Privacy Policy

This policy explains how RESU handles personal data when you visit our website, create an account, study with us, send feedback or submit a refund request. The operator and privacy contact are identified below. We handle personal data in accordance with Singapore’s Personal Data Protection Act 2012 (PDPA).

A feature may have an additional notice explaining information needed for that feature. We will identify new purposes and obtain consent where required before using your data for them.

• Account details: your email address, account ID, display name, full name on your exam registration, preferred paper, intended exam sitting, previously supplied training-provider details and referral codes, setup progress and authentication information used by our account provider to manage sign-in and recovery.
• Study activity: saved answers, answer reveals, attempts, scores, mock submissions, progress and resume positions, together with timestamps, question and key versions, syllabus mappings and review status.
• Feedback and correspondence: difficulty ratings, comments, the question context attached to feedback, and messages you exchange with us.
• Purchase and refund information, where applicable: payment references, amounts, covered papers, accepted policy versions, candidate details, examination sitting and results, original results emails you upload, verification records and claim correspondence. An original email can contain sender and recipient details, message headers, body text and attachments.
• Technical and device information: session cookies, browser preferences and local study caches. Our hosting and service providers may also process IP addresses, browser information and request or error logs when delivering and protecting the service.

We use information needed to create and secure your account, restore saved work across devices, calculate study progress, provide practice comparisons, review feedback, answer requests and improve the reliability and quality of the service. If you purchase access or make a claim, we also use relevant information to administer access, verify eligibility, prevent duplicate or fraudulent claims, process refunds and keep transaction records.

We collect, use and disclose personal data with your consent where required, or where the PDPA or another applicable law permits or requires it. Creating an account is not blanket consent to unrelated marketing. Account confirmation, password recovery and requested service messages are separate from optional product updates.

Your study reports use your retained answers and mock history. Resetting your current answers does not erase this history. Peer comparisons can show your mock score and placing under a pseudonymous learner label, alongside aggregated score distributions. They do not give other learners access to your email address, individual answers or feedback.

Authorised reviewers can read submitted feedback and its question context to investigate content issues. Authorised refund reviewers can inspect claim evidence and verification findings. Where automated email or eligibility checks flag a refund request for review, a reviewer may request more information. You can ask us to correct inaccurate information or review a disputed outcome.

We use session cookies to keep you signed in and support account verification. Browser storage keeps pending study changes, cached progress, local drafts, answer annotations, resume positions and layout or syllabus preferences. Notification preferences currently save in your browser; optional notification delivery is not yet enabled.

Your browser can block cookies or clear stored data, although this can prevent sign-in or remove changes that have not synced. The profile settings control for deleting browser study data removes local records for that account. It does not delete the account or information already saved on our servers, and saved progress may download again when you return.

The current app does not use advertising cookies or third-party advertising trackers. We will provide an appropriate notice and choices before introducing optional tracking that requires them.

We use Supabase for account authentication, stored study records and private refund evidence. Hosting and technical service providers process information needed to deliver and secure the app. Where enabled, Stripe handles payment and refund processing, and Resend delivers refund service emails. Payment card processing takes place with the payment provider; our refund records use payment references rather than full card details.

Access within RESU is limited to people who need it for their work. Providers should process data only for the agreed service purposes and subject to appropriate confidentiality and data-protection arrangements. We may also disclose information where lawfully required by a court or authority, or where permitted to investigate fraud or protect legal rights. We do not sell personal data.

Providers may process or support data outside Singapore. Where we transfer personal data overseas, we will put in place safeguards required by the PDPA, including a legally recognised transfer arrangement that provides a comparable standard of protection where required. Contact us for information about the arrangements relevant to your data.

We keep information for as long as needed for the purposes described here, including maintaining your account and study history, administering a purchase or claim, resolving disputes and meeting legal obligations. We will delete or anonymise personal data when those purposes end and there is no longer a legal or business need to retain it.

Original refund evidence is subject to a separate retention period after a claim is resolved, with additional retention where needed for an active dispute or legal obligation. We may retain limited transaction, decision and audit records separately from the original evidence. The retention schedule for this draft remains subject to operator confirmation.

Account closure and deletion requests require a separate review; there is currently no self-service account-deletion control. Feedback and editorial context may remain separately from account and study records where still needed for a lawful purpose. We will explain any information we must retain and why, and remove identifying details when they are no longer needed.

We use reasonable technical and organisational safeguards, including authenticated access, account-specific permissions and restricted access to private claim evidence. No internet service can guarantee absolute security. Protect your password and use a separate browser profile on shared devices, as locally stored study information is accessible to someone who controls that browser profile. We will assess suspected data breaches and notify the relevant authorities and affected individuals where required by law.

Contact our privacy contact below to request access to personal data we hold about you and information about its use or disclosure in the preceding year, to correct an error, to withdraw consent on reasonable notice, or to raise a privacy concern. These requests are subject to the PDPA’s requirements and exceptions.

Include your account email and a description of the request. We may ask for proportionate identity verification before disclosing or changing data. We will respond as soon as reasonably possible; if an access or correction request needs more than 30 days, we will tell you within that period when to expect a response. If a reasonable access fee applies, we will explain it in advance.

We will explain the likely effect of withdrawing consent. Some features may no longer work if they require the relevant data; necessary processing permitted or required by law may continue. You may also raise an unresolved concern with Singapore’s Personal Data Protection Commission.

We will update the date on this page when this policy changes and give appropriate notice of material changes. A policy update does not by itself provide consent for a new purpose that requires your consent. We will explain that purpose and ask where required.

Direct privacy requests and concerns to the RESU data protection contact.

Registered operator

To be confirmed

UEN and business address

To be confirmed

Privacy / DPO email

To be confirmed