Privacy Policy

1. Who we are

ClassBuddy is a booking platform for children's enrichment classes in Singapore, operated by ClassBuddy Pte. Ltd. (UEN 202605555D), registered at 154 Ang Mo Kio Avenue 5, #11-3098, Yio Chu Kang Grove, Singapore 560154. In this policy, "we", "us", and "our" mean the company. It covers our website at classbuddy.sg, our booking platform, and our communications with you.

2. Our Data Protection Officer

We have designated a Data Protection Officer (DPO) as required by section 11(3) of the PDPA. The DPO oversees how we handle personal data and is the contact point for every data protection matter in this policy.

Reach the DPO at dpo@classbuddy.sg or by post: Data Protection Officer, ClassBuddy Pte. Ltd., 154 Ang Mo Kio Avenue 5, #11-3098, Yio Chu Kang Grove, Singapore 560154.

3. Personal data we collect

• Parents and members: name, email address, phone number, account credentials, booking history, credit balance, payment records, and messages you send us.
• Children: the child's name, age, and class attendance history, provided by the parent or guardian when booking.
• Partners: business name, UEN, contact person details, bank account details for payouts, and signed agreement records. Listing information may also come from public sources such as the centre's own website or business profile.
• Ambassadors: identity and contact details collected through the ambassador programme's signed agreements.
• Visitors and leads: contact details submitted through our forms (launch notifications, call requests), plus device and usage data collected through cookies.

4. Why we collect and use it

• Running your account, including sign-in and security
• Processing bookings, credits, and payments
• Sharing booking details with the enrichment provider delivering the class
• Paying partners and settling commissions
• Sending service messages about bookings and your account, by email and WhatsApp
• Sending marketing you have separately consented to
• Analytics and improving the platform
• Detecting fraud and keeping the platform secure
• Meeting legal and regulatory obligations

We collect, use, and disclose personal data only for these purposes. If we ever need it for a new purpose, we tell you first and seek fresh consent.

5. Consent and withdrawing it

We collect personal data with your consent, given when you create an account, make a booking, or submit a form. In limited situations the PDPA treats consent as given, for example when you volunteer data for an obvious purpose.

You can withdraw consent at any time by emailing dpo@classbuddy.sg or using the unsubscribe link in any marketing message. We act on withdrawals promptly and tell you the consequences before they take effect. Withdrawing consent for core purposes means we can no longer run your account or bookings; there is no penalty for withdrawing.

6. Children's data

Bookings are made by a parent or guardian, who provides the child's details and consents on the child's behalf. We collect the minimum needed to run a class and never market to children. Providers receive only the details needed to deliver the booked class.

7. Who we share data with

We do not sell personal data. We share it only with:

• Enrichment providers: the booking details a centre needs to deliver the class you booked.
• Service providers under contract: Supabase (database and authentication), Vercel (website hosting), Airwallex (payments and partner payouts), Resend (email delivery), respond.io (WhatsApp messaging), Google (Tag Manager and analytics), and Anthropic (AI assistance for listing content).
• Authorities and advisers: where the law requires disclosure or we need to protect legal rights.

8. Overseas transfers

Our database runs on Supabase infrastructure in Tokyo, Japan (AWS ap-northeast-1). Other service providers, including Vercel, may process data in the United States and other regions.

Wherever personal data leaves Singapore, we rely on contractual safeguards with these providers so it receives protection comparable to the PDPA, as the Transfer Limitation Obligation requires.

9. How we protect it

All traffic to classbuddy.sg is encrypted in transit, and stored data is encrypted at rest. Database access is restricted by row-level security policies and role-based permissions, and file uploads go through signed, time-limited URLs. Access to production systems is limited to the team members who need it.

10. How long we keep it

We keep personal data only as long as it serves the purpose it was collected for or a legal requirement demands.

We keep data longer only where a legal obligation or an anticipated legal claim requires it.

11. Access and correction

You can request a copy of your personal data, ask how it has been used or disclosed in the past year, or ask us to correct it. Send requests to dpo@classbuddy.sg; we verify your identity and respond within 30 days, or tell you within that time how much longer we need.

Access requests may carry a reasonable fee, quoted before we proceed. Corrections are free.

12. Accuracy

You can update your contact and account details in your account settings at any time. When you ask us to correct inaccurate data, we also pass the correction to any organisation we disclosed it to within the past year, as the PDPA requires.

13. Marketing messages and the DNC registry

We send marketing by email or WhatsApp only with your consent, collected separately from service messages. Every marketing message includes a way to unsubscribe, and unsubscribing never affects your bookings.

Before sending marketing to a Singapore phone number, we check the Do Not Call Registry unless you have given us clear consent, and we comply with the Spam Control Act for all bulk messages.

14. Cookies and analytics

We use three categories of cookies: Essential (sign-in and core functions), Functional (preferences and product analytics), and Marketing and Advertising. Analytics and advertising tags load through Google Tag Manager. Change your choices any time via Cookie Settings in the page footer.

15. Data breach notification

If a data breach occurs, we assess it under the PDPA's Data Breach Notification Obligation. Where a breach is likely to cause significant harm to affected individuals or affects 500 or more people, we notify the Personal Data Protection Commission within 3 calendar days of that assessment and inform the individuals affected.

16. Complaints

Raise any concern with our DPO first at dpo@classbuddy.sg; we investigate and reply to every complaint. If you are not satisfied with our response, you can complain to the Personal Data Protection Commission at pdpc.gov.sg.

17. Changes to this policy

We date every version of this policy and post updates on this page. Material changes are announced by email or an in-product notice before they take effect.

See also our Terms and Conditions.