Privacy Policy

Effective date: Pending publication
Last updated: Pending publication

1. Who we are

thinkShuo is a business Mandarin learning service operated by Rasbora Labs Pte Ltd, a company registered in Singapore (“we”, “us”, or “our”).

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you use our website, applications, AI tutors, voice practice features, and paid subscriptions (collectively, the “Services”).

Our registered address is 22 Sin Ming Lane #06-76 Midview City, Singapore 573969.

For privacy questions or requests, contact our Data Protection Officer at support@thinkshuo.com, with “Privacy” in the subject line.

2. Personal data we collect

We collect the following categories of data, depending on the features you use:

• Account information: Your name, email address, account identifier, profile image where provided, preferences, and account settings.
• Google sign-in information: When you sign in with Google, we receive your Google account identifier, email address, email verification status, and available basic profile information, such as your name and profile image. We use this information to authenticate you, create or link your thinkShuo account, and manage your account. We do not receive your Google password. Basic Google sign-in does not give us access to your Gmail messages, Google Drive files, contacts, or calendar.
• Learning information: Your learning goals, selected lessons, exercise responses, lesson completion, practice activity, learning progress, and feedback.
• Voice and conversation information: Audio you submit through voice features, speech transcripts, messages sent to AI tutors, generated responses, and pronunciation or language feedback.
• Subscription and transaction information: Your plan, purchase history, billing status, transaction references, and information needed for invoices. Website subscription payments are processed by Stripe. Stripe receives the payment details needed to process your purchase.
• Technical information: IP address, device and browser information, operating system, access times, feature usage, and diagnostic or security logs.
• Communications: Information you provide when contacting support, reporting problems, or submitting feedback.

Please avoid submitting confidential business information or other people’s personal data unless you are authorised to do so.

3. How we use personal data

We use personal data to:

• Authenticate users and manage accounts.
• Deliver lessons, AI conversations, voice practice, and personalised learning feedback.
• Save learning history and progress.
• Process subscriptions, payments, and invoices.
• Respond to support requests.
• Maintain reliability, investigate errors, and improve the usability of the Services.
• Detect fraud, abuse, and security incidents.
• Send necessary account, billing, security, and service communications.
• Comply with legal obligations and resolve disputes.

Our use of personal data is subject to applicable consent requirements and other grounds permitted by law. You can contact us about your choices or to withdraw consent as described below.

4. Voice recordings and AI processing

When you activate a voice feature and grant microphone permission, we process the audio you submit to transcribe speech, assess pronunciation, and generate learning responses. We do not use microphone permission to record unrelated conversations in the background.

AI tutor features process your messages, relevant conversation context, and, where applicable, audio or transcripts to produce responses and learning feedback.

We use OpenAI, Google AI services including Vertex AI, and OpenRouter for AI features, and OpenAI and OpenRouter for speech features. These services receive the messages, relevant conversation context, audio, or transcripts needed for the feature you use. OpenRouter automatically routes requests to underlying model providers, which may vary between requests.

We save voice recordings for troubleshooting and delete recordings from our active application storage within 30 days of collection, including recordings used to investigate issues. We save transcripts and AI conversation history so you can revisit your practice. Provider processing and storage may differ from our application storage; the 30-day application retention period is not a guarantee of deletion from every provider or backup. See the provider information and retention sections below.

Authorised personnel or service providers may access relevant information where necessary to respond to your support request, investigate a technical problem or abuse, maintain security, or comply with law. Access is restricted to the relevant purpose.

You can withdraw microphone permission through your device settings. Voice features will then be unavailable, but other available learning features remain accessible.

5. When we share personal data

We disclose personal data where necessary to:

• Service providers: Providers supporting hosting, authentication, AI processing, speech processing, payments, diagnostics, communications, and customer support. The main providers and their functions are listed below.
• Authorities or other recipients: Where disclosure is required by law or reasonably necessary to protect rights, investigate fraud, or address security risks.
• A business successor: In connection with a merger, acquisition, or transfer of our business, subject to applicable safeguards and notice or consent requirements.
• Recipients you authorise: When you expressly request or authorise a disclosure.

These links provide general information about the providers. Processing performed on our behalf is also governed by the applicable service agreements and configurations; a provider's general privacy policy may address its own services rather than customer content processed through its business APIs. Google and Stripe also process information under their own policies when you interact directly with their services.

6. Cookies and analytics

We use cookies, local storage, or similar technologies to maintain sign-in sessions, protect accounts, and remember preferences.

We use PostHog and Google Analytics on our website and in our app to understand user actions and improve the Services. Analytics starts automatically when you use these services. Events record actions such as page visits and feature interactions and may be linked to your account user ID when available. We retain these event records for 180 days.

We do not send voice recordings, transcripts, prompts, or AI responses as analytics event content. We use PostHog for event tracking, not session replay.

There is currently no in-product analytics accept/reject control. You can contact support@thinkshuo.com with questions or requests about analytics processing. Browser controls may limit some tracking but do not necessarily prevent all event collection.

You can manage cookies through your browser settings. Disabling essential cookies may affect sign-in or other functionality.

7. Data retention and deletion

We retain personal data only for as long as needed for the disclosed purposes or legitimate legal and business requirements.

We may retain limited records where necessary to comply with law, resolve disputes, prevent fraud, or fulfil an applicable obligation. Access to retained records is restricted.

To request deletion of your account or a conversation, contact support@thinkshuo.com. In-app account and individual-conversation deletion controls are not currently available. We may need to verify your identity and assess any applicable retention requirements before responding to your request.

The application retention periods above do not establish identical retention periods for all service-provider records or backup copies.

8. Security and international transfers

We use reasonable technical and organisational safeguards, including encryption during transmission, access controls, and restricted access to personal data. No system can guarantee absolute security.

Our Supabase and AWS application hosting and storage are configured in Singapore. Other providers and their subprocessors may process data outside Singapore, including when OpenRouter routes a request to a model provider. Singapore application hosting does not mean all processing remains in Singapore.

When transferring personal data outside Singapore, we take steps required by applicable law to ensure protection comparable to that required under Singapore’s Personal Data Protection Act, including appropriate contractual protections where applicable.

We assess suspected personal data breaches and notify regulators and affected individuals where required by law.

9. Your choices and requests

You may contact support@thinkshuo.com to:

• Request access to your personal data and information about its use or disclosure, subject to applicable law.
• Request correction of inaccurate or incomplete personal data.
• Withdraw consent with reasonable notice.
• Request account deletion.
• Raise a privacy concern or exercise other rights available under applicable law.

We may verify your identity before fulfilling a request. If withdrawing consent affects our ability to provide a feature, we explain the consequences.

You can remove thinkShuo’s Google connection through your Google Account settings. Removing the connection does not automatically delete data already stored by thinkShuo; contact us separately to request deletion.

Account deletion and subscription cancellation are separate processes. Please also cancel any recurring subscription through the channel used to purchase it.

You may raise unresolved Singapore privacy concerns with the Personal Data Protection Commission.

10. Age eligibility

The Services are intended for people aged 18 or older. We do not knowingly collect personal data from users under 18. If you believe a minor has provided personal data, contact us so we can investigate and take appropriate action.

11. Changes to this policy

We may update this Privacy Policy as our Services or practices change. We update the date above and provide appropriate notice of material changes.

Before using Google user data for a new purpose beyond what was originally disclosed, we provide updated disclosures and obtain the required consent.

12. Contact

Rasbora Labs Pte Ltd
22 Sin Ming Lane #06-76 Midview City, Singapore 573969
Privacy and support: support@thinkshuo.com