Privacy Policy

1. Introduction

Tiny Equations Pte. Ltd. (“Tiny Equations”, “we”, “our”, or “us”) is committed to protecting the privacy and personal data of all users of our web application, accessible at app.tinyeqn.com (the “Platform”). This Privacy Policy explains how we collect, use, disclose, store, and protect personal data in connection with the Platform and our AI-powered educational Services, including TinyMark, TinyQ, TinyTeach, and the Mastery Intelligence System (MIS).

This Privacy Policy applies to all users of the Platform, including school administrators, teachers, students, and individual consumers. It should be read together with our Terms of Service, available at app.tinyeqn.com/terms.

By registering for or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where a user is a minor, the parent or guardian who provides consent at registration also acknowledges this Policy on behalf of the child.

This Policy is separate from the internal Data Privacy Policy that governs how Tiny Equations' own employees and contractors handle company data.

2. About Us and Our Data Protection Officer

Tiny Equations Pte. Ltd. is a company incorporated in Singapore (the “Company”). We are the data controller in respect of personal data collected through the Platform.

We have designated a Data Protection Officer (DPO) as required under the Singapore Personal Data Protection Act 2012 (PDPA). Our DPO can be contacted at:

All data protection queries, access requests, correction requests, and deletion requests should be directed to the above contact.

3. Scope and Applicable Laws

This Privacy Policy is governed primarily by the Personal Data Protection Act 2012 of Singapore (PDPA). Where Tiny Equations operates through local partnerships, agencies, or joint ventures in Malaysia or Myanmar, we also comply with the Personal Data Protection Act 2010 of Malaysia and other applicable data protection frameworks in those jurisdictions, to the extent required.

To the extent that users from other jurisdictions access the Platform, Tiny Equations will endeavour to comply with applicable local data protection laws as relevant.

4. Personal Data We Collect

4.1 Data You Provide Directly

When you register for or use the Platform, we may collect the following categories of personal data:

• Account registration data: name, email address, and password (stored in hashed form).
• Profile information: role (student, teacher, school administrator), school or institution name, and year or grade level where applicable.
• Parental or guardian data: name and contact details of the parent or guardian who provides consent for a minor B2C account.
• User-submitted content: student answers, essays, written responses, questions submitted to TinyTeach, and any other content submitted in the course of using the Services (“User Data”).
• Payment data: billing name, billing address, and payment card details for B2C paid subscriptions. Payment card data is processed directly by Stripe and is not stored by Tiny Equations. Please refer to Stripe's Privacy Policy at stripe.com/privacy for details of how Stripe handles your payment information.

4.2 Data We Collect Automatically

When you access or use the Platform, we automatically collect certain technical and behavioural data, including:

• Login activity: date, time, and frequency of logins.
• Usage data: features accessed, time spent on tasks, assignment completion activity, and interactions with the Services.
• Device and browser data: IP address, browser type and version, operating system, and device identifiers.
• Cookie and tracking data: as described in Section 7 below.

4.3 Data Generated by the Services

As a result of your use of the Platform, we generate and store the following types of data:

• AI-generated outputs: marking feedback, generated questions, tutoring responses, and mastery graphs and concept or topic mastery scores produced by the Mastery Intelligence System.
• Learning progression data: mastery scores, concept progression, and assignment grades associated with individual student accounts.

We note that learning progression data, including mastery scores derived from student responses, may in some cases reveal information about a student's educational needs or learning profile. We treat such data with appropriate care. Please refer to Section 10 for further details.

5. How We Use Personal Data

5.1 Providing and Improving the Services

We use personal data for the following purposes:

• To create and manage your account and verify your identity.
• To provide, operate, and maintain the Platform and Services.
• To process and respond to student submissions through TinyMark, TinyQ, and TinyTeach.
• To generate and surface mastery graphs and concept mastery scores via the Mastery Intelligence System.
• To process B2C subscription payments via Stripe.
• To perform quality assurance on AI model outputs and to improve the accuracy, quality, and relevance of Content generated by the Services.
• To monitor for and prevent fraudulent activity, misuse, and security incidents.

5.2 Communications

We use contact details to send:

• Transactional communications: account verification, password resets, billing receipts, and service-related notices. These are sent to all users and cannot be opted out of while your account is active.
• Product update notifications: information about new features, changes to the Platform, or updates to the Services. These are enabled by default for all user types. You may opt out through your account settings.
• Marketing emails: promotional content, offers, and news about Tiny Equations. These are sent only to B2C users. All B2C users, including minors where parental consent for marketing communications has been obtained at registration, may receive marketing emails. You may opt out at any time through your account settings.

