Privacy Policy

We are a company incorporated in Singapore. By creating an account or using the Service, you consent to the collection, use and disclosure of your personal data as described in this policy.

1. Personal data we collect

• Account data: your name, email address and password (stored in encrypted form), or your login details if you sign in through a third-party provider.
• Learning data: your favourite and saved topics, vocabulary lists, progress, paused and resumed sessions, and settings.
• IvocaAI content: text and audio you submit to IvocaAI and the responses it generates.
• Payment data: billing name, email, country and transaction history. Card details are collected and processed directly by Stripe. We never see or store your full card number.
• Communications: messages you send to us and our replies.
• Technical data: IP address, browser and device type, pages visited, and cookie identifiers.

2. How we use your personal data

We use your personal data to:

1. create and manage your account;
2. provide lessons, topics, Lyric Study and IvocaAI, and save your progress;
3. process payments and subscriptions, and prevent fraud;
4. respond to your enquiries and support requests;
5. maintain, secure and improve the Service, including through analytics;
6. send you service notices, such as receipts and changes to our terms;
7. send you marketing messages, only where you have agreed to receive them; and
8. comply with legal, tax and accounting obligations.

We will not use your personal data for any other purpose without notifying you and, where required, obtaining your consent.

3. Disclosure to third parties

We do not sell your personal data. We disclose it only to service providers that help us operate the Service, and only to the extent needed:

• Stripe — payment processing (Stripe Privacy Policy);
• AI service providers — to generate IvocaAI responses;
• hosting, database and email providers — to run the website and send account emails;
• analytics providers — to understand how the Service is used.

These providers are bound by contract to protect your personal data and use it only for the purposes we specify. We may also disclose personal data where required or permitted by law, for example to government authorities.

4. Transfers outside Singapore

Some of our service providers store or process data outside Singapore. When we transfer personal data overseas, we take steps to ensure the recipient provides a standard of protection comparable to the PDPA, as required by the Transfer Limitation Obligation.

5. Retention

We keep personal data only as long as needed for the purposes above, or as required by law:

• account and learning data: while your account is active, and deleted within 30 days after you close it;
• IvocaAI conversations: up to 12 months, unless you delete them earlier;
• payment and transaction records: 5 years, as required by Singapore tax and accounting rules;
• support messages: 2 years.

6. Cookies

We use essential cookies to keep you signed in and the Service working. We also use analytics cookies to understand usage. You can block or delete cookies in your browser settings, but some features may then not work.

7. Your rights

Under the PDPA, you may:

• access the personal data we hold about you and ask how it has been used or disclosed in the past year;
• correct any personal data that is inaccurate or incomplete;
• withdraw your consent to our collection, use or disclosure of your personal data. We will tell you what this means for your use of the Service, for example that we may no longer be able to provide your account;
• ask us to delete your account and personal data, subject to records we must keep by law.

To make a request, email our Data Protection Officer at [email protected]. We will respond within 30 days. If we need more time, we will tell you when you can expect our reply. We may charge a reasonable fee for access requests and will tell you the fee in advance.

To stop marketing emails at any time, click "unsubscribe" in any email or contact us.

8. Children

The Service is intended for users aged 13 and above. Users under 18 should use the Service with the consent of a parent or guardian. If we learn that we have collected personal data from a child under 13 without parental consent, we will delete it.

9. Security

We protect personal data with reasonable security arrangements, including HTTPS encryption, hashed passwords, restricted staff access and reputable service providers. No method of transmission or storage is completely secure, so please keep your password confidential.

10. Data breaches

If a data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission (PDPC) as required by the PDPA.

11. Users outside Singapore

If you live in another country, such as the United Kingdom or the European Union, you may have additional rights under your local data protection laws. Contact us and we will respond in line with those laws.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date and notify you by email of significant changes.

If you are not satisfied with our response, you may contact the Personal Data Protection Commission.