Privacy Policy

1. Who we are

This Privacy Policy explains how Inner Sharp Consulting Pty Ltd (ABN 70 664 952 667) ("we", "us", or "our") collects, uses, discloses, and protects personal data when you use Enlightova at sg.enlightova.com.

For privacy requests, support, or questions about this Policy, use our online privacy request form or contact our Data Protection Officer (details in section 14) at contact@enlightova.com.

2. Scope

This Policy applies to parents, legal guardians, students, and website visitors who use Enlightova in connection with Singapore primary / PSLE learning support. It should be read together with our Terms of Service.

We handle personal data in line with Singapore's Personal Data Protection Act 2012 (PDPA), as applicable to our role as an organisation providing this Service.

3. What we collect

Depending on how you use Enlightova, we may collect:

• Account data: name, email address, role (parent or student), and authentication identifiers
• Student learning data: practice answers, diagnostic and mock results, scores, progress, study plans, and related feedback
• Parent linkage and consent records: which parent is linked to which student profile, and records of parental approval
• Billing data: subscription status and payment-related information processed by Stripe. We do not store full card numbers on our servers
• Technical data: device and browser information, IP address, logs, and usage events needed to run and secure the Service
• Optional parent MCP connections: if you connect an AI app, we store a hashed access token, the app label you chose, consent time, and tool-call metadata (which tool ran and when — not the progress snapshot itself)
• Communications: messages you send us (for example, support emails)

4. Why we collect it

We use personal data to:

• Create and manage accounts, and authenticate users
• Deliver diagnostics, practice, mocks, progress views, and study plans
• Show parents insights and coaching materials about linked students
• If you opt in, let a connected AI app retrieve a read-only Maths progress summary for children linked to your account
• Process subscriptions and payments
• Send service emails (for example, invites, consent requests, and account notices)
• Maintain security, prevent abuse, and troubleshoot issues
• Improve the Service and understand how features are used
• Comply with legal obligations

5. Children’s data and parental consent

Enlightova is designed for primary-school learners with parent involvement. Where a student is under 18, we rely on a parent or legal guardian's approval before processing the student's learning data for personalised features, consistent with our in-product consent flow.

Parents can typically:

• Approve or decline a child's use of the Service
• View linked progress information in the parent experience
• Optionally connect a read-only AI app (MCP) and revoke that access from Privacy
• Request withdrawal of consent and deletion of personal data by emailing contact@enlightova.com

If consent is withdrawn, we will stop the relevant processing and delete or anonymise data where we are not required to keep it for legal, security, or billing reasons.

6. AI processing

Some features use artificial intelligence providers (for example, Google Gemini and Anthropic) to help grade answers, generate explanations, coaching content, or study plans. Relevant learning content may be sent to those providers solely to deliver the requested feature.

We do not sell student or parent personal data. AI outputs may be imperfect; treat them as learning support.

If you connect an AI app through Parent MCP, Enlightova sends only a compact Maths progress summary (first name, Achievement Level estimate, this week's plan topics, activity, and the latest weekly report highlight) to that app when it asks. We do not control the connected app's training, retention, or who can see the chat. This is optional. You can revoke access at any time from the parent Privacy page. Do not connect an app unless you accept that the child summary will be processed outside Enlightova.

7. Who we share data with

We share personal data with service providers only as needed to operate Enlightova, under appropriate arrangements. Categories include:

• Clerk — authentication and account management
• Stripe — payment processing
• Neon — database hosting
• Resend — transactional email
• Sentry — error monitoring
• Langfuse — AI observability and quality monitoring
• AI providers (for example, Google and Anthropic) — feature delivery
• A parent-chosen AI app — only if you create a Parent MCP connection. That app is not our subprocessor; we do not have a contract with it
• Hosting and infrastructure providers — running the website and related services

We may also disclose information if required by law, to protect rights and safety, or in connection with a corporate transaction (for example, a merger), subject to appropriate safeguards.

We do not sell personal data.

8. Overseas transfers

Enlightova is operated by an Australian company and uses cloud and AI providers that may process data outside Singapore (including in Australia, the United States, or other countries). Where personal data is transferred overseas, we take steps consistent with the PDPA to ensure it is protected to a standard comparable to protection under Singapore law, such as using reputable providers and contractual safeguards where appropriate.

9. Retention

We keep personal data while your account is active and for as long as needed to provide the Service, resolve disputes, enforce our Terms, meet legal or accounting requirements, and maintain security records.

When data is no longer needed, we delete or anonymise it where reasonably practicable.

10. Your rights (PDPA)

Subject to the PDPA and applicable exceptions, you may request to:

• Access personal data we hold about you
• Correct inaccurate personal data
• Withdraw consent for collection, use, or disclosure (where consent is the basis)
• Ask us to delete personal data where we are not required to retain it

Submit a request online at sg.enlightova.com/privacy/request, or email our Data Protection Officer at contact@enlightova.com. We may need to verify your identity (and parental authority, where relevant) before responding.

11. Cookies and tracking

We use cookies and similar technologies that are necessary for the Service to function (for example, authentication and security). We may also use analytics tools (including via Google Tag Manager) to understand site usage and improve Enlightova.

You can control cookies through your browser settings. Blocking some cookies may affect sign-in or other features.

12. Security

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. No online service can guarantee absolute security. Please keep your account credentials safe and tell us promptly if you suspect unauthorised access.

13. Changes

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date on this page. Where changes are material, we may provide additional notice through the Service or by email where appropriate.

14. Contact and Data Protection Officer

We have designated a Data Protection Officer (DPO) to oversee personal data protection matters and PDPA-related requests for Enlightova.

Data Protection Officer: Madhavan Ekanathan
Online privacy requests: /privacy/request
DPO business contact: contact@enlightova.com

Use the form or email contact for privacy questions, data access, correction, deletion, consent withdrawal, and personal data complaints or incidents.

Operator: Inner Sharp Consulting Pty Ltd (ABN 70 664 952 667), trading as Enlightova.