Privacy Policy
Effective: 12 October 2026
This policy covers the myEdu Parents app, the myEdu Staff app and the myEdu service behind them. Both apps are tools for tuition and enrichment centres that use myEdu. It explains what personal data is handled, why, who sees it, how long it is kept, and how to ask for access, correction or deletion.
1. Who we are
myEdu is operated by First To Fly Pte. Ltd. ("First To Fly", "we", "us"), a company registered in Singapore, UEN 202509233N. Contact: [email protected].
Each tuition or enrichment centre that uses myEdu is a separate business. Which one holds your data depends on which centre your child attends or which centre employs you.
2. Who is responsible for your data
- The centre is the data controller (in Singapore PDPA terms, the organisation responsible for the personal data). It decides what data to collect about its students, parents and staff, why, and for how long. It is also the first place to ask about your data.
- First To Fly is the data intermediary (processor) for the centre. We store and process the data only to provide myEdu to that centre and follow its instructions. We do not use centres' data for our own marketing, advertising or profiling, and we do not sell it.
- For the small amount of data we hold about the centre's contact people and our own website enquiries, First To Fly is the controller.
Legal basis: Singapore's Personal Data Protection Act 2012 (PDPA). Some centres are in Malaysia (myEdu supports MYR billing and a Malaysian payment gateway). For those centres the Malaysian Personal Data Protection Act 2010 also applies to the centre.
3. What data is handled
Parents and guardians (myEdu Parents)
- Name, email address, mobile number, and the centre code that links you to your centre.
- A password, kept only as a one-way hash (Argon2), never in readable form.
- Your language choice, appearance choice and whether you accept marketing emails.
- Messages you write to the centre, absence notices and class change or make-up requests.
- Your payment history and receipts. When you pay online, you are sent to the payment provider's own page. We receive the status and amount of the payment, not your card or bank login.
Children (held for the centre)
Names, class enrolments, schedule, attendance, report cards, exam results, invoices and balances. The centre may also hold date of birth, gender, school, emergency contacts, photo and photo consent, and notes. This data is entered by the centre's staff or supplied by a parent when registering. We do not collect data from children directly, and children do not use the apps.
Centre staff (myEdu Staff)
- Name, email, role, centre, and a password hash.
- What you do in the app: attendance you mark, payments you record, approvals, lead notes, broadcasts.
- If you allow notifications: a push token for your device, your phone type (iPhone or Android) and your language.
- Information about students and parents that your job needs: contact details, class lists, balances, absences, leads (parent name, mobile, email, child's name).
Technical data
- When you use the apps or the service, our servers log your IP address, your phone's user agent and, for actions that change data, a record of what was changed (an audit log). Passwords are removed from this log. This is used for security and to answer "who changed this".
- The apps check an update service run by Expo for new versions of the app's code. Expo receives your IP address and the app version when it does.
- On your phone: sign-in tokens in the phone's secure storage (Keychain on iPhone, Keystore on Android), and your language and appearance settings. Signing out removes the tokens.
What the apps do not collect
No location, contacts, camera, photos, microphone or advertising ID. No analytics, crash-reporting or advertising services run inside either app. No data is used to track you across other companies' apps or websites.
4. Why the data is used
- To run your account and show you what the centre shares with you: lessons, attendance, fees, results, messages and announcements.
- To let centre staff run classes, attendance, billing, enquiries and communication with parents.
- To take and record payments.
- To send notices: in-app notifications, emails (invoices, receipts, reminders, password reset), and, for staff who allow it, push notifications.
- To keep the service secure, find faults, and prevent misuse.
- To send marketing emails, only if you switch them on (Me tab in myEdu Parents). You can switch them off at any time. These are sent by your centre through myEdu, about its own classes and events.
We do not make decisions about you by automated means that have legal or similarly significant effects.
Centre administrators may use optional AI-assisted tools in the web admin (for example drafting a report-card comment, generating practice questions, or marking written answers). These are not part of the mobile apps. When used, the relevant text, which can include a student's name and answers, is sent to an AI provider (Anthropic) to produce the draft, and a staff member reviews it before anything is saved or shared. The provider processes this text only to return the draft and does not use it to train its models.
