How PencilScope handles personal data.

Data we process

Depending on how you use PencilScope, we process account identity and contact details, country and language, authentication and session data, profile information, creator content and media, learning activity and assessment results, course participation, support messages, device/browser context supplied with problem reports, transaction references, payout status and audit/security events.

Why we use it

We use data to create and secure accounts; provide learning, publishing, communication and AI-connected features; process purchases and payouts; prevent fraud and abuse; provide support; comply with law; maintain records; and improve reliability. Where GDPR applies, the usual legal bases are contract, legal obligation, legitimate interests assessed against individual rights, and consent where genuinely optional.

Sharing and processors

Data is shared only as needed with creators or learners involved in a service, authorised staff, and service providers supporting hosting and security, payments, email delivery, identity sign-in, calendars and online meetings. Current integrations may include Cloudflare, Stripe, Resend, Google and Facebook. We may disclose data where required by law or necessary to protect people and the platform.

International transfers

Providers may process data outside Singapore or the country where it was collected. PencilScope uses contractual and other appropriate safeguards intended to provide protection comparable to applicable requirements, including recognised transfer mechanisms where GDPR applies.

Retention

We retain data only for the service, security, dispute, accounting and legal periods that apply to it. Account content may be removed or anonymised after closure, while payment, assessment, security and audit records may need longer retention. Deleted private assets may remain recoverable for a limited period before permanent purge.

Your choices and rights

You may request access or correction and, where applicable, deletion, restriction, portability or objection. You may withdraw optional consent without affecting earlier lawful processing. We verify requests and may retain information where required for payments, security, disputes or law. GDPR requests are normally answered within one month; under Singapore PDPA, if an access or correction response cannot be completed within 30 days, we will provide the expected response time.

Children

PencilScope is designed for learning but does not permit a child to independently create a contractual account. A parent or legal guardian must create and manage the account where the user is under 18. We minimise child data and apply additional care to communications, profiling and learning records.

Security and incidents

Controls include role-based access, restricted private storage, encryption in transit, session controls, audit logs and monitored operational events. No system is risk-free. PencilScope assesses suspected breaches and makes regulatory or individual notifications when legally required.

Updates and complaints

Material changes create a new notice version and may require renewed acknowledgement. You may raise concerns with PencilScope and retain the right to contact the Singapore PDPC or an applicable European supervisory authority.