Privacy Policy

1.1 This Privacy Policy ("Policy") describes how X Operators Group ("we", "us", or "our"), operator of the TutuTap platform ("TutuTap"), collects, uses, discloses, retains, and protects personal data in connection with the TutuTap website, parent application, tutor application, registration and onboarding flows, messaging, subscriptions, support, marketing, and related services (collectively, the "Platform").

1.2 This Policy applies to parents, legal guardians, tutors, tutor applicants, visitors, and other users who interact with the Platform.

1.3 By accessing or using the Platform, submitting information, or creating an account, you acknowledge that you have read and understood this Policy. Where required by law, we will seek your consent for specific processing activities.

1.4 This Policy should be read together with the Terms of Use and incorporated documents at tututap.com/legal.

2.1 For the purposes of the Personal Data Protection Act 2012 of Singapore ("PDPA") and this Policy, the data controller is:

X Operators Group Singapore

2.2 Privacy enquiries, access requests, correction requests, consent withdrawals, and complaints may be directed to:

Email: hello@tututap.com Subject line: "Privacy Request" Legal hub: tututap.com/legal

2.3 We will respond within timeframes required by applicable law. Complex requests may require additional time with notice.

3.1 The categories of personal data we may collect include:

telephone number, residential area or postal district, nationality, race (if voluntarily provided), gender (if voluntarily provided), date of birth, and profile photograph.

identifiers, subscription tier, plan status, preferences, and settings.

availability, biography, teaching experience, qualifications, education history, languages, lesson formats offered, and public portfolio content.

identity documents, educational transcripts, certificates, resumes, employment or study pass information, and other documents submitted for verification or onboarding.

learning goals, scheduling preferences, and notes you choose to provide. Parents must not upload unnecessary identifying information about children in public or broadly shared areas.

address, payment method tokens or partial card details as processed by payment providers, invoices, and tax-related information where applicable. Tuition payments between parents and tutors are generally not processed by TutuTap unless a specific payment feature is enabled.

reports, reviews, ratings, complaints, support tickets, and attachments.

browser type, app version, log files, cookies and similar technologies, analytics events, crash reports, security signals, and approximate location derived from IP.

interactions, referral codes, and communication preferences.

indicators, and aggregated analytics produced from the above.

3.2 We collect personal data when you provide it directly, when you use the Platform, when other users interact with you through the Platform, from service providers, and from publicly available sources where permitted by law.

3.3 You are responsible for ensuring that personal data you provide about third parties (including children) is provided lawfully and with appropriate authority or consent.

• (a) Identity and contact data: full legal name, display name, email address,
• (b) Account and authentication data: username, hashed credentials, account
• (c) Tutor profile and professional data: subjects taught, levels, rates,
• (d) Verification and compliance data (tutors): legal name, residency status,
• (e) Parent and child-related data: child's academic level, subject needs,
• (f) Transaction and billing data: subscription payments to TutuTap, billing
• (g) Communications and user-generated content: enquiries, messages, lesson
• (h) Technical and usage data: IP address, device type, operating system,
• (i) Marketing and communications data: newsletter subscriptions, campaign
• (j) Inferences and derived data: match scores, ranking signals, fraud risk

4.1 We use personal data for the following purposes:

display, search, matching, messaging, notifications, and feature delivery.

communicate with each other. TutuTap is a marketplace only and does not employ tutors or guarantee outcomes.

and eligibility. Verification reflects review at a point in time and does not guarantee safety or qualifications.

renewals, auto-billing, fraud prevention, and enforcing our strict no-refund policy except as stated in Subscription Terms.

enforcing Terms of Use, Safety & Community Standards, and applicable law.

responses, and — where permitted — marketing about TutuTap products.

features, and conducting research on aggregated or de-identified data.

legal rights, and maintaining records.

acquisitions, financing, or asset sales.

4.2 We do not guarantee any particular academic, financial, or matching outcome through our use of personal data.

• (a) Operating the Platform: account creation, authentication, profile
• (b) Marketplace facilitation: enabling parents and tutors to discover and
• (c) Verification and trust signals: reviewing tutor applications, documents,
• (d) Billing and subscriptions: processing payments to TutuTap, managing
• (e) Safety and enforcement: moderating content, investigating reports,
• (f) Communications: service announcements, security alerts, support
• (g) Improvement and analytics: understanding usage, debugging, developing
• (h) Legal and regulatory compliance: responding to lawful requests, exercising
• (i) Corporate transactions: evaluation and completion of mergers,

5.1 Under the PDPA and applicable law, we rely on one or more of the following bases as appropriate:

consent, or where consent is deemed or permitted under the PDPA.

you or to take steps at your request before entering a contract.

service improvement, and enforcement of our terms, balanced against your rights and reasonable expectations.

orders, or lawful government requests.

life or safety.

5.2 Where consent is the basis, you may withdraw consent subject to legal and contractual restrictions. Withdrawal may limit Platform functionality.

5.3 Marketing communications require consent or another lawful basis under the PDPA. You may opt out of marketing at any time via unsubscribe links or by emailing hello@tututap.com.

• (a) Consent: where you have been notified of the purpose and have given
• (b) Contractual necessity: processing necessary to perform our contract with
• (c) Legitimate interests: fraud prevention, network and information security,
• (d) Legal obligation: compliance with applicable laws, regulations, court
• (e) Vital interests: rare situations where processing is necessary to protect

6.1 We may disclose personal data to:

tutor profiles to parents, sharing enquiry details with tutors, and publishing reviews you submit. Control what you share in public profiles and messages.

processing, analytics, email delivery, customer support tools, identity verification vendors, and professional advisers, under contractual confidentiality and data protection obligations.

corporate transactions, subject to this Policy or successor notice.

process, or to protect rights, safety, and security of TutuTap, users, or the public.

management.