5. Who we share data with
| Recipient | What | Why |
|---|---|---|
| Your centre and its authorised staff | Everything described above about its own families and staff | The centre is the controller. Staff only see what their role allows |
| Payment provider: Airwallex (PayNow, Singapore). Malaysian payments (RinggitPay) are not available yet; this policy will be updated before they are | Amount, invoice reference, and the payer details needed to take the payment | To take payments. Airwallex runs the payment page and has its own privacy terms |
| Amazon Web Services | All stored data (database, files) in Singapore (ap-southeast-1); outgoing email through Amazon SES | Hosting and email delivery |
| Expo (Expo Application Services) | Push token and message for staff push notifications; update checks (IP, app version) | To deliver push notifications and app updates. Apple Push Notification service or Google Firebase Cloud Messaging then delivers the notification to the phone |
| AI provider (Anthropic) | As in section 4, web admin only | Draft assistance |
| Authorities | Only what the law requires | Legal obligation |
We do not sell personal data. We do not share it with advertisers or data brokers. The providers above are the only ones that receive personal data.
6. Where data is stored
On servers of Amazon Web Services in Singapore. Some providers in section 5 (Expo, Apple, Google, Airwallex, Anthropic) may process limited data outside Singapore. For those, we rely on their contractual protections as required by the PDPA Transfer Limitation Obligation.
7. How long data is kept
Each centre can set its own retention windows. The defaults are:
| Data | Default |
|---|---|
| Students | Kept while enrolled. About 7 years after the last enrolment ended, then personal details are removed |
| Parents and guardians | Kept while linked to any student whose data is still held. When all linked students have been removed, the guardian record is removed too |
| Staff accounts | About 2 years after the account was removed by the centre |
| In-app and push notification records | 90 days |
| Registration enquiries that were rejected, withdrawn or marked spam | Only removed if the centre sets a period. Otherwise kept |
| Login sessions and password-reset links | Removed automatically once expired or used |
What "removed" means here: a scheduled job overwrites the person's name, contact details, notes and messages with a blank marker and deletes related messages, notifications, emergency contacts and photo files. The row stays so the centre's financial and attendance counts remain correct, and records the law requires the centre to keep (for example invoices and receipts, which may be kept for 5 years or longer under tax and accounting rules) stay in anonymised form. Audit-log entries are kept as long as the records they relate to.
Backups made by our hosting provider are kept for about 7 days and then expire.
If a centre stops using myEdu, we delete or return its data as the centre instructs, within 30 days of the instruction or the end of the agreement.
8. Security
- Traffic between the apps and our servers is encrypted (HTTPS).
- Stored data is encrypted at rest in the database.
- Passwords are stored as Argon2 hashes. Sign-in tokens are short-lived and kept in the phone's secure storage. Sessions can be revoked.
- Staff access is limited by role. Changes are written to an audit log.
- The apps request only the permissions they need (staff: notifications; parents: none).
No system is perfectly secure. If we become aware of a breach that is likely to harm people, we will tell the centre without delay and help it notify the regulator and affected people as the law requires.
9. Your rights and how to use them
You can ask for:
- Access to the personal data held about you (a parent can see their own account data in the app and ask for a full copy of it).
- Correction of data that is wrong.
- Deletion of your data, or of your account.
- Withdrawal of consent where we rely on it, such as marketing email.
- A complaint to the data protection regulator: the Personal Data Protection Commission in Singapore (pdpc.gov.sg), or in Malaysia the Personal Data Protection Commissioner.
How to ask. Because the centre is the controller, the quickest route is to ask the centre. You can also write to us at [email protected] with your name, the centre and what you want. We will check who you are, pass the request to the centre where it must decide, and reply within 30 days (the period the PDPA expects).
Marketing emails: switch off in the Me tab of myEdu Parents, or use the link in the email.
Delete your account
- Parents. In myEdu Parents, open the Me tab and tap Delete my account. This removes your login, signs you out on every device and stops notifications. You can also email [email protected] or ask your centre. Your guardian record and your children's records belong to the centre; ask the centre if you also want those removed. The centre may need to keep some records, for example invoices, for legal reasons, and will tell you what is kept and why.
- Staff. Ask your centre administrator, who can close your account and remove your personal data, or write to us at the same address.
- Children's data. A parent can ask the centre to remove their child's data. When it is removed, the child's name, details, notes, messages and photo are erased as set out in section 7.
10. Children
The apps are for adults: parents and guardians in myEdu Parents, and centre staff in myEdu Staff. They are not directed at children, and children are not meant to sign in. A child's information appears in the apps because the centre holds it for the child's enrolment and a parent or guardian is entitled to see it. It is entered by the centre's staff or by a parent. We do not knowingly collect data directly from a child. If you believe a child has created or used an account, tell the centre or us and we will act on it.
11. Changes to this policy
When we make a material change we will update the date at the top and tell users in the app or by email before the change starts. Small corrections (typing errors, clarity) may be made without notice. Earlier versions are available on request.
12. Contact
First To Fly Pte. Ltd. UEN 202509233N Singapore Email: [email protected] Data protection officer: reachable at [email protected]
---