5.3 Advertising (B2C Only)

Where you have opted in to personalised advertising through the consent banner presented on first login, we may use your usage data and cookie data to serve personalised advertisements within or related to the Platform. Advertising cookies are not used for Institution-Linked (B2B) accounts. See Section 7 for further detail on cookies.

6. Legal Bases for Processing

Under applicable data protection law, we process personal data on the following bases:

• Contractual necessity: processing required to provide the Services you have registered for, including account management, delivery of AI-generated outputs, and payment processing.
• Consent: processing based on your freely given, specific, and informed consent, including consent to advertising cookies, personalised advertising (B2C), marketing emails, and the overseas transfer of personal data to GCP (US) and Supabase servers. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
• Legitimate interests: processing for the purposes of improving our AI models, ensuring platform security, and preventing fraud, where such interests are not overridden by your rights and interests.
• Legal obligation: processing required to comply with applicable laws or regulatory requirements.

7. Cookies and Tracking Technologies

7.1 Types of Cookies We Use

The Platform uses the following categories of cookies:

• Strictly necessary cookies: session cookies required for the Platform to function, including authentication tokens and security cookies. These are used for all account types and cannot be disabled.
• Analytics cookies: cookies that help us understand how users interact with the Platform, including which features are used and how frequently. These are used for both B2C and Institution-Linked accounts. Where Google Analytics is used, data may be transmitted to Google's servers. Please refer to Section 9 for further details on international data transfers.
• Advertising cookies: cookies used to serve and personalise advertisements. These are used only for B2C accounts where you have provided explicit consent. Advertising cookies are not used for Institution-Linked (B2B) accounts under any circumstances.

7.2 Cookie Consent

On your first login to the Platform following account registration, you will be presented with a cookie consent banner. For B2C accounts, this banner will offer you the option to accept or decline analytics and advertising cookies. For Institution-Linked accounts, the banner will cover session and analytics cookies only. Strictly necessary cookies do not require consent and will be set in all cases.

You may update your cookie preferences at any time through your account settings.

8. Data Sharing and Disclosure

8.1 Third-Party Service Providers

We share personal data with the following categories of third-party service providers who process data on our behalf, subject to appropriate contractual protections:

• Google Cloud Platform (GCP): cloud infrastructure and AI model processing. GCP servers are located in the United States.
• Supabase: database hosting in the Asia-Pacific (Southeast Asia) region.
• Stripe: payment processing for B2C subscriptions. Stripe processes payment card data directly and is subject to its own privacy policy at stripe.com/privacy.
• Google Analytics (if enabled): website and platform analytics. Data may be processed on Google's servers in the United States.

8.2 Institution-Linked Accounts

User Data collected in connection with Institution-Linked Accounts, including student submissions, answers, essays, queries, progression scores, assignment grades, and related educational data, will not be disclosed to any third party other than the service providers listed in Section 8.1, without the prior written consent of the relevant Institution, except where required by applicable law.

8.3 B2C Accounts

User Data collected from B2C accounts will not be disclosed to third parties for their own purposes without your consent, except to service providers as described in Section 8.1 and as otherwise required by law. Where you have opted in to personalised advertising, your usage data and cookie data may be used to serve targeted advertisements, but will not be sold to third parties.

8.4 Legal Disclosures

We may disclose personal data to government authorities, law enforcement, or other third parties where required or permitted by applicable law, including in response to a court order, regulatory request, or to protect the rights, property, or safety of Tiny Equations, our users, or the public.

8.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of the assets of Tiny Equations, personal data held by us may be transferred to the acquiring entity, subject to equivalent data protection commitments.

9. International Data Transfers

Tiny Equations stores and processes personal data on servers located outside Singapore, including on Google Cloud Platform servers in the United States and Supabase servers in the Asia-Pacific (Southeast Asia) region. By using the Platform and accepting this Privacy Policy, you consent to your personal data being transferred to and processed in these jurisdictions.

We take steps to ensure that such transfers are made in accordance with applicable data protection laws and that appropriate safeguards are in place, including the use of standard contractual clauses or equivalent protections where required.

Where Google Analytics is used, data about your Platform usage may be transmitted to and processed by Google on servers located in the United States, subject to Google's own privacy policy and terms. You may opt out of Google Analytics data collection through your cookie preferences.