6.2 We do not sell personal data in the ordinary course. If we introduce data sharing practices that constitute a sale or require opt-out under future law, we will update this Policy and provide required choices.

6.3 Parents and tutors who exchange contact details or arrange lessons off- Platform do so at their own risk. TutuTap is not responsible for subsequent disclosure by users.

• (a) Other users: as necessary for marketplace operation, such as displaying
• (b) Service providers and processors: hosting, cloud infrastructure, payment
• (c) Affiliates and successors: entities under common control or acquirers in
• (d) Authorities and legal process: where required by law, regulation, legal
• (e) Insurers and legal counsel: in connection with claims, disputes, and risk

7.1 Personal data may be processed in Singapore and other countries where we or our service providers operate.

7.2 Where personal data is transferred outside Singapore, we will take steps required under the PDPA and applicable law, which may include ensuring the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA.

7.3 By using the Platform, you acknowledge that cross-border transfers may occur for the purposes described in this Policy.

8.1 We retain personal data only for as long as reasonably necessary to fulfil the purposes described in this Policy, including operating the Platform, resolving disputes, enforcing agreements, and meeting legal, tax, accounting, audit, and safety requirements.

8.2 Verification documents and records relating to safety reports may be retained for longer periods where required by law, legitimate interest in fraud prevention, or pending investigations.

8.3 When data is no longer needed, we will delete, anonymise, or aggregate it in accordance with our retention schedule and technical capabilities. Residual copies may persist in backups for a limited period.

8.4 Account closure does not automatically delete all data. See Section 11 for your rights.

9.1 We implement reasonable administrative, technical, and organisational safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

9.2 No method of transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your credentials.

9.3 Notify hello@tututap.com promptly if you believe your account or data has been compromised.

10.1 We use cookies, pixels, local storage, and similar technologies for authentication, preferences, analytics, security, and marketing where permitted.

10.2 You may control cookies through browser settings. Disabling cookies may affect Platform functionality.

10.3 We may use third-party analytics providers subject to their policies and our contractual restrictions.

11.1 Subject to exceptions under the PDPA and other applicable law, you may have the right to:

under our control;

contractual consequences;

disclosed in the past year where required by the PDPA; and

Singapore if you believe we have handled your personal data contrary to the PDPA.

11.2 Submit requests to hello@tututap.com with sufficient information to verify your identity. We may refuse requests that are unreasonable, repetitive, or prohibited by law.

11.3 We may charge a reasonable fee for access requests where permitted by the PDPA.

11.4 Withdrawing consent or deleting data may prevent use of the Platform and does not entitle you to refunds of TutuTap subscription fees under our strict no-refund policy except as stated in Subscription Terms.

• (a) request access to personal data about you that is in our possession or
• (b) request correction of inaccurate or incomplete personal data;
• (c) withdraw consent for processing based on consent, subject to legal and
• (d) request information about how your personal data has been used or
• (e) lodge a complaint with the Personal Data Protection Commission (PDPC) in

12.1 The Platform is directed at adults. Accounts must be created by parents, guardians, or eligible tutors aged 18 or older unless otherwise permitted by law and our onboarding process.

12.2 Parents provide information about children only as reasonably necessary for tuition matching. Avoid sharing excessive identifying details in public areas.

12.3 TutuTap does not knowingly collect personal data directly from children without appropriate parental authority. If you believe we have collected data from a child improperly, contact hello@tututap.com.

12.4 Parents remain responsible for supervising lessons and safeguarding children. TutuTap does not guarantee safety outcomes.

13.1 We may use automated systems to rank search results, suggest matches, detect fraud, and moderate content. These systems do not produce legal or similarly significant effects solely by automated means without human involvement where required by law.

13.2 Match and ranking outputs are informational only. We do not guarantee tutor availability, lesson quality, or outcomes.

14.1 The Platform may contain links to third-party websites, apps, or services (e.g. video conferencing, payment wallets). Their privacy practices are governed by their own policies.

14.2 TutuTap is not responsible for third-party data practices.

15.1 If we become aware of a data breach that is likely to result in significant harm or is notifiable under the PDPA, we will take reasonable steps to assess, contain, and notify affected individuals and the PDPC as required by law.

16.1 We may update this Policy from time to time. The "Last updated" date will change when we do.

16.2 Material changes will be communicated through the Platform, email, or other appropriate means where required by law.

16.3 Continued use after the effective date constitutes acknowledgement where permitted. Where renewed consent is required, we will obtain it.

17.1 While we take reasonable steps to protect personal data, we disclaim liability for unauthorised access caused by factors outside our reasonable control, user negligence, or third-party actions, subject to applicable law and the limitation of liability in the Terms of Use.

17.2 Verification and moderation based on personal data do not guarantee user conduct, safety, or qualifications.

18.1 This Policy is governed by the laws of Singapore. Disputes relating to personal data are subject to the dispute resolution provisions in the Terms of Use, including the thirty (30) day good-faith resolution period via hello@tututap.com before court proceedings (except urgent relief).

X Operators Group Email: hello@tututap.com Legal hub: tututap.com/legal

For general terms, see Terms of Use at tututap.com/terms.