Privacy Policy

Welcome to iStarPal (“we,” “our,” or “us”). iStarPal is built and operated by Starclub Education, an education provider serving students preparing for Cambridge IGCSE, Singapore O-Level, and Malaysian SPM examinations. This Privacy Policy explains how we collect, use, store, and safeguard your information when you use our mobile and web applications and related services (collectively, the “Service”).

By using the Service you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.

We comply with the Personal Data Protection Act 2010 (Malaysia), the Personal Data Protection Act 2012 (Singapore), and other applicable data protection laws in Southeast Asia, including the Indonesian Personal Data Protection Law, Thailand’s Personal Data Protection Act, and Vietnam’s Personal Data Protection Decree where the Service is offered in those jurisdictions.

We collect personal information you voluntarily provide when you register for and use the Service, including:

• Name and contact data (email address; optional display name)
• Account credentials and authentication tokens
• Parent contact data when the user is under 18 (parent email for consent verification — see Section 6)
• Learning data — your study syllabus, conversations with the AI tutor, assessment responses, and progress signals
• Usage data and interaction metrics within the application (anonymized rollups for product improvement)

We do not collect biometric data, precise location data, financial account data, or contacts from your device.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Personalize your tutoring experience based on your syllabus and learning history
• Improve our pedagogical models and content quality
• Communicate with you regarding updates, security, and support
• Send the optional weekly parent summary email (if you are a parent of an under-18 user)
• Comply with legal obligations and respond to lawful requests from authorities

iStarPal relies on the following third-party processors to deliver the Service. Each processor is contractually bound to handle your data only on our instructions.

• Supabase (Singapore region) — authentication, database, and file storage
• Hetzner Cloud (Singapore region) — hosting for the learning management infrastructure
• Vercel — hosting for the marketing website and the web application
• Mailtrap — transactional email delivery (account verification, parent consent, weekly summaries)
• Anthropic and OpenRouter — AI model inference for the tutor; conversation content is processed transiently and not used for model training

iStarPal is designed for students in primary and secondary school, many of whom are under 18. For users under 18:

• We require verifiable consent from a parent or guardian before we activate the student account, in accordance with PDPA requirements
• We do not show behavioral advertising to minors. We do not show advertising of any kind in the Service today
• Parents may request access to, correction of, or deletion of their child’s data at any time by emailing privacy@istarpal.com
• Parents may withdraw consent at any time, which will trigger suspension of the student account and deletion of associated data per Section 8

Your personal information is stored in Singapore-region data centers operated by our processors (Supabase, Hetzner Cloud). Limited transitory processing occurs at AI inference endpoints operated by Anthropic and OpenRouter; conversation content is transmitted to these processors for the sole purpose of generating tutor responses and is not retained for model training.

We keep your information for as long as necessary to provide the Service and to comply with our legal obligations. You have the right to request deletion of your account and personal data at any time.

You can request deletion of your account and data by emailing privacy@istarpal.com. We will respond within 30 days, in accordance with PDPA timelines. An in-app deletion option is being added in a forthcoming release.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (see Section 8)
• Withdraw consent for processing where consent is the basis
• Lodge a complaint with the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi) or Singapore (PDPC) as applicable

We may update this Privacy Policy from time to time. We will notify you of material changes by email at the address associated with your account, and we will update the “Last updated” date at the top of this page. Continued use of the Service after a change constitutes acceptance of the updated policy.

If you have questions, comments, or requests regarding this policy or your personal data, please contact us at: privacy@istarpal.com.