Privacy Policy
Effective date: 9 August 2026 Last updated: 9 August 2026
1. Introduction and scope
1.1 This Privacy Policy (the "Policy") describes how the Operators collect, use, disclose, process and protect Personal Data in connection with the Service.
1.2 This Policy is issued in accordance with the Personal Data Protection Act 2012 of Singapore and is to be read together with the Terms of Service. Capitalised terms used in this Policy have the meanings given to them in clause 2.
1.3 By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with it, you must not access or use the Service.
1.4 The Service is operated independently and is not affiliated with, endorsed by, or associated with the School.
2. Definitions and interpretation
2.1 Definitions. In this Policy, the following terms have the following meanings:
"Aggregated or De-identified Information" means information that has been aggregated with other information or from which identifiers have been removed, such that it does not identify, and cannot reasonably be used by the recipient to identify, any individual.
"Channel" means the Telegram channel operated by the Operators through which Content may be published to an audience.
"Content" means any information, text, message, image, poll, survey or feedback response or other material that you submit, send, post or otherwise make available through the Service.
"Discussion Group" means the Telegram group linked to the Channel in which Users may post replies.
"Operators", "we", "us" or "our" means the group of individuals that operates the Service.
"PDPA" means the Personal Data Protection Act 2012 of Singapore, together with any subsidiary legislation and applicable guidelines issued under it, in each case as amended, replaced or supplemented from time to time.
"Personal Data" has the meaning given to it in the PDPA, namely data, whether true or not, about an individual who can be identified (a) from that data, or (b) from that data and other information to which the Operators have or are likely to have access.
"School" means Singapore Management University, the educational institution whose community the Service is intended for.
"Service" means the SMU Confess Telegram bot, together with the Channel, the Discussion Group, the Web Application and all related features, functions and materials made available by the Operators.
"Service Providers" means the third-party service providers engaged by the Operators to process data on their behalf, of the categories described in clause 7.
"Telegram" means the Telegram messaging platform operated by Telegram FZ-LLC and its affiliates, through which the Service is provided.
"User", "you" or "your" means any person who accesses or uses the Service.
"Verification" means the process by which a User confirms control of a School email address through an identity verification provider, and "Verified" is construed accordingly.
"Web Application" means the web-based interface made available by the Operators as part of the Service, including at https://smuconfess.app/bots/smu-confess/app.
2.2 Interpretation. In this Policy, unless the context requires otherwise:
(a) headings are for convenience only and do not affect its interpretation;
(b) the singular includes the plural and vice versa;
(c) a reference to a person includes an individual and any body of persons, corporate or unincorporated;
(d) the words "including", "includes" and "such as" are not words of limitation and are to be read as if followed by "without limitation";
(e) a reference to a statute, document or provision is to that statute, document or provision as amended, replaced or supplemented from time to time;
(f) "writing" and "written" include communication by electronic means; and
(g) a reference to a clause is to a clause of this Policy.
3. Personal Data we collect
3.1 We may collect and process the following categories of Personal Data:
| Category | Examples | Source |
|---|---|---|
| Identifiers | Telegram user identifier, username and related identifiers | Telegram |
| Verification data | School email address and Verification status | Identity verification provider |
| Content | The text and messages you submit or send through the Service | You |
| Derived data | Analyses and other data derived from your Content by automated means | Generated internally or by Service Providers |
| Usage data | Your interactions with the Service and related activity records | Your use of the Service |
| Payment data | Transaction and subscription identifiers and related records | Payment processor |
| Moderation data | Records relating to moderation, enforcement and account status | Internal systems and Service Providers |
3.2 We do not collect your email account password, your payment card details, or the contents of any third-party account you use to complete Verification. Payment card details are collected and processed solely by our payment processor; we do not receive or store them.
3.3 Cookies and local storage. The Web Application sets a strictly necessary cookie in order to maintain your signed-in session, and may store limited data on your device in order to operate. That cookie is essential to the functioning of the Web Application, is not used for advertising or cross-site tracking, and expires or is invalidated when your session ends. You may block or delete such data through your browser or client settings, but the Web Application may then cease to function.
4. Nature and limits of anonymity
4.1 Content submitted through the Service is presented to other Users and to the audience of the Channel on an anonymous basis. Content published to the Channel is not attributed to your name, and messages exchanged with other Users are relayed under a pseudonymous identifier rather than under your name or account.
4.2 You acknowledge that such anonymity operates only as between you and other Users or the audience of the Channel, and is not absolute. For the purposes of operating and securing the Service, complying with applicable law and giving effect to this Policy, the Operators maintain a record associating each User with the Content submitted by that User, and authorised personnel may access the Content you submit and the messages you exchange through the Service.
4.3 Where you post a reply directly within the Discussion Group, the Service will seek to remove your original message and to re-publish its content anonymously under your alias. You acknowledge that this operates on a best-efforts basis and is not instantaneous: prior to removal, your message is visible under your own account and may already have generated notifications; and in the event of delay, interruption or failure, your original message may remain visible under your own account. For assured anonymity, you should use the anonymous submission facility provided by the bot rather than posting directly.
