Privacy Policy

This Privacy Policy explains what personal data Cyber Skill Tutor (the "Service"), operated by Support Center Phuket Co., Ltd, collects, why, on what legal basis, who receives it, how long it is kept and how you can use your rights. We use the Personal Data Protection Act B.E. 2562 (2019) of Thailand (the "PDPA") as the framework.

Two kinds of people appear in this Policy. The adult buyer is the parent or legal guardian who buys a subscription for a child, or an adult who buys it for themselves: the adult buyer creates the account, accepts our Terms, gives the consents described below and pays. The student is the child (or the adult learner) who uses the lessons. Our Terms of Service do not allow a child to buy a subscription or to give these consents.

1. Data We Collect

About the adult buyer

• Contact and account data: name and email address, and login credentials for signing in.
• Consent and declaration records: the time and wording version of the consents given at enrollment, and, at checkout, the buyer's declaration that they are an adult and legally able to make the purchase, with its time. We record the declaration; we do not verify age or identity.
• Payment data: subscription and billing status. Card and full payment details are collected and processed directly by our payment processor, Stripe; we do not receive or store your full card number. Stripe tells us when a payment succeeds, with its date, amount and currency; we keep those facts ourselves only for the optional advertising measurement in Section 6.
• Offer-eligibility records: a hash of the email address and a date, kept after an account is deleted (Section 9).
• Advertising-measurement records: only if you give the separate optional consent (Section 6): a hashed form of your email address, the time, amount, currency and first-or-later flag of your payments, the country of your request, and the times you confirmed or withdrew the consent.

About the student

• Student data: first and last name and date of birth (used only to place the student into an age-appropriate track), lesson progress, and star/achievement records.
• Lesson conversations: the messages exchanged with the AI tutor during a lesson, and any screenshot or image the student chooses to share during a lesson, which are processed as described in Section 3 to generate the tutor's responses. Screenshots are not stored in our database; the text of the conversation is.
• Placement test: the answers given during the initial placement test (or, for an in-person class, a diagnostic conversation), used to recommend a starting module. The placement test can be taken before any payment.
• Progress summaries: a teacher or administrator can request a short AI-generated summary of a student's progress. It is based on the student's name, age group, star points, lesson progress and assessment scores. It does not use the lesson conversation.
• School program data (where applicable): for students enrolled through a school or class, a shared class access code and class/group information used to manage that group.

Technical and source data

• Technical & security data: basic technical logs (such as IP address and request metadata) generated automatically by our hosting provider for security, abuse prevention, and reliability.
• Campaign source: if you arrive from one of our ads or links, the campaign names in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term) are kept in your browser and saved with your sign-up record. Advertising click identifiers that a platform may add to a link (such as fbclid or gclid) are read in your browser but are not saved with your record, in our logs or with your payment.
• Payment reference data: when you pay, we give Stripe a technical reference so the payment can be matched to the right account: an internal account identifier, the module and lesson chosen, the interface language, the campaign names above, and, when applicable, the time of your adult declaration and a random checkout identifier. It contains no name; the email is the one you use to pay.

We need the adult buyer's name and email address and the student's name and date of birth to create the account and provide the lessons. Without them we cannot provide the Service. Advertising measurement is never required.

2. Why We Use It, and on What Basis

• To provide the lessons, the AI tutor, and progress tracking, and to personalize the tutor's responses to the student's level and history. Basis: performing our contract with the adult buyer and, for a child's data, the consent of the parent or legal guardian given at enrollment.
• To process payments and manage the subscription, trial and billing, and to meet tax and accounting duties. Basis: the contract; our legal obligations.
• To communicate with the adult buyer about the Service (account setup, invitations, password resets, service updates). Basis: the contract; our legitimate interest in running the Service.
• To keep the Service secure and reliable. Basis: our legitimate interest.
• To prevent a free trial from being used repeatedly and to apply the conditions of introductory offers (Section 9). Basis: our legitimate interest in preventing abuse of our offers and applying their terms fairly, balanced against your rights.
• To understand which of our ads and links lead to sign-ups, using the campaign names in the link. Basis: our legitimate interest.
• To measure our advertising with Meta (Section 6). Basis: your separate, optional, withdrawable consent, and nothing else.

3. AI Tutor & Voice Processing

A student using Cyber Skill Tutor talks to an AI tutor, not to a person, and the AI can make mistakes (see our Terms of Service). To generate the tutor's responses we send each lesson request to one of the trusted third-party AI service providers we use. A lesson request contains the student's messages, any screenshot the student chose to share, the lesson content and instructions, and the student's age group (for some lessons, also age). We do not include the student's name or email address in lesson requests. A student can still type personal information in a message or show it in a screenshot, so please remind your child not to share personal details.

