This supplement applies to users who are residents of the European Union (EU) or European Economic Area (EEA). It supplements our Privacy Policy and provides the additional disclosures required under the General Data Protection Regulation (GDPR).

Singapore Math Drills acts as the data controller for personal data processed through the platform. For all data protection enquiries, contact us at [email protected].

We process personal data under the following lawful bases: • Contract — processing your account data is necessary to provide the service you signed up for. • Legitimate interests — limited pseudonymous analytics to improve the platform. Adult account sessions use a pseudonymous ID derived from the account ID; family-account child sessions may carry the family owner's pseudonymous ID. Umami does not set tracking cookies, collect IP addresses, or receive names or email addresses. Authorised internal administrators can link the pseudonymous ID to the corresponding account using internal records. • Consent — where we rely on consent (e.g. marketing communications), you may withdraw it at any time without affecting prior processing.

As an EU/EEA resident, you have the following rights: • Right of access — request a copy of your personal data. • Right to rectification — correct inaccurate data. • Right to erasure — request deletion of your data ("right to be forgotten"). • Right to restriction — request that we limit processing of your data. • Right to data portability — receive your data in a structured, machine-readable format. • Right to object — object to processing based on legitimate interests. To exercise any of these rights, contact [email protected]. We will respond within 30 days.

We do not directly collect personal data from children under 16. Student accounts are provisioned by a verified parent or guardian, who provides consent on behalf of the child. Parents retain full control and may request deletion at any time by contacting [email protected].

Our servers are located outside the EEA. We transfer data under standard contractual clauses or equivalent safeguards as permitted under GDPR Article 46. Third-party processors (Stripe, Google) operate under their own GDPR-compliant transfer mechanisms.

We retain personal data only as long as necessary to fulfil the purpose for which it was collected. Account data is deleted immediately upon account deletion. Billing records are retained only as required by applicable financial law. One narrow exception: a one-way cryptographic hash of your email address (not the address itself) is retained after account deletion, solely to prevent free-trial abuse through repeated deletion and re-registration.

You have the right to lodge a complaint with your local data protection authority (DPA). A list of EU DPAs is available at edpb.europa.eu. We encourage you to contact us first at [email protected] so we may resolve your concern directly.