Privacy Policy

Last updated: 13 September 2026

This Privacy Policy explains how Myko Education Centre Pte Ltd ("Myko", "Myko Education", "we", "us" or "our") collects, uses, discloses and protects personal data when you use our website and portal at portal.mykoeducation.com, our mobile applications, and related services (together, the "Services").

We are based in Singapore and serve families and staff in Singapore and Australia. We are committed to handling personal data in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA") and the Australian Privacy Act 1988 (Cth) and its Australian Privacy Principles ("APPs"), as applicable.

1. Who we are

Myko Education Centre Pte Ltd
317 Outram Road, #02-77, Singapore 169075
Privacy / Data Protection contact: support@mykoeducation.com

Our Data Protection Officer can be contacted at the email address above for any question, request or complaint about your personal data.

2. The personal data we collect

We collect only the data we need to run an education service and to let parents and staff communicate. This includes:

• Account & contact details. For parents and staff: name, email address and (where provided) phone number, used to create and secure your login.
• Student records. Information about enrolled students — name, year level, class enrolment, attendance, assessment results and progress reports. This information is made available to the student's parent or guardian, to the staff responsible for that student, and — in the Koko mobile app — to the student themselves through a sign-in provisioned by the centre.
• Schoolwork. In the Koko app a student can photograph and submit their homework; the photos are converted to PDF documents, stored securely, and returned to the student with their teacher's marking. We strip location and other camera metadata from submitted photos before storage.
• Messages & support content. The content of messages you send through the in-app chat between parents or students and their care team, and questions you put to our in-app assistant.
• Device & technical data. Authentication and session information; and, if you enable notifications on the mobile app, a device push token. We also keep basic security and diagnostic logs.

We do not collect payment-card details through the Services, and we do not seek sensitive information beyond what a parent or the centre chooses to provide about a student (for example, any medical/allergy note recorded for the centre's care of the child).

3. How we use personal data

• To provide the Services — sign-in, showing a parent their own child's information, and operating the chat.
• To communicate with you, including activation links, service emails and (on mobile) push notifications about new messages or reports.
• To power our in-app assistant, which answers a parent's questions from that parent's own child's records (see section 4).
• To keep accurate education and attendance records, and to support the safe operation of our centre.
• To secure the Services, prevent misuse, and meet our legal and regulatory obligations.

Under the PDPA we rely on your consent (which you may withdraw — see section 10) and, where applicable, on the legitimate-interests basis. Under the APPs we collect and use personal information for the purposes above and directly related purposes.

4. Our in-app assistant (AI)

The optional parent AI assistant is off until a linked parent or guardian explicitly enables it for a child. Before enabling it, we explain that new messages from that parent, the child's name and identifier, and relevant attendance summaries or the latest shared progress report will be sent to Anthropic to generate replies. Earlier messages and other people's messages are not included. Anthropic may process this information overseas. The assistant can make mistakes; staff can respond personally. Parents can turn AI off in the child's conversation at any time. This stops future AI requests; it does not delete information already processed. Ordinary messaging, lessons, attendance and reports remain available without AI. Contact support@mykoeducation.com for privacy or deletion requests.

5. How we share personal data

We do not sell personal data. We share it only with service providers who process it on our behalf, under contract and only as needed to run the Services:

• Supabase — secure database, authentication and hosting (data stored in the Singapore region).
• Anthropic — processing for the optional parent AI assistant (section 4).
• Vercel — hosting the portal and server functions, including operational logs.
• Expo — mobile app updates and the mobile push notification gateway.
• Microsoft — sending service emails on our behalf.
• Apple and Google — delivering mobile push notifications (via their notification services).

We may also disclose personal data where required by law, to protect the safety of a child or any person, or in connection with a sale or restructuring of our business (with appropriate protections).

6. Children's personal data

The Services are used by parents/guardians and our staff, and — in the Koko mobile app — by enrolled students, including children under 13. We treat children's information with particular care: a parent can see only their own child's records, a student can see only their own, access is enforced at the database level, and we limit who on our staff can see a given child's information. Children cannot create accounts themselves: the centre provisions student sign-ins and links the child's account to a parent or guardian's account. Linking accounts does not enable the parent AI assistant; that requires the separate choice described in section 4. The app shows no advertising and uses no third-party tracking. A parent or guardian may access or correct their child's information, or ask us to close a student's sign-in, by contacting us.

7. Where data is stored & international transfers

Personal data is hosted by Supabase in Singapore. Because we serve families in Australia and Singapore, and because some of our service providers operate overseas (including in the United States), your personal data may be transferred to, and processed in, countries outside your own. Where we transfer personal data internationally we take steps to ensure it remains protected to a standard comparable to the PDPA and the APPs, including through contractual safeguards with our providers.

8. How long we keep personal data

We keep personal data for as long as needed to provide the Services and to meet our legal, accounting and record-keeping obligations as an education provider. When personal data is no longer required for any lawful purpose, we will delete or anonymise it. Messages are retained as part of the record of communications with families.

9. How we protect personal data

Access is controlled by row-level security in our database, so each user can reach only the records they are permitted to see. Data is encrypted in transit, access is restricted to authorised staff and providers, and actions are logged. No system is perfectly secure, but we work to protect personal data against loss, misuse and unauthorised access.

10. Your rights and choices

Parents or guardians can request deletion of their own account, a linked child's sign-in or associated personal data by emailing support@mykoeducation.com with the subject "Koko privacy or deletion request". Tell us the account email and which account or data the request concerns. Do not send your password. We verify the requester's identity and authority, explain any records we must retain and why, and confirm the outcome. Closing a sign-in does not automatically cancel an enrolment. Copies in backups are subject to the applicable backup expiry process; contact us for the details relevant to your request.

You may contact us at support@mykoeducation.com to exercise the rights below.

Singapore (PDPA). You may request access to, and correction of, your personal data, and you may withdraw consent to our continued use of it (which may mean we can no longer provide some or all of the Services). You may also make a complaint to our Data Protection Officer, and to the Personal Data Protection Commission (PDPC) of Singapore.

Australia (APPs). You may request access to, and correction of, your personal information. If you are concerned about how we have handled your personal information, please contact us first; if you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).

11. Cookies & local storage

We use cookies and similar local storage only as needed to keep you signed in and to operate the Services securely. We do not use them for third-party advertising.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and change the "Last updated" date above. Material changes will be communicated through the Services where appropriate.

13. Contact us

For any question or request about this policy or your personal data, contact:
Myko Education Centre Pte Ltd — support@mykoeducation.com
317 Outram Road, #02-77, Singapore 169075