Privacy Policy

01 Our Role

For any centre using Primo, the centre remains the owner and controller of its data — we act as a data intermediary, processing information only on the centre's instructions and only for the purposes they've agreed to.

We do not use centre, staff, parent, or child data to train general-purpose AI models, to improve products for other customers, or share it with third parties — without explicit written instruction from the centre.

02 What We Collect

Right now, before the full product is live, the only information we collect is what you give us directly:

• Early access sign-ups — the email address (and any other details) you submit through our "Get Early Access" form, used only to reach out about Primo.
• Direct enquiries — anything you send us by email or through a form on this site.

Once a centre is live on Primo, the product itself will process operational data on the centre's behalf — attendance, enrolment, staff records, child development observations, and similar — strictly under the terms agreed with that centre. That processing is covered by the sections below.

03 Cookies & Website Analytics

This website uses Google Analytics (GA4) to understand how visitors use the site — pages viewed, scroll depth, outbound link clicks, and interactions with forms like our waitlist and early-access sign-up. This is aggregate usage data used to improve the site; it is separate from any operational data processed for centres using the Primo product.

• Google Analytics sets cookies to distinguish visitors and sessions. No data collected here is used to identify you personally, and it is never linked to child, staff, or parent data processed within the Primo product.
• Any form on this site (early access, waitlist, contact) sends the details you submit — name, email, phone, company, and your message — to us directly, so we can follow up. We don't sell or share this with third parties.
• You can opt out of Google Analytics tracking using the Google Analytics Opt-out Browser Add-on, or by blocking cookies in your browser settings.

04 Children's Data

Children's information is held to a higher standard than any other data we process:

• Isolated storage — developmental records, health information, and attendance data are stored in isolated, encrypted containers, separated from general system data.
• No behavioural profiling — child data is never used to train AI models or build behavioural profiles, for Primo or anyone else.
• Consent flows through the centre — a centre using Primo is responsible for having valid parental/guardian consent in place, consistent with PDPC guidance, before any child data enters the system.
• Built for ECDA alignment — our data flows and AI use are documented so centres can produce the diagrams and impact assessments regulators expect.

05 AI & Data Safety

Primi, our AI layer, is built with a few hard rules:

• No customer data — child, staff, or parent — is used to train general-purpose AI models.
• AI agents are purpose-limited: each one only accesses the specific data it needs to do its job, nothing more.
• Every AI action is logged with a timestamp and an agent identifier, and that audit trail is available to a centre on request.
• Anything consequential — amending a child's record, a developmental judgment — is always surfaced to a person to action. Primi suggests; it doesn't decide.

06 Security

• Data is encrypted with AES-256 at rest and TLS 1.2+ in transit.
• Infrastructure runs on ISO 27001-certified cloud providers, hosted in Singapore.
• Multi-factor authentication and role-based access controls are mandatory for anyone with system access.

07 Retention & Deletion

• Operational data is retained only for as long as a centre is an active customer.
• System logs are kept for up to 3 years for security and audit purposes.
• Encrypted backups are deleted within 30 days of the data they contain being removed.
• When a centre's contract ends, all of that centre's personal data is securely deleted within 30 days.

08 Your Rights

Under Singapore's Personal Data Protection Act (PDPA), you can ask what personal data we hold about you, request a correction, or ask us to stop using it for a particular purpose (for example, withdrawing from early-access communications). Write to us and we'll respond within a reasonable time.

09 Questions

This policy will grow alongside the product. If anything here is unclear, or you want more detail before trusting us with your centre's data, just ask.