Where the tutor's replies are read aloud, the text of the reply is sent to a third-party text-to-speech provider to generate the audio.

4. AI Services and Children's Data

The AI service providers process this data to provide the AI tutoring and related learning features described in this Privacy Policy and in our Terms of Service. The names of the providers we use, the data each receives and how long each keeps it under its own published terms are available on request: cyberone@itkingdom.co.

For a child using Cyber Skill Tutor, the parent or legal guardian provides consent to this processing through the enrollment process described in Section 8 below.

5. Who We Share Data With

We do not sell personal data. We share data with the following recipients, only as described in this Policy:

• Payment processing: Stripe, which receives your payment details and the payment reference data described in Section 1.
• Database & authentication: Supabase.
• Hosting: Vercel.
• AI tutor & voice processing: trusted third-party AI service providers and a text-to-speech provider, described in Section 3.
• Email delivery: Resend, for account, confirmation and certain inquiry emails.
• Advertising measurement (optional, only with your confirmed consent): Meta Platforms, Inc. (Facebook and Instagram), described in Section 6.

Apart from Meta, which receives data only if you consent, these recipients process data on our behalf to run the Service. The offer-eligibility records are not shared with anyone.

6. Advertising Measurement with Meta (Optional)

If, and only if, you give the separate optional consent described here, we measure our advertising with Meta Platforms, Inc. ("Meta", Facebook and Instagram). This uses a server-to-server connection (Meta's Conversions API). No Meta Pixel or other Meta script runs in your browser or on any page of the Service, and we set no Meta cookie. Being server-side does not make it any less advertising-related processing of personal data, and this Policy treats it as exactly that.

• When it is offered: after payment, on a page for the adult buyer (the first stage is limited to buyers in Thailand). Ticking the box does not switch anything on: we email a confirmation link to the address Stripe holds for your payment, and the consent starts only when you open it. This stops someone else at the same device from making the choice for you, but it is not a verification of age or identity.
• What Meta receives: for each trial start and each successful payment of the adult buyer: a hashed form of your email address (a one-way code; a hashed identifier can still be personal data), a hashed form of the payment processor's customer reference, the time and type of the event (trial start or purchase) and, for a purchase, the amount actually charged (including any VAT), the currency, and whether it is the first payment or a later one.
• What Meta never receives from us: the student's name, age, date of birth, identifier, lessons, conversations, test results or progress, or any other data about a child; no IP address, device or browser data; no advertising click identifier.
• Why: to measure which of our ads lead to trials and purchases and to improve our advertising. Our legal basis is your consent.
• Meta as a recipient: once Meta receives data it handles it under its own terms and policies, as an independent party.
• It is optional and separate: saying no, or withdrawing later, does not affect your purchase, your subscription, the price, or your child's lessons.
• Withdrawing: at any time, with the link in the confirmation email or on the page you used. From then on nothing further is sent, and we delete the payment records and the email hash that we kept for this purpose (Section 11). Data Meta has already received is governed by Meta's policies and we cannot recall it.

7. International Transfers

Our service providers and Meta may store or process data outside Thailand, including in the United States. We send personal data abroad only on a basis the PDPA allows: because it is necessary to provide the Service you ordered (payments, hosting, the database, email delivery, AI tutoring), or with your consent (advertising measurement with Meta). The full, current list of providers is available on request (Section 13).

8. Children's Data

Cyber Skill Tutorrelies on a parent or legal guardian to create the account, provide the consent described at enrollment, and supervise the child's use of the Service. At enrollment the parent or guardian confirms that they hold that authority and accepts our Terms and this Policy; where the PDPA requires the consent of the person with parental responsibility for a child's data, this is how we obtain it. A child does not create an account or buy a subscription on their own. Students who use the Service through a school or class are given access by their school. We do not verify the identity or age of the person who completes enrollment or checkout. If you believe a child has provided personal data to us without the involvement of a parent or guardian, please contact us using the details in Section 13 so we can address it.

We use children's data to provide the lessons. We never send a child's data, lesson content, test results, name, age, date of birth, identifier or device information to any advertising platform, and we do not load advertising or analytics tags on any page where children work (see Sections 6 and 10).

9. Offer-Eligibility Records (kept after an account is deleted)

Two internal records let us apply our offers fairly. Each contains a hash of the adult buyer's email address and one date, and nothing else (no name, no readable email address, no child data, no card data). A hash is a one-way code, but anyone who already has an email address can check whether a matching record exists, so we treat these records as personal data. They can be read only by our server, are not used for any other purpose and are not shared with anyone, including advertising platforms.