10. Special Categories of Data — Educational Needs

The Platform's Mastery Intelligence System analyses student responses and learning behaviours to generate personalised mastery scores and learning pathways. While the MIS does not specifically screen for or diagnose special educational needs, the pattern of a student's responses and progression data could, in some cases, be indicative of particular learning profiles or educational needs.

Tiny Equations does not use this data to label, categorise, or make determinations about students' special educational needs. The MIS is designed solely to optimise individualised learning pathways in a dynamic and adaptive manner.

Where Institution-Linked Accounts are used, the relevant school or institution is responsible for ensuring that appropriate disclosures and consents are in place with students and their families regarding the collection and use of learning progression data, in accordance with the institution's own obligations under applicable law.

We treat learning progression data with a heightened level of care and do not share it with third parties except as described in Section 8 of this Policy.

11. Data Retention

We retain personal data for as long as your account remains active and for a period of six (6) months following the closure or termination of your account, after which your data will be securely deleted or anonymised, unless we are required to retain it for a longer period under applicable law.

For Institution-Linked Accounts, User Data associated with an institution's subscription or pilot is retained for six (6) months from the date on which the subscription or pilot arrangement concludes.

Payment records and billing data may be retained for longer periods where required for accounting, tax, or legal compliance purposes.

Anonymised or aggregated data derived from your use of the Services, which cannot reasonably be used to identify you, may be retained indefinitely for the purposes of product improvement and analytics.

12. Your Rights

Subject to applicable law, you have the following rights in respect of your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right of correction: you may request that we correct any inaccurate or incomplete personal data we hold about you.
• Right of deletion: you may request that we delete your personal data. We will action such requests subject to any legal retention obligations and the six-month post-closure retention period described in Section 11.
• Right to withdraw consent: where processing is based on your consent (including consent to cookies, advertising, marketing emails, or overseas data transfers), you may withdraw that consent at any time through your account settings. Withdrawal of consent does not affect the lawfulness of processing that took place prior to withdrawal.
• Right to opt out of marketing: you may opt out of marketing emails at any time through your account settings. You may also opt out of product update notifications through the same channel.

To exercise any of the above rights, please contact our Data Protection Officer at support@tinyeqn.com. We will endeavour to respond to all requests within thirty (30) calendar days. In some cases, we may require verification of your identity before processing your request.

If you are a minor, requests should be made by your parent or legal guardian.

13. Data Security

Tiny Equations implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include access controls, encryption of data in transit and at rest, and regular security reviews.

Notwithstanding the above, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security and shall not be liable for any unauthorised access or breach that occurs despite reasonable security measures, except to the extent required by applicable law.

In the event of a personal data breach that is notifiable under applicable law, we will take appropriate steps in accordance with our legal obligations, including notifying affected individuals and the relevant regulatory authority where required.

14. Minors and Parental Consent

The Platform is accessible to users of all ages, including primary and secondary school students. Where a B2C user is under 18 years of age, a parent or legal guardian is required to provide consent at the point of registration. The consent process will ask the parent or guardian to provide their name and contact details, and to confirm consent on behalf of the child, including consent to the collection and use of the child's personal data as described in this Policy, the transfer of data to overseas servers, and where applicable, the sending of marketing communications to the child's registered contact.

Advertising cookies are not served to minor users on the basis of their age or learning data. General, non-targeted advertising may be served to minor B2C users only where the parent or guardian has provided consent to marketing communications.

Parents and guardians may exercise data rights on behalf of a minor at any time by contacting support@tinyeqn.com.

For Institution-Linked Accounts, student accounts are provisioned by Tiny Equations in coordination with the relevant Institution. It is the responsibility of the Institution to ensure that all required parental or guardian consents are in place prior to student data being submitted to the Platform.

15. Changes to This Privacy Policy

Tiny Equations reserves the right to update or amend this Privacy Policy at any time. Where changes are material, we will provide not less than seven (7) calendar days' advance notice by posting the updated Policy on the Platform and, where reasonably practicable, by notifying registered users by email.

The date of the most recent update will be reflected at the top of this document. Your continued use of the Platform after the effective date of any updated Policy constitutes your acknowledgement of the changes.

16. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data handling practices, or if you wish to exercise any of your rights under applicable data protection law, please contact:

We will endeavour to respond to all enquiries within thirty (30) calendar days of receipt.