Privacy Policy

1. Who We Are

CLAce (“CLAce”, “we”, “our”, “us”) is operated by CLAce. We provide an AI-powered PSLE Chinese composition and comprehension marking service accessible at clace.sg.

For any privacy or data protection matters, please contact our support team at support [at] clace [dot] sg.

2. Personal Data We Collect

We collect only the personal data necessary to provide our service. No data is collected without a valid purpose.

We do not collect a child’s NRIC, school name, class, or any identifier beyond a display name and level. Composition text is processed but not used to build profiles for advertising purposes.

3. How We Use Personal Data

• Provide, maintain, and improve the CLAce marking service.
• Authenticate your account and protect against unauthorised access.
• Process payments and manage subscriptions via Stripe.
• Send transactional emails (marking results, receipts, important notices) via Resend.
• Generate and display marking history and score trends in your dashboard.
• Improve our AI marking models through aggregated, anonymised analysis — we will never use individual identified compositions to train third-party foundation models without your explicit consent.
• Respond to support requests and enforce our Terms of Service.

4. Children’s Data

CLAce is intended for use by parents or legal guardians on behalf of their children aged 10–12 (P4–P6). The account holder must be at least 18 years old. By creating a child profile and submitting a composition, you confirm that you are the parent or legal guardian of that child and you consent to the collection and processing of the child’s data as described in this policy.

We collect only the minimum data necessary to personalise the marking experience. We do not require a child’s full name, NRIC, school, or photograph. If we become aware that personal data has been collected from a child without verifiable parental consent, we will delete it promptly.

5. Third-Party Processors

We engage trusted third-party processors to deliver our service. All processors are bound by data processing agreements that require them to protect your data in accordance with applicable law.

This list describes processor categories and is non-exhaustive. We may change providers from time to time while maintaining equivalent data protection standards.

6. Cross-Border Data Transfers

Our service infrastructure is primarily hosted in the United States. By using CLAce, you consent to your personal data being transferred to and processed in countries outside Singapore. We ensure that any such transfer is accompanied by appropriate safeguards consistent with the PDPA’s Transfer Limitation Obligation, including contractual protections with each processor.

We will not transfer personal data to countries that do not provide an adequate level of protection without first obtaining your consent or establishing appropriate contractual protections.

7. Data Retention

• Active accounts: Personal data is retained for as long as your account is active.
• Composition history: Retained for 3 years from submission to allow progress tracking, or until account deletion, whichever is earlier.
• Billing records: Retained for 7 years in accordance with Singapore’s Companies Act accounting requirements.
• Deleted accounts: Personal data is deleted or anonymised within 30 days, except where retention is required by law.

8. Data Security

We implement industry-standard technical and organisational measures to protect your personal data, including:

• Passwords stored as salted cryptographic hashes (never in plain text).
• All data in transit encrypted via TLS 1.2+.
• Database access restricted by row-level security policies.
• API keys and secrets stored in server-side environment variables only.
• Regular vulnerability reviews of application dependencies.

In the event of a data breach that is likely to result in significant harm, we will notify the Personal Data Protection Commission (PDPC) within 3 calendar days and notify affected individuals as required under the PDPA.

9. Cookies

CLAce uses essential session cookies to maintain your authenticated session. We do not use third-party advertising cookies or cross-site tracking. Usage analytics (if any) use privacy-preserving, aggregated data only.

10. Your Rights Under the PDPA

Under the Singapore Personal Data Protection Act, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Withdrawal of consent: Withdraw consent at any time. Withdrawal will not affect the lawfulness of prior processing, and may result in restriction or termination of services.
• Data portability: Request your personal data in a machine-readable format where technically feasible.
• Erasure (account deletion): Delete your account and request erasure of personal data, subject to legal retention obligations.

To exercise any of these rights, email support [at] clace [dot] sg. We will respond within 30 calendar days. We may request verification of your identity before processing the request.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on the site at least 14 days before the changes take effect. Your continued use of CLAce after the effective date constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related queries, requests, or complaints, please contact our Data Protection Officer: