Legal

Privacy Policy

Last updated: 16 July 2026

Before publishing: company details (EXD Lab Pte. Ltd., UEN 201733062K) are from a public registry lookup, pending internal confirmation — verify against your actual incorporation documents. Replace the remaining bracketed placeholdercontact email(s) below with a real, monitored mailbox. This draft is structured for Singapore's Personal Data Protection Act 2012 (PDPA) and Google OAuth verification requirements, but it is not a substitute for legal review by qualified counsel.

This Privacy Policy explains how EXD Lab Pte. Ltd. ("SightVia", "we", "us", or "our") collects, uses, discloses, and protects personal data when you use our survey and reporting platform (the "Service"), in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA").

1. Who we are

SightVia is operated by EXD Lab Pte. Ltd., a company registered in Singapore (UEN: 201733062K), with its registered office at 7 Temasek Boulevard, #12-07 Suntec Tower One, Singapore 038987. We are the data controller for account and platform data as described below, and act as a data intermediaryfor survey response data collected on behalf of the schools and organizations that use SightVia (each, a "Customer Organization").

2. Personal data we collect

2.1 Account holders (school staff and administrators)

Name, email address, and role within your organization
Login credentials (email/password) or Google account identifier, where used
Activity logs (e.g. sign-ins, forms created, reports generated)

2.2 Survey respondents (including students)

Where a survey is configured to require sign-in, respondents authenticate using their Google account, and SightVia receives the respondent's name, email address, and Google account identifier from Google, restricted to the school domain(s) configured by the Customer Organization. We also collect the respondent's answers to survey questions, which may include information about wellbeing, attitudes, or self-assessment depending on the survey's design.

Data about minors. SightVia is used by schools to survey students, who may be under 18. For student respondents, the Customer Organization (school) is responsible for obtaining any necessary parental/guardian consent and for ensuring the survey complies with applicable education and data protection guidance (e.g. Singapore Ministry of Education policies) before collecting student data through SightVia. SightVia processes this data solely as instructed by the Customer Organization.

2.3 Automatically collected data

Authentication session cookies, required for you to stay signed in
Basic technical logs (IP address, browser type, timestamps) for security and abuse prevention

We do not use advertising or third-party tracking cookies. See §7 (Cookies) for details.

3. How we use personal data

To provide, operate, and maintain the Service (accounts, forms, surveys, dashboards)
To generate and deliver PDF reports and email notifications you or your organization request
To authenticate account holders and survey respondents (including via Google Sign-In)
To produce aggregated, de-identified analytics for the Customer Organization
To maintain the security, integrity, and availability of the Service
To comply with legal obligations and enforce our Terms of Service

4. Legal basis for processing

We rely on consent (obtained when you sign in, including via Google OAuth, or when a Customer Organization agrees to our Terms of Service on behalf of its members), and on the legitimate interests exceptions under the PDPA where applicable (e.g. security monitoring, fraud prevention). Where SightVia processes student or staff data on behalf of a Customer Organization, that organization is responsible for ensuring it has a valid basis (including any required consent) for the collection.

5. Who we share data with

We do not sell personal data. We share data only with service providers who process it on our behalf, under contractual confidentiality and security obligations:

Supabase — database, authentication, and file storage (hosted in the Singapore region)
Amazon Web Services (AWS) — application hosting, PDF generation, and email queueing (Singapore region for compute; the CloudFront CDN and TLS certificate infrastructure operate globally by nature)
Resend — transactional email delivery (e.g. sending generated PDF reports)
Google — OAuth sign-in, when you or a survey respondent chooses to sign in with a Google account

We may also disclose data if required by law, court order, or to protect the rights, property, or safety of SightVia, our users, or the public.

6. International data transfers

Our primary infrastructure (database and application compute) is hosted in AWS's and Supabase's Asia Pacific (Singapore) regions. Some service providers (e.g. Google, Resend) may process data outside Singapore. Where personal data is transferred overseas, we take steps required by the PDPA's Transfer Limitation Obligation to ensure it receives a comparable standard of protection, including relying on providers that maintain recognized certifications or contractual data protection commitments.

7. Cookies

We use strictly necessary cookies to keep you signed in and to protect the Service from abuse. We do not use cookies for advertising or cross-site tracking.

8. Data retention

We retain personal data for as long as your account or your organization's subscription is active, and for a reasonable period afterward as needed to comply with legal obligations, resolve disputes, and enforce our agreements. Customer Organizations may request deletion of their organization's data at any time by contacting us (§11).

9. Data security

We apply technical and organizational safeguards appropriate to the sensitivity of the data, including encryption in transit (TLS) and at rest, row-level access controls scoped to each organization, and restricted administrative access to production systems.

10. Your rights under the PDPA

Subject to applicable exceptions, you may:

Request access to the personal data we hold about you
Request correction of inaccurate or incomplete personal data
Withdraw consent to our collection, use, or disclosure of your personal data
Ask us to delete your personal data, subject to our legal retention obligations

If you are a survey respondent (e.g. a student), please contact your school or Customer Organization first, as they control the survey and its data. Otherwise, contact us using the details in §11.

11. Contact us

For privacy questions, access/correction requests, or to withdraw consent, contact our Data Protection Officer:

Email: [privacy@sightvia.com]
Address: 7 Temasek Boulevard, #12-07 Suntec Tower One, Singapore 038987

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date, and where changes are material, we will provide additional notice (e.g. by email).