpass, you declare the same information yourself; we store self-declared information separately and clearly marked, so that it is never mistaken for a verified fact.

If you are a school, CCA host, or community partner. You give us your organisation's name, the name and role of the person responsible, a contact email, and the supervising teacher's name, email, and phone number.

Everyone. Messages you send other users on the platform are stored, including any files attached. Reviews and testimonials you post appear publicly with your name, so please consider what you include. Reports or complaints you submit about another user are stored and reviewed by our administrators.

Information we collect automatically

When you use the platform we record your IP address and information about your device and browser. We use these to limit repeated sign-in attempts from the same source, and to investigate reports of misuse.

We also record how the platform is used: which words a student saw, when, and how well they recalled each one. This is what allows us to bring a word back at the right moment for revision, which is how vocabulary is learned. It is not used to build a profile of anyone.

We use cookies to keep you signed in and to remember your language and timezone. See section 7.

What we never collect

We never collect precise location. It is switched off. We hold the country you tell us, and an approximate location derived from your IP address for security purposes only.
We never collect advertising identifiers, and we set no advertising or cross-site tracking cookies.
We never receive your full payment card number. Card details go directly to our payment provider and do not reach us.
We never access your contacts, photo library, or microphone without your permission, other than what you explicitly consent to.
We never see your activity on other websites.
We never collect biometric identifiers.

3. What do we do with your information?

We use personal data only for the purposes set out below, and we will ask you first if we ever want to use it for something else.

To create and run accounts and lessons. To set up and secure accounts, match students with tutors, schedule and run lessons, build lesson plans, mark work, and let students and tutors message one another.

To personalise the learning path. We use the details you give us — language spoken at home, vocabulary level, interests, daily goal, country, and class or year group — together with a student's answers and revision history to adjust the difficulty of lessons and exercises as a student improves or struggles, to put together vocabulary and grammar exercises suited to that student, and to recommend which learning module or story to take next. This decides what a student is taught. It is not used to build a commercial or behavioural profile of a child, and it is not used to make any decision about a person outside their learning.

To track and report progress. We use assessment results, quiz answers, and revision history to produce learning reports, to show how your grasp of vocabulary has changed over time, and to display progress measures. Section 4 sets out exactly who those reports are shown to.

To keep the platform and its students safe. We use IP address and device information to limit repeated sign-in attempts from the same source and to investigate reports of misuse.

To meet our legal and financial obligations. We use payment information to take payments, pay tutors, handle refunds, keep tax records, and meet our obligations under Singapore law.

To be explicit about what we do not do:

We do not sell or rent personal data, to advertisers, data brokers, or anyone else.
We do not serve behavioural or targeted advertising, to children or to adults.
We do not build commercial or behavioural profiles of children.
We do not make automated decisions about a person that carry legal or similarly significant effects.

4. Who can see your information?

We do not sell your personal data, and we never will.

Inside the platform

Access inside Vocabulous! is decided by role. Nobody sees a student's information simply because they work here or teach here.

The student sees their own profile, lessons, work, progress, and messages.
The parent or guardian of a child under 13 sees everything we hold about their own child, including assessment results and progress reports.
The tutor teaching that student sees what is needed to teach them: name, age, learning preferences, lesson history with that tutor, assessment results, work handed in, and progress. A tutor cannot see students they do not teach, and never sees payment or card details.
A supervising teacher or CCA coordinator, where a student takes part in a programme run with their school or a community partner, sees attendance, assessment results, and progress for the students in that programme only. They do not see payment information, private messages, or anything about a student outside that programme.
A school or partner administrator sees the same programme information, for running and reporting on the programme they are responsible for.
Our staff see personal data only where a person's role requires it — to answer a support request, investigate a report, or fix a fault. Access is granted on a need-to-know basis.

A student's profile is not public. Their name, work, and progress are never shown to other students or to visitors to the site. Tutor profiles are public: a tutor's profile, qualifications, introductory video, and the reviews written about them can be seen by anyone looking for a tutor.

Outside the platform

We use a small number of service providers to run the platform. They fall into these categories, and each receives only the information it needs to do its job and nothing more:

Hosting and database services, which store the platform and the information in it.
File and media storage, which holds uploaded documents, images, audio, and video.
Video conferencing services, which run live lessons and receive a participant's name and the details needed to join a session.
Email delivery services, which send account and service emails and receive the recipient's name, email address, and the content of the message.
Payment processing services, which handle payments and tutor payouts.
Government identity verification services, used to verify a user's identity.

