Privacy Policy

Last updated: 25 September 2026

We take privacy seriously, including the privacy of children and families. This Privacy Policy explains what information LivelyRead (Reading App) uses, what we save, and how artificial intelligence (AI) is used to help you or your child learn to read.

1. Scope, Age Range and Availability

LivelyRead (Reading App) is designed for learners aged 3 to 99. It is currently offered only to users located in Singapore; if we expand to other countries in the future, we will update this Policy accordingly.

This Policy is intended to comply with Singapore's Personal Data Protection Act 2012 (PDPA).

• Users aged 18 and above may create and manage their own account and give their own consent to this Policy.
• For users under the age of 18, a parent or legal guardian must create the account and provide consent on the child's behalf. See Section 4 below and our Parent/Guardian Consent form.

2. Information We Save

We designed the Reading App to collect and store as little information as possible.

We do not save:

• voice recordings made during reading sessions;
• conversations between a user and the AI tutor; or
• transcripts of those conversations.

For reading progress, the Reading App saves only the last page read, so that the user can continue from where they stopped.

Usage records. When the AI reading tutor is used, we record when each session starts and ends and how much of the AI service it used, so we can charge the correct amount of credit and help with questions about charges. These records do not include what was said. Detailed per-turn records are deleted within 7 days; session records are kept for 12 months.

Where an account is created, we also process:

• account information — the name and email address of the Google account used to sign in, Google's identifier for that account, whether the account is for a child under 18 or an adult, the date and version of the consent given, and whether and when the email address was verified;
• credit information — the credit balance, the date it expires, and a record of any credit that expired unused; and
• where applicable, payment information needed to operate the account.

See Section 9 for how long this is retained.

Sign-up location check. The Reading App is offered only in Singapore, so when a new account is created we use the IP address of the device signing up to check that it is connecting from Singapore. The IP address is looked up in a country database held on our own server (IP geolocation data by DB-IP, https://db-ip.com, licensed under CC BY 4.0), so it is not sent to anyone else for this check, and it is not stored with the account. Our hosting provider's server logs, which include IP addresses, are kept for up to 30 days (see Section 11).

3. Voice and AI Processing

The Reading App uses the OpenAI Realtime API to provide the AI reading tutor.

When a user speaks to the AI tutor, audio and other information necessary for the conversation are transmitted to OpenAI for processing so that the AI tutor can understand the user and respond.

Although our Reading App does not save voice recordings or conversations, OpenAI may retain API inputs and outputs for a limited period for purposes such as abuse monitoring and security, subject to the API service and data-retention settings we use.

4. Account Set-Up, Consent and Email Verification

When an account is created, the account holder is asked who will use the account:

• a child under 18, in which case the account holder must be the child's parent or legal guardian; or
• the account holder themselves, in which case they must be 18 or older.

We record this choice, along with the date and version of the consent given. We do not ask for or store a date of birth.

Accounts for a child under 18. Before a child under 18 can use the AI reading tutor, the parent or legal guardian must:

1. Create the account using their own email address;
2. Complete the Parent/Guardian Consent step, confirming they are the child's parent or legal guardian and agreeing to this Policy; and
3. Verify that email address by clicking a confirmation link we send to it.

Accounts for users aged 18 and above. Adult users may create their own account and give their own consent to this Policy, without a parent's involvement, by confirming they are 18 or older. They must also verify their email address using the confirmation link.

The Reading App cannot be used until both consent and email verification are complete. The confirmation link expires after 24 hours, and a new one can be requested from the app.

We use this email verification and attestation process as a reasonable means of confirming that the person giving consent controls the account's email address. It does not independently verify age, identity or legal guardianship. Account holders remain responsible for the accuracy of the information they provide, including the choice of who will use the account.

If we make significant changes to this Policy or the Parent/Guardian Consent, we may ask account holders to review and accept the updated version before continuing to use the Reading App (see Section 12).

Parents and guardians are encouraged to supervise their child's use of the Reading App generally, and are welcome to stay involved in the reading of older children and adults.

5. How We Use Information

Information processed through the Reading App is used only as necessary to:

• provide the reading and AI tutoring functions;
• allow a user to continue from the last page read;
• operate and secure the service; and
• manage accounts and payments, where applicable.

We do not use children's information for advertising.

We do not sell personal information.

6. Third-Party Service Providers and Cross-Border Data Transfer

The Reading App is powered by AI processing using the OpenAI Realtime API and is hosted using Google Cloud Platform (GCP).

• OpenAI processes voice and conversation data to provide the AI tutor's understanding and responses, as described in Section 3.
• Google Cloud Platform hosts the application and processes the limited information described in Section 2 (such as the last page read and account information) to operate and secure the service.
• Google Sign-In, where used, processes information necessary to authenticate the account.
• Microsoft (Microsoft 365) sends the email-verification link described in Section 4 from our email domain, and processes the account's email address to do so.
• HitPay processes payments and provides us with information necessary to confirm and manage those payments. During our initial Singapore release, payments are made using PayNow. Other payment methods, including credit and debit cards, may be offered in the future.