5. Purposes of collection, use and disclosure
We collect, use and disclose Personal Data for the following purposes:
(a) to provide, operate, maintain and improve the Service and its features;
(b) to verify your eligibility to access the Service;
(c) to maintain the safety and integrity of the Service, including moderation and the detection, prevention and investigation of prohibited conduct;
(d) to process payments and to administer entitlements, discounts and promotions;
(e) to analyse use of the Service, including on a per-User basis, in order to understand and improve it;
(f) to create and use Aggregated or De-identified Information in order to operate, analyse, improve and sustain the Service, including in connection with commercial partnerships;
(g) to select and display advertising or sponsored content within or alongside Content, on the basis of the subject-matter of that Content; we do not select advertising on the basis of your profile, characteristics or history, and we do not disclose Personal Data to advertisers for that purpose;
(h) to communicate with you in relation to the Service; and
(i) to comply with applicable law and lawful requests, and to establish, exercise or defend legal claims.
6. Processing by automated means and by Service Providers
6.1 Your Content and other Personal Data may be processed by automated means and by Service Providers, including providers of artificial-intelligence services, for the purposes described in clause 5, including safety, moderation and analysis.
6.2 We engage Service Providers under obligations of confidentiality and on terms that do not permit them to use your data to train their own models. We may change Service Providers from time to time. The categories of Service Provider we engage are set out in clause 7.1.
7. Disclosure of Personal Data
7.1 We do not sell your Personal Data. We may disclose Personal Data to Service Providers engaged to process it on our behalf and on our instructions, comprising the following categories:
| Category of recipient | Purpose |
|---|---|
| Messaging platform | Operation of the Service |
| Identity verification provider | Verification of your School email address |
| Payment processor | Processing of payments |
| Artificial-intelligence service provider(s) | Processing of Content, including for safety and analysis |
| Email delivery provider | Delivery of verification and notification emails |
| Hosting and infrastructure provider(s) | Hosting and operation of the Service |
| Cloud storage and backup provider | Off-site data backup |
7.2 We may further disclose Personal Data, including the record referred to in clause 4.2 and the Content you have submitted or exchanged, where we reasonably consider such disclosure to be required by law or by the lawful request of a competent authority, or necessary to prevent or address a threat to life, safety or security or other serious harm.
8. Transfer of Personal Data outside Singapore
Certain Service Providers store or process Personal Data outside Singapore, including in connection with the hosting of the Service and our off-site backups. Where Personal Data is transferred outside Singapore, we take reasonable steps to ensure that it is afforded a standard of protection comparable to that under the PDPA.
9. Retention
9.1 We retain Personal Data for as long as necessary to fulfil the purposes described in this Policy, for so long as the Service is operated, and in any event for a minimum period of at least 90 days, unless a longer period of retention is required or permitted by law, including for the purposes of safety, fraud prevention, enforcement, payment records and legal compliance. Content published to the Channel is anonymous and may remain available indefinitely.
9.2 We maintain off-site backups. Accordingly, the deletion of Personal Data from our primary systems may not immediately remove it from backup copies, which are overwritten or expire in the ordinary course over a limited period.
10. Your data and your rights
10.1 By accessing or using the Service, you acknowledge that the Personal Data you provide and the Content you submit form part of the Service and are retained and used in accordance with this Policy. Except to the extent required by law, we do not delete your account or Content upon request.
10.2 You may have rights under the PDPA, including to request access to or correction of your Personal Data, or to withdraw consent to our use of it. To make a request, please contact us using the details in clause 14, and we will respond in accordance with applicable law. We may require verification of your identity before responding. Withdrawing consent may mean that we can no longer make some or all of the Service available to you, and does not require us to delete Personal Data that we are entitled to retain.
11. Data security
We implement reasonable administrative, technical and physical measures designed to protect Personal Data against unauthorised access, use, disclosure, alteration or loss, including restricting administrative access to authorised personnel and relying on the security controls of reputable Service Providers for hosting, payment processing and backups. No method of transmission or storage is completely secure, and we do not guarantee absolute security. Where a data breach that meets the notification threshold under the PDPA occurs, we will notify the Personal Data Protection Commission of Singapore and affected individuals in accordance with applicable law.
12. Age
The Service is provided through Telegram and is intended for enrolled members of the School community who satisfy Telegram's minimum-age requirement and who are of sufficient age and capacity, under the laws applicable to them, to consent to this Policy. We do not knowingly collect Personal Data from any person who does not meet these requirements. If we become aware that we have collected Personal Data from such a person, we will take reasonable steps to delete it.
13. Changes to this Policy
We may amend this Policy from time to time. The current version, together with its effective date, will be made available at https://smuconfess.app/privacy. Where amendments are material, we will take reasonable steps to bring them to your attention through the Service. Your continued use of the Service after an amendment takes effect constitutes your acknowledgement of the amended Policy.
14. Contact and complaints
Requests, questions or complaints regarding this Policy or your Personal Data may be directed to the Operators at:
- Data protection contact: privacy@smuconfess.app
- Email: privacy@smuconfess.app
- Requests form: https://forms.gle/tbKpnRxWT3FMdyDq7
If you are not satisfied with our response, you may be entitled to lodge a complaint with the Personal Data Protection Commission of Singapore.