Privacy Policy

Last updated: 22 September 2026

This policy explains how ShiftedTech (“we”, “us”), a Singapore business, handles personal data in RemindClient, and how that fits with Singapore's Personal Data Protection Act (PDPA).

1. Two roles

• Your own account. We decide why and how your account details are used, so we are responsible for them.
• Your clients' information. The tutor or coach decides which students, parents and payers to add and why. We store and process that information on the coach's behalf (in PDPA terms, we are a “data intermediary”). If you are a parent or student and have a question about your details, please ask your tutor first. You can also contact us and we'll help.

2. What we collect

Your account (coaches): your email address and name (if you sign in with Google, what Google shares with us), a unique account ID, your plan and trial dates, the version of these documents you accepted and when, and your confirmation that you are 18 or older. If you connect Telegram notifications, we also keep your Telegram chat ID.

Your clients' information (entered by you): client name and phone number, payer or parent name and phone number, lesson days, times and locations, fee and currency, payment status and dates, notes, reminder settings and messages, and calendar events.

Parents and students on Telegram: when someone opens your connection link and starts our bot, we store their Telegram chat ID, display name and username so reminders reach the right chat. We also record the buttons they tap (such as “I've Paid”). If they send a payment screenshot, we store the image in private storage.

AI chat: when you ask the assistant for a draft, we send Google's Gemini the selected client's name, phone numbers, payer, lessons, fee, payment status, last-paid date and your notes, plus your name and the conversation. The conversation lives in your browser while the page is open; we don't keep chat transcripts on our servers. We do keep a daily count of your AI messages to apply plan limits.

Technical data: our hosting keeps request logs (which page or API was requested, the time, the result, your IP address and browser type) for about 30 days to keep the service running and secure. When you create an account, Cloudflare Turnstile checks that you're not a bot and receives your IP address and browser signals. Fonts load from Google Fonts, so Google sees your IP address when a page loads.

Cookies and similar: we use your browser's storage to keep you signed in and to remember small choices, such as dismissing the trial banner. We don't use advertising or analytics trackers.

3. Why we use it

• to create and secure your account;
• to provide the service: keep your records, show your calendar, draft and send reminders, and track payment claims;
• to alert you and to contact you about your account or the service;
• to keep the service safe and stop abuse; and
• to meet our legal obligations.

We'll only email you promotional material if you've asked for it, and every such email will have a way to unsubscribe.

4. Who we share it with

We use these providers to run the service. They process personal data for us and only for that purpose:

• Google — sign-in (Firebase Authentication), our database (Cloud Firestore), hosting (Cloud Run), private storage for receipts (Cloud Storage), logs, and the Gemini AI service used for message drafts.
• Cloudflare — the Turnstile bot check on sign-up.
• Telegram — delivers reminders and receives parents' replies through our bot.

WhatsApp is different: when you tap a WhatsApp button, the message opens on your own device. We don't send data to WhatsApp. We also don't sell personal data. We may disclose it if the law requires us to.

5. Where it's stored

Our database and receipt storage are in Singapore (Google Cloud, asia-southeast1). Some providers, including Gemini, Firebase Authentication, Cloudflare and Telegram, may process data outside Singapore. When personal data leaves Singapore, we take steps to make sure it is protected to a standard comparable to the PDPA, including through our providers' terms.

6. How long we keep it

• We keep your data while your account is active.
• Deleting a client in the app removes their record and calendar events straight away. Payment screenshots are stored separately, and we delete them when you ask us to or when your account is deleted.
• When a trial ends and you don't subscribe, your account becomes read-only. We may delete your data about 60 days after the trial ends.
• To delete your whole account, email us. We'll delete your account, clients and receipts within 30 days.
• Deleted data can stay in encrypted backups for up to 7 days, and in logs for up to about 30 days.
• A coach can disconnect a client's Telegram in the app, which removes the stored chat ID, name and username. A parent can also stop messages at any time by blocking the bot.

7. Security

Connections to RemindClient are encrypted. Data is stored in Google Cloud, which encrypts it at rest. Each coach's records are kept separate and checked on every request, and receipts sit in private storage that only the owning coach can view through the app. Access on our side is limited to what is needed to run the service. No system is perfectly secure, so if a breach happens that is likely to cause significant harm, we will notify affected coaches and the Personal Data Protection Commission as the law requires.

8. Your choices and rights

You can ask us to give you a copy of your personal data, correct it, delete it, or stop using it. You can also withdraw consent. Email us (see below) and we'll reply within 30 days. If you withdraw consent or ask for deletion, we may not be able to keep providing the service to you.

For information about a student or parent, we'll work with the coach who added it.

9. Children

RemindClient is for adults. Accounts require you to be 18 or older, and we don't knowingly allow anyone under 18 to create one. Coaches may add information about students who are minors, and they are responsible for doing so properly (see our Terms of Service). We use that information only to run lessons and reminders, and messages go only to the chat a parent or payer has connected. If you believe a child has an account, or you'd like a child's information removed, please email us.

10. Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change matters, the app will ask you to read and accept it before you carry on.

11. Contact

Data Protection Officer, ShiftedTech: fahmymahamud@gmail.com.