Privacy Policy

Superholic Lab is an online educational platform operated by Superholic Lab Pte. Ltd. (UEN 202621641M), a company incorporated in Singapore on 15 May 2026.

We comply fully with Singapore's Personal Data Protection Act 2012 (PDPA) and act as the Data Controller. This policy applies to all personal data collected through www.superholiclab.com for parents, guardians, and children.

• Account data Parent's name and email. Children's profiles require only a first name and school level — never a full name, home address, school name, NRIC, or phone number.
• Parental consent record Accounts are created and managed by a parent or legal guardian. At signup you give explicit consent for your under-13 child's data to be collected and used as described here; we record the consent statement version and timestamp.
• Usage data Quiz results, topic progress, and AI tutor chat history — used exclusively to personalise learning and build your dashboard.
• Payment data Processed securely via Stripe, Inc. We do not store your credit card numbers on our servers.

We never use your data for advertising or sell it to third parties.

Your data is stored in Supabase (PostgreSQL), hosted on secure AWS servers located physically in Singapore (ap-southeast-1).

We enforce strict row-level security (RLS) policies so users can only access their own data. All data is transmitted over HTTPS, and passwords are cryptographically hashed using bcrypt.

We share data only with essential service providers who are contractually bound to protect it:

• Supabase Database, file storage, and authentication (Singapore region).
• Stripe Secure payment processing. We never store card numbers.
• OpenAI, Anthropic & Google The AI model providers behind Miss Wena, question generation, and exam papers. None of them use our API inputs (your child's chats or answers) to train their models. We deliberately send at most a first name — never your child's other personal details.
• Vercel Website hosting, plus privacy-first, cookie-free web analytics.
• Cloudflare & Resend Network security/DNS, and transactional email (parent email only).

Cross-border note: your family's data is stored in Singapore, but AI requests are processed by our AI providers outside Singapore. Under PDPA Section 26, each provider is bound by a data-protection agreement to protect that data to a comparable standard.

Under the PDPA, you have complete control over your family's data. You have the right to:

• Access & correction View or fix the data we hold about you.
• Withdrawal Withdraw your consent for data usage (which will pause your service).
• Right to forget Request full deletion of your account and child's data. Processed within 30 days.

We keep personal data only as long as it serves you, then delete it on a schedule:

• Learning records Quiz and exam attempts, mastery progress, XP and badges are kept while your subscription is active, and for 180 days after cancellation (so a returning family keeps their history), then permanently deleted.
• AI tutor chat logs Kept for 12 months, then deleted or anonymised.
• Email & support records Kept for 24 months for audit and billing-dispute purposes.
• On account deletion Everything — including learning records and tutor chat logs — is hard-deleted within 30 days, regardless of the schedules above.

We do not use tracking cookies. Our analytics provider (Vercel Web Analytics) is entirely cookie-free and respects your privacy. We only use local browser storage for functional necessities — like keeping you safely logged into your session.

When you download a past-year paper from our archive at superholiclab.com/papers, we record the following for service-quality, abuse-prevention, and analytics purposes:

• The paper identifier you downloaded;
• The timestamp of the download;
• For signed-in users, your account ID;
• A one-way hashed identifier derived from your IP address combined with a monthly-rotating salt (used solely for rate-limiting and abuse detection — we cannot reverse-engineer this hash to your IP address);
• The referring page (where you arrived from).

We do not store your raw IP address with past-paper download records. We retain these records for up to 24 months, after which they are deleted or anonymised for long-term analytics. Aggregate, non-identifying download counts (e.g., "Downloaded 234 times this month") may be displayed publicly on the archive page.