Every provider works under a written agreement requiring it to use the information only for the purpose we specify, to protect it to a standard comparable to our own, and to delete it when we tell it that a user has been deleted.

We may also disclose personal data where we are required to do so by law, by a court, or by a regulator; where it is necessary to investigate a report of harm or a breach of our terms; or where it is necessary to protect the safety of a child or another person.

Transfers outside Singapore. Some of our providers operate outside Singapore. Where personal data is transferred abroad, we do so only under contractual terms requiring a standard of protection comparable to that under the PDPA, as section 26 of the PDPA requires.

5. How do we protect children's privacy?

Most of our students are children, so this section matters more than any other.

Under 13. We require verifiable consent from a parent or guardian before we collect anything at all from a child under 13. This is required by section 13 of the PDPA, and it is the standard COPPA sets.

13 to 17. Under the PDPC's guidance a young person of this age can usually consent for themselves, provided they understand what they are agreeing to. That is what happens where they hold their own account. Where a child of this age is on a parent-managed account, their parent or guardian consents on their behalf instead — we do not ask the child separately, so we do not pretend to rely on their consent. See section 6.

18 and over. Consents for themselves. A parent cannot give consent on behalf of an adult, and we do not record one.

6. For parents

How consent is given. You create your own account and add each child's details. Before anything is saved, you see every child on one review screen. For each child you tick three things separately:

that you are that child's parent or guardian;
that you consent to our collecting their information;
that you agree their one-to-one lessons are recorded.

You then confirm that you have read this policy and the Terms of Service. The accounts are created only after that.

We do not treat reaching that screen as agreement. If a child's consent is not recorded, that child's account is not created. If any part of the sign-up fails partway, the whole registration is undone — you are never left with a half-made account.

Why you cannot decline any of them. Each statement is shown separately so you can see exactly what you are agreeing to, and so we hold a record of each one. They are not optional. We cannot teach a child whose information we are not allowed to collect, and we cannot run a one-to-one lesson unrecorded, for safeguarding reasons. If you do not agree to all three, we do not create the account. We would rather say that plainly than offer you a choice we cannot honour.

What we store as proof. For each child under 18 we keep two records: your consent, as their parent or guardian, to our collecting their information, and your agreement to lesson recording. For you we keep your agreement to this policy and the Terms of Service. Each record carries the date and the account it came from, because we must be able to show that consent existed.

Children aged 13 to 17. Under the PDPC's guidance a young person of 13 or over can usually consent for themselves, and that is what happens when they hold their own account. On a parent-managed account we take your consent instead, because the child does not hold the account and we do not ask them separately. To be clear about what that is: it is your consent, given on their behalf — not theirs.

Withdrawing consent. You can withdraw at any time, either from your child's page in your dashboard or by emailing dpo@vocabulous.sg. We tell you exactly what will happen before you confirm it.

When you withdraw consent for a child:

that child's account closes straight away, and they can no longer sign in;
your own account stays open. This is true even if that child was the only one on your account — we do not close a parent's account because they have withdrawn for their last child;
any other children on your account are unaffected. Withdrawing for one child does nothing to a sibling.

You cannot undo this yourself. There is no way to reopen a closed child account by signing in, and no way for you to restore it from your dashboard. If you withdraw by mistake, email dpo@vocabulous.sg as soon as you can. What we hold is kept for the period set out in our data retention policy, and deleted at the end of it.

What you can do from your dashboard. On your child's page you can:

see the consent records held for that child, and withdraw any of them;
download everything we hold about them, as a file you can keep;
change their display name and their PIN;
close their account.

Their date of birth, school, and year group cannot be edited in the product yet. Email dpo@vocabulous.sg and we will correct them for you.

How we check it is really you. Anything you do from your signed-in parent dashboard happens immediately, because holding that account is what identifies you as the parent. If you email us instead, we will confirm that you are that child's parent before we act — the alternative, a stranger obtaining a child's records by sending an email, is worse. We aim to answer within 15 days and will never take longer than 30.

Where to read more. This policy, the Terms of Service, and the data retention policy are all linked from the sign-up screen where you give consent, so you can read them before you agree rather than afterwards.

7. How do we use cookies?

We use two kinds of cookie, and no others.

Essential cookies keep you securely signed in and keep your session working. These cannot be switched off without breaking the login. Preference cookies remember your timezone and your choice of language, so that lesson times display correctly and the site appears in the language you chose.

We use no advertising cookies, no cross-site tracking cookies, and no third-party advertising pixels. We do not send your activity to any outside analytics or measurement service. We measure how the platform is used from our own records, described in section 2, and not by tracking you across the internet.

