Privacy Policy 隐私政策

Currixa is a school-management platform operated by OLGA Education Service Pte Ltd (“we”, “us”), a company registered in Singapore. Tuition and enrichment centres (“Centres”) use Currixa to manage classes, attendance, reports, fees and parent communication.

For personal data entered by a Centre about its students and parents, the Centre is the organisation responsible under the Personal Data Protection Act 2012 (“PDPA”), and we act as its data intermediary — we process that data only on the Centre’s behalf and instructions.

Depending on how your Centre uses Currixa: student and parent names, contact details (phone, email, address), date of birth, school, enrolment and class records, attendance, academic reports and quiz results, fee and payment records (including payment-proof screenshots you upload), leave requests, enquiry details, and staff employment records. Login events record an IP address for security auditing.

NRIC/FIN numbers are an optional field intended only where a Centre has a genuine need consistent with the PDPC’s NRIC Advisory Guidelines; they are encrypted at rest and we encourage Centres not to collect them unless necessary.

We use only session cookies necessary for login. No advertising or tracking cookies.

Solely to provide the service to your Centre: scheduling and attendance, progress reports, fee administration, parent-school notifications (e.g. absence alerts, fee reminders, report releases), classroom activities (e.g. quizzes and reward points), and service security. We do not sell personal data, use it for advertising, or share it with third parties except the service providers below.

Data is stored in an encrypted PostgreSQL database hosted in Singapore (Neon), served by application servers in Singapore (Render). Transactional emails (e.g. absence alerts, password-reset codes) are delivered via Resend from servers in Tokyo, Japan; the email necessarily contains the recipient address and message content. Encrypted nightly backups are stored with Google Cloud Storage. Where data transits outside Singapore, we ensure the recipient provides a standard of protection comparable to the PDPA through contractual and technical measures (all backups are AES-256-encrypted before leaving our systems).

All traffic is encrypted in transit (TLS). Identity documents, contact numbers, dates of birth and addresses are additionally encrypted at rest (AES-256-GCM). Passwords and PINs are stored only as bcrypt hashes. Access is role-restricted per Centre — one Centre can never see another Centre’s data — and every administrative action is recorded in an audit log. Repeated failed logins are rate-limited.

Personal data is retained while the student remains enrolled and for up to 3 years afterwards (to support re-enrolment, academic history and legal/accounting requirements), unless your Centre instructs earlier deletion or a longer statutory period applies. Backups roll off automatically.

You may request access to, or correction of, your or your child’s personal data, or withdraw consent for its continued use, by contacting your Centre — or us directly at dpo@currixa.io. We will respond within 30 days. Withdrawing consent may mean the Centre can no longer provide some or all of its services to you.

If a data breach occurs that is likely to result in significant harm, we will notify the Personal Data Protection Commission and affected individuals in accordance with the PDPA’s Data Breach Notification obligations, and support the affected Centre in doing the same.

OLGA Education Service Pte Ltd — Data Protection Officer
Email: dpo@currixa.io

Each Centre also designates its own DPO for data it controls; contact your Centre for details.

We will post updates to this policy here and note the effective date above. Material changes will be announced in the app.