Privacy Policy

Last updated: 17 October 2026

This policy explains how Magic Spider (“we”, “us”) collects, uses and protects personal data when parents and children use our learning app. We follow Singapore’s Personal Data Protection Act 2012 (PDPA).

1. Who we are

Magic Spider is operated by [business name and UEN], Singapore. For any privacy question or request, contact our Data Protection Officer at [contact email].

2. Personal data we collect

• Parent account: email address and password. Passwords are stored only in a scrambled (hashed) form, never as plain text.
• Child profiles (created by the parent): first name or nickname, school grade, and subject levels.
• Learning activity: answers, scores, points, mock exam results, written answers, and when activities were done.
• Delivery details (only if you order a physical item): name, phone number and address.
• Payments: handled by our payment provider, Stripe. We do not see or store your card number.

3. How we use it

• To run your account and let your children practise, track progress and see results.
• To show parents progress reports and to improve our questions and features.
• To process purchases and deliver items you order.
• To keep the service safe, prevent misuse, and meet legal requirements.

We do not sell personal data, and we do not show advertising to children.

4. Children’s data

Child profiles can only be created by a parent or guardian, who gives consent on the child’s behalf. We ask only for what we need: a first name or nickname is enough. Parents can view their child’s activity at any time and can ask us to correct or delete it.

5. Sharing

We share personal data only with service providers who help us run Magic Spider, such as our hosting provider (servers in Singapore) and Stripe for payments, and only for that purpose. We may also disclose data where the law requires it.

6. AI tools and your data

• Our questions are generated and checked using AI tools, including Claude (Anthropic). We use these tools to create question content such as wording and answer options.
• We do not send your child’s name, your email, or any account or learning record to these AI tools. Only general instructions about the type of question needed are sent.
• AI can make mistakes. Please see our Terms of Use and check other valid sources if something looks wrong.

7. Payments and payment risk

• Payments are processed by Stripe (cards and PayNow). We receive limited information such as the plan bought, amount, payment status, and a customer reference. We do not store your card number.
• Stripe and your bank handle your payment data under their own privacy and security terms. Online payments carry risks such as fraud, phishing, wrong transfers and unauthorised charges. Keep your login private, check amounts before you pay, and contact your bank and us if something looks wrong.
• We keep payment records as required by law (for example for accounting and tax).

8. Sending data overseas

Our servers are in Singapore. Some providers, such as Stripe and AI tool providers, may process data in other countries. Where this happens we take reasonable steps to make sure the data is protected to a standard comparable to the PDPA.

9. Cookies

We use one essential cookie to keep you logged in. We do not use advertising or tracking cookies.

10. How long we keep data

We keep personal data while your account is active. When you close your account, we delete or anonymise your data within a reasonable time, unless we must keep some records by law (for example, payment records).

11. Your rights

You can ask to access or correct your personal data, withdraw your consent, or have your account and your children’s data deleted. Email [contact email] and we will respond within a reasonable time. Withdrawing consent may mean we can no longer provide the service.

12. Keeping data safe

We make reasonable security arrangements to protect personal data from unauthorised access, use or loss. No online service can be completely secure, so please keep your password private.

13. Data breaches

If a data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as required by the PDPA.

14. Changes

We may update this policy from time to time. We will post the new version here with a new date, and tell you about important changes.