You can manage your choice through the cookie banner, which offers "Essential Only" and "Accept All", or through your browser settings. Choosing "Essential Only" deletes the preference cookies and does not remove access to lessons.

8. What control do you have over your information?

Under the PDPA you have the following rights. Parents have additional controls over a child's account, set out in section 5.

Access. You can download a copy of your data at any time using the export feature in your account settings, or ask us for it.

Accuracy. We make reasonable efforts to keep the personal data we use accurate and complete, and we ask you to keep your own details up to date, because a decision about a lesson or a report about a child is only as good as the information behind it.

Withdrawal of consent. You can withdraw consent for a particular purpose at any time. We will explain what it affects before we act on it.

Deletion. You can delete your account from your settings. This removes your profile, messages, files, and learning data.

Portability. The export provides your information in a machine-readable format you can take elsewhere.

To exercise any of these, use your account settings or email dpo@vocabulous.sg.

9. How do we keep your information secure?

We protect personal data with administrative, technical, and physical safeguards appropriate to how sensitive it is. Information is encrypted in transit and at rest. Passwords and children's PINs are cryptographically hashed and cannot be read by anyone at Vocabulous!, including our own engineers. Staff access is granted only on a need-to-know basis and is limited to what a person's role requires, and certain sensitive actions, such as exporting a user's data, are recorded in an audit log.

No method of storing or transmitting information is completely secure, and we cannot guarantee absolute security. What we can commit to is this: if a data breach occurs that is notifiable under the PDPA, we will notify the Personal Data Protection Commission within 3 calendar days of assessing it as notifiable, and we will notify affected users — and, for a child, their parent — as soon as practicable, telling you what happened, what information was involved, what we have done, and what you should do. Where a child's own information is affected and they are old enough to understand, we will write to them separately in language appropriate to their age.

10. How long do we keep your information?

We keep personal data only for as long as it serves the purpose it was collected for, or as long as the law requires.

Account information is kept while your account is open. If you ask us to delete your account, we close it immediately and you cannot sign back in. We then hold what remains for 7 months, and delete it permanently at the end of that period. If you closed your account by mistake, email dpo@vocabulous.sg as soon as you can. We will do what we can, but we cannot promise that an account can be reopened.

A child's account is different in one way. If a parent withdraws consent, the child's account is closed and the child cannot reopen it by signing in. A parent cannot restore it from their dashboard either — if consent was withdrawn by mistake, contact us as soon as possible.

Learning information such as session records, lesson plans, assessments, and quiz results, is kept for the duration of the student's account and 12 months afterwards. Messages are kept for 24 months from the last message in a conversation. A tutor's identity documents and certifications are kept for the duration of the tutor's account and 90 days afterwards, then securely deleted. Records of parental consent are kept for the duration of the child's account and 24 months afterwards. Short-lived items such as password reset links and verification codes are purged automatically when they expire.

Financial records are the one exception. Singapore tax law requires us to keep transaction records for 7 years. If you delete your account, we anonymise them rather than keeping them intact: the name becomes "Deleted User", the email address is replaced by an irreversible hash, and phone number, address, date of birth, and parent contact details are erased. What survives is an amount and a date, which cannot identify anyone. Public reviews are anonymised the same way.

When you delete an account, the deletion extends to your profile, messages, uploaded files, authentication tokens, and learning records — not only the record that makes the account visible. Deleted information may persist for a limited period in encrypted backups until those backups are rotated out of the cycle. We do not restore deleted personal data into the live platform.

11. What about links to other websites?

The platform may contain links to websites we do not operate. This policy does not apply to them. We are not responsible for their content or their privacy practices, and we encourage you to read the privacy policy of any site you visit from ours.

12. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The date at the top of this page always shows when it last changed.

Where a change is significant — a new category of information, a new purpose, or a new category of recipient — we will notify you by email or through the platform before it takes effect. Where the change affects a child's information, we will ask for parental consent again rather than assuming that earlier consent carries over.

13. How to contact us

Accountability. We have appointed a Data Protection Officer and put internal policies and training in place to meet our obligations under the PDPA, and we are accountable for the personal data in our care — including data handled on our behalf by the service providers described in section 4.

Vocabulous! Education Pte. Ltd.

Data Protection Officer: dpo@vocabulous.sg

General enquiries: info@vocabulous.co

Please put "Personal Data Request" in the subject line so we can route it correctly. We respond within 15 days wherever possible, and always within 30.