Because these service providers may process information on servers located outside Singapore (for example, in the United States or other countries where OpenAI, Google Cloud or Microsoft operate data centres), a user's or child's information may be transferred to, and processed in, countries other than Singapore.

Where we transfer personal data outside Singapore, we take steps required under the PDPA to ensure the recipient provides a standard of protection comparable to the PDPA, including relying on our service providers' contractual and security commitments.

Information processed by our third-party service providers is handled according to their applicable terms, privacy commitments and data policies.

7. AI Training

By default, OpenAI does not use information submitted through its API, including inputs and outputs, to train or improve its AI models.

We do not opt in to sharing our users' API inputs and outputs with OpenAI for model training.

8. Analytics and Cookies

We do not use advertising cookies or third-party tracking cookies. We may use strictly necessary cookies or similar technologies to keep users signed in, maintain security and operate the Reading App. We do not use these technologies for advertising.

9. Data Retention

We do not retain voice recordings, conversations or transcripts.

We retain the last page read for as long as the account remains active, or until the associated information is deleted at the parent's or user's request.

Account information is retained for as long as the account remains active and thereafter only for as long as reasonably necessary for account administration, security, legal or accounting purposes. Section 11 explains the limited records that may be kept after an account is deleted, why, and for how long.

Payments are processed by third-party payment providers. We do not directly store full payment card or bank account details. Our payment providers process information necessary to complete and record payments in accordance with their own privacy and data-retention policies.

OpenAI and Google Cloud may separately retain certain data for a limited period in accordance with their own data-retention policies (see Sections 3 and 6).

10. Data Security

We take reasonable steps to protect information handled by the Reading App from unauthorised access, loss, misuse or disclosure.

However, no Internet-based service can guarantee absolute security.

If we become aware of a personal data breach, we will assess it and make notifications to affected individuals and the Personal Data Protection Commission (PDPC) where required under the PDPA.

11. Parents' and Users' Choices

A parent, legal guardian, or user aged 18 and above may:

• request access to, and a copy of, the information we hold about them or their child;
• request correction of information stored by us; and
• request deletion of the account and the information stored with it. This is also how consent is withdrawn: the Reading App cannot be used without consent, so withdrawing it means the account is closed and deleted as described below.

To make a privacy request, please contact us using the details below. We will respond within a reasonable time and in accordance with the PDPA.

What we keep after an account is deleted

When we delete an account at your request, we delete the account information, the last page read, and the usage and top-up records stored with it. A small number of limited records may survive the deletion, for the purposes and periods below:

• Deletion record (consent and billing summary). A record that the account was deleted, identified only by an internal account number. It contains the type of account (for a child under 18, or for an adult), the version and date of the consent given, and the credit balance, credit expiry date and top-up totals at the time of deletion. It does not include the name, email address, reading information or usage history. Purposes: to show that consent was obtained and that the deletion was carried out, and to reconcile credits and payments in our accounts. Kept for: 12 months after the deletion, then deleted. Records of other administrative changes to accounts (for example, a corrected credit balance) are kept for the same 12 months.
• Sign-up record. A one-way scrambled (hashed) form of Google's identifier for the account, with the date it was first used to sign up. It does not include the name, email address or any other account information, and cannot on its own be turned back into the identifier. Purpose: to make sure free starting credit is given only once per Google account, even if an account is deleted and created again. Kept for: as long as we offer free starting credit to new accounts, then deleted.
• Our correspondence about your request. The emails exchanged when you asked for the deletion, which include your email address. Purpose: to show which request was made and that we acted on it, since the deletion record above does not identify you. Kept for: 12 months after the request is completed, then deleted.
• Payment records held by our payment provider. Where a top-up was paid through HitPay, HitPay keeps its own record of the transaction. Purposes: to complete, record and reconcile payments and to meet legal, tax and anti-fraud obligations. Kept for: the period set by HitPay's own policies and applicable law, which we do not control.

Separately, copies of deleted information may remain for a short time in database backups (up to 7 days) and in our hosting provider's server logs (up to 30 days), until they expire automatically. These copies are not used for any other purpose.

12. Changes to This Privacy Policy

We may update this Privacy Policy if the Reading App, applicable laws or the services we use change.

If we make significant changes affecting children's privacy, we will update this policy and, where appropriate, notify parents or obtain new consent.

13. Contact Us and Complaints

Data Protection Officer
KINDLIVELY PTE LTD
admin@kindlively.com.sg

Parents and users may also contact us to request access to, or correction of, information, or to have the account deleted (which also withdraws consent).

If you have an unresolved concern about how we handle personal data, you may also contact Singapore's Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.