• Free-trial record (hash and the date the first free trial began). Purpose: each customer is entitled to one free trial (see the Terms of Service). Basis: our legitimate interest in preventing repeated free trials. We keep it for as long as we apply the one-free-trial rule; we have not set a fixed deletion date, and no automatic deletion is in place.
• Payment record (hash and the date of the first successful payment). Purpose: the founder price is offered to customers who have never paid. Basis: our legitimate interest in applying the terms of that offer. We keep it for as long as the founder price depends on it; we have not set a fixed deletion date, and no automatic deletion is in place.

These records stay when an account is deleted, because deleting them with the account would defeat their purpose. You can ask us to delete them, or object to our keeping them, by emailing cyberone@itkingdom.co from the address of the account (or tell us the address so we can find the record). We examine each request individually and answer it without undue delay. We delete the records unless keeping them is necessary to prevent abuse of our offers or to establish, exercise or defend legal claims, and if we keep them we explain why. If they are deleted, we can no longer recognise you as a returning customer, so a new subscription may include a free trial and, while founder places remain, the founder price.

10. Cookies, Local Storage & Advertising Technologies

Cookies.We do not set cookies of our own. The Service keeps small items in your browser's local or session storage (ours, not a third party's): to keep you signed in, to remember your interface language, to continue a lesson or enrollment you started, and to remember the campaign source of your first visit. You can remove them at any time by clearing your browser's site data. Our payment processor's checkout page is operated by that processor and may set its own cookies under its own policy. You can control cookies through your browser settings.

Analytics and advertising tags in your browser.We do not currently load Google Analytics, Google Ads, Meta Pixel or any similar tag. If we start to use Google tags, we will update this Policy first; they will load only on pages for adults and parents, only after you accept a cookie banner, and they will be switched off on every page where a child works (including from the moment the children's AI dialog begins inside a page).

Server-side advertising measurement is not a cookie or a Pixel, and the absence of a Pixel does not mean the absence of advertising-related processing. The optional measurement with Meta is described in Section 6. We do not use the Service to show you personalised ads.

Why there is no separate Cookie Policy: we set no cookies of our own and load no browser tags, so this section covers everything a cookie policy would. If that changes we will add the banner and a separate list first.

11. Data Retention

• Account, student, lesson and consent records: for as long as the account is active. When an account is deleted (at the request of the parent or guardian, or by us), we delete the student's lesson conversations, progress and consent records, except records we must keep by law (for example financial records, which are also held by Stripe) and the offer-eligibility records in Section 9. We have not set a shorter automatic deletion period for lesson conversations.
• Payment and billing records: as long as tax and accounting law requires.
• Offer-eligibility records: as described in Section 9.
• Advertising-measurement records (Section 6) are kept only while your consent is active. They are deleted at once when you withdraw or when the last account of that buyer is deleted. Payment facts are stored for advertising at all only during the first days after checkout, while a consent can still be given and for buyers who have given one; for a checkout without a consent the email hash and payment facts are removed within about 30 days. If the subscription has lapsed for 13 months, the consent ends and they are removed. A record that a consent was given and withdrawn (a random identifier, times, the wording version and the country, with nothing that identifies you) is kept for 36 months as proof. Event identifiers used to avoid sending the same event twice are kept for 30 days.
• Campaign names: with the sign-up record, for as long as the account exists.
• Technical logs: for the short period set by our hosting provider.

Our AI and other service providers keep data under their own published terms; details are available on request (Section 13).

12. Your Rights & How to Use Them

A parent or guardian may, for themselves and for their child, ask for access to or a copy of personal data, correction, deletion or anonymisation, restriction of use, or object to its use, may withdraw consent at any time, and may file a complaint with the Personal Data Protection Committee of Thailand or another competent authority. To make a request or ask a question about how data is used, email cyberone@itkingdom.co. We will take reasonable steps to verify the request and respond to it, subject to records we are required by law to retain (for example, financial records) and to the Data Retention section above. You can withdraw the advertising-measurement consent yourself, without writing to us, with the link in the confirmation email. Withdrawing consent or deleting the account means we can no longer provide the Service to the student; withdrawing the advertising consent has no effect on the Service.

13. Contact

Questions about this Privacy Policy, or requests under Section 12, can be sent to cyberone@itkingdom.co, or by post to Support Center Phuket Co., Ltd, 403/6 Village No. 9, Chalong Subdistrict, Mueang District, Phuket Province, 83130, Thailand.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective" date at the top of this page reflects the version currently in force. We will ask for your consent again where the law requires it, and always before we begin any processing that this Policy says needs your consent.