How Spark handles your data

1. Who we are

Spark (sparkthetutor.com) is an AI study tutor for Singapore students, currently in a free public beta. This notice explains how we handle personal data under Singapore’s Personal Data Protection Act 2012 (PDPA).

For anything about your data — access, correction, deletion, withdrawing consent, or a complaint — email hello@sparkthetutor.com. That address is also our data protection contact.

2. What we collect

• Account: your email address and sign-in method. If you use Continue with Google, Google also passes us your name and profile picture link, which our sign-in provider stores with your account.
• Profile: whether you are a student or a parent, a display name, and a grade band.
• Consent record: the age band you chose (13 or over, or under 13), the version of this notice you agreed to and when. For an under-13: the parent or guardian email you gave, and when and to which version they agreed.
• Lessons: the messages you type, the text of what you say, the tutor’s replies, session titles and summaries, hint levels, and your whiteboard drawings (strokes and text cards).
• Uploads: photos and PDFs you add to a session. We store the file, and for a PDF the text we extract from it.
• Voice: when you hold the mic, the clip is sent to be transcribed. We keep the text; we never store the audio.
• Progress: mastery per skill, and the record of attempts, hints and explanations it is worked out from.
• Safety and quality counts: per session, how many messages tripped the safety filter and how many replies our answer-leak check flagged.
• Guardian links: which guardian account is linked to which student, and short-lived link codes.
• Technical: sign-in cookies, a few small functional cookies (your starting subject, why you are here, a guardian link code for ten minutes, and a consent hold while a parent confirms), voice settings saved in your browser, and server logs that record ids, timings, error codes and rule names — never the text you wrote or the content of a file. Our hosting providers see IP addresses as part of delivering the site. We also keep anonymous daily totals of which site buttons are pressed, with no cookie, id or IP address attached.
• Emails you send us, and our replies.

We do not use advertising, we do not sell or rent personal data, and there are no third-party trackers or analytics scripts on the site.

3. Why we use it

• To run tutoring sessions: generate the tutor’s replies, read your board and uploads, and transcribe speech.
• To keep your work so you can return to it, and to track progress and suggest what to practise next.
• To show a linked parent or guardian your work and progress (see section 5).
• To keep sessions safe: filter unsafe messages, flag replies that give away answers, and count both.
• To keep the service secure and working: sign-in, rate limits against abuse, and fixing errors from logs.
• To get parental consent for under-13s, and to answer your emails and data requests.

4. Who receives it

We use these service providers. Each gets only what its job needs:

• SoCLaaS, the language-model service run by the National University of Singapore School of Computing. It writes the tutor’s replies and transcribes voice. It receives your messages and recent conversation, the session’s topic and your progress on it, pictures of your whiteboard, uploaded photos, extracted PDF text, and voice clips. It does not receive your name or email address.
• Supabase — sign-in, our database and file storage. It holds everything we store, listed in section 2, and sends our sign-in emails (and, unless we use Resend, the parental confirmation email).
• Render — hosts the servers that run Spark. Every request passes through it, and it keeps our server logs.
• Cloudflare — domain name service and network delivery. It handles traffic, including IP addresses, on its way to Render.
• Google — only if you choose Continue with Google, to confirm who you are.
• Resend — if it is switched on, it sends the parental confirmation email; it receives the parent’s email address and the link.

We do not use your content to train AI models. We are confirming in writing how long SoCLaaS keeps request data during the beta, and will update this notice when we have that.

5. Parents and guardians

A student can link a parent or guardian account by giving them a one-time code. Once linked, the guardian can read the student’s full transcripts, uploaded files and whiteboards, as well as session summaries, mastery, and the counts of safety and flagged replies. Guardians cannot change anything.

A student can remove a linked guardian from their Progress page, and the guardian’s access ends then.

6. Children under 13

Spark is built for students, many of them under 13. When someone says they are under 13, their account stays locked until a parent or guardian agrees: we email the parent a single-use link that expires after 7 days, and the account opens only when the parent presses Confirm. If we cannot send that email, the family can confirm by writing to hello@sparkthetutor.com from the parent’s address.

A parent or guardian can ask us at any time to show, correct or delete their child’s data, or withdraw consent, by emailing hello@sparkthetutor.com.

7. Data stored or processed outside Singapore

SoCLaaS is operated in Singapore. Supabase, Render, Cloudflare, Google and Resend are companies based outside Singapore, and may store or process data in other countries. When we use them we rely on their data processing terms, which commit them to protect personal data to a standard comparable to the PDPA.

8. How long we keep it

• Your account and its lessons, uploads and progress: for as long as the account exists.
• A session you delete (from Account and data): its messages, board and files are removed straight away.
• A file you remove from a session: the stored file is deleted.
• Voice audio: not stored by us at all.
• When you delete your account, everything above is removed from our live database and storage immediately, and any copies left in our database provider’s backups expire within 30 days.
• Server logs (ids and error codes, no content) are kept by our host for a limited period and then deleted.

9. Your choices and rights

• Access and correction: email hello@sparkthetutor.com for a copy of your data or to fix something wrong. You can change your name and grade at any time in the app.
• Deletion: delete a session, or your whole account, from Account and data once signed in — or email us and we will do it.
• Withdrawing consent: deleting your account withdraws it. If you would rather we stop and delete without signing in, email us.

We aim to reply to data requests within 30 days. If you are not satisfied with our answer, you can contact the Personal Data Protection Commission (pdpc.gov.sg).

10. Security

Traffic is encrypted, uploaded files are kept in private storage, and the database only lets each account read its own records (and a linked guardian read their student’s). Lesson data is written only by our servers. No system is perfectly secure; if a breach affects your data we will tell you, and the Commission where the PDPA requires it.

11. Changes to this notice

This is the beta version of the notice. When it changes we update the version and date at the top, and for significant changes we tell account holders in the app. Questions: hello@sparkthetutor.com.