How we look after your family's information
Last updated: [date you publish]. Baca dalam Bahasa Malaysia.
[DRAFT. Have this checked by a lawyer before you publish. It is not legal advice.]
Who we are
Everstep Learning ("we") provides one-to-one maths tuition and daily practice worksheets in the Klang Valley, Malaysia, at home and online. We are the data user (controller) of your family's personal data under the Personal Data Protection Act 2010 (PDPA). Business owner: Yin Kai Tan. [Business registration no. once registered with SSM]
What we collect
- About you (parent or guardian): name, phone number, email, and your address for home lessons. If you create a family account: your login email, an encrypted password (we never see it) and your parent PIN, stored only as a scrambled code.
- About your child: first name, school year, school syllabus, maths level, each worksheet's answers, scores and times, the kinds of mistakes made, and lesson notes. Your child's PIN is stored only as a scrambled code. Children never need an email address.
- Messages: what you send us on WhatsApp or email.
We do not collect sensitive personal data such as health or biometric information. If your child has a learning need you want us to know about, please tell us only what helps us teach.
Why we use it
- To assess your child, choose the right starting point and plan lessons.
- To run the practice app: show today's worksheet, mark it and record progress.
- To send you progress updates and contact you about lessons and fees.
- To match your child with a tutor.
- To keep the service safe, fix problems and meet legal duties.
We don't sell your data, and we don't use it for advertising or share it with advertisers.
Consent for children
A parent or guardian creates the family account and gives consent for each child. If you are under 18, please ask a parent or guardian to contact us.
Who we share it with
Only Everstep and the tutor(s) assigned to your child can see your child's learning record. If a tutor changes, the new tutor receives the record so progress continues. We also use these service providers to run Everstep. They handle data only on our instructions:
- Supabase: stores family accounts and worksheet records. Server region: [region you chose, e.g. Singapore].
- Netlify: hosts this website and the app.
- Zoho Mail: our email.
- WhatsApp (Meta): messages you choose to send us.
- Google Fonts: loads the typeface on our pages; Google receives your device's IP address when a page loads.
Some of these providers store data outside Malaysia. We use them only where the PDPA allows it and where they protect data to a standard at least as strong as Malaysian law.
Cookies and storage
We don't use advertising or tracking cookies. The practice app stores your login session on your device so you stay signed in; this is needed for the app to work. If we ever add analytics, we will update this notice first.
How we protect it
All pages use encrypted connections (HTTPS). Each family can see only its own records, enforced by the database itself. Passwords are handled by our login provider and never stored in readable form. If a data breach happens that is likely to cause you significant harm, we will tell you and the Personal Data Protection Commissioner as the law requires.
How long we keep it
While your child learns with us, and for [12 months] afterwards in case you return. Then we delete it, unless the law requires us to keep it longer (for example, payment records).
Your rights
- See the data we hold about your family, and get a copy.
- Correct anything that is wrong.
- Ask us to send your child's learning record to you or another provider in a common format.
- Withdraw consent, or ask us to delete your family's data.
- Tell us not to send marketing messages.
Message us on WhatsApp or email us and we'll respond within [21 days]. You can also delete a child's profile yourself in the parent area of the app. If you are unhappy with how we handled your request, you can complain to the Personal Data Protection Department (JPDP).
Photos and videos
We never post a photo, video or work of your child without your written consent, and we never show a child's face together with their full name or school. You can ask us to remove content at any time.
Contact
Everstep Learning · Data protection contact: Yin Kai Tan · hello@everstep.my · WhatsApp +60 16-924 8933
Changes
We'll update the date at the top when this notice changes, and tell existing families about important changes.