goAnywhr Privacy Policy

1 Who We Are and What This Policy Covers

Rave Group Int'l Pte Ltd, UEN 201508140W, of 10 Ubi Crescent, #06-84A, Ubi Techpark, Singapore 408564, operates goAnywhr by Rave Group. Our Data Protection Officer can be contacted at privacy@ravegroup.sg or by post marked Data Protection Officer to 10 Ubi Crescent, #06-84A, Ubi Techpark, Singapore 408564.

This Policy describes personal data handled in the verified tour workspace, including students, parents, teachers, tour leaders, creators and administrators. Rave Group handles users’ privacy requests directly through its DPO. Users do not need to contact their school or client organisation first. Each organisation retains the legal responsibilities applicable to its own activities and contractual arrangements.

Key Definitions

“App” means the verified goAnywhr service. “Client” means the institution or organisation engaging Rave Group to use the App. “Tour Team” means authorised staff managing a tour. “Participant” means an authorised App user connected with a tour, including a student, parent or guardian. “We”, “us” and “our” mean Rave Group Int'l Pte Ltd; “you” means the individual whose Personal Data is covered by this Policy.

“PDPA” means Singapore’s Personal Data Protection Act 2012. “Personal Data” has the meaning given in the PDPA and includes the identifiable account, tour and activity information described below. “DPO” means our Data Protection Officer, Mr. Steven Phua.

2 Information We Collect

Account and tour records: names, registered email addresses, roles, tour and group membership, parent–child links, tour dates, destinations, hotel stays, room assignments and contact details supplied for tour operations.

Activity and content: check-in declarations and times; packing ticks; published-update read and acknowledgement records; chat messages, replies, reactions, photos and files; delivery and read markers; reports and moderation records; journal drafts, submitted entries, attachments and teacher feedback.

Technical and administration records: session identifiers, request and security logs, IP addresses, browser or device information, notification subscriptions, preferences, and records of imports, account changes, publication, chat status and archive requests. We use hashed email or IP rate-limit identifiers for sign-in protection.

We obtain data from you, authorised schools and tour teams, linked parents or guardians, other participants who communicate with you, and the service providers that operate the app. Do not include unnecessary passport or NRIC images, medical records or payment data in ordinary chat or journals.

3 Why We Use Information

We use information to verify approved access; organise tours, groups and accommodation; communicate tour information; support participant check-ins and preparation; provide journals and teacher feedback; resolve support and safeguarding concerns; prepare authorised archives; maintain security; and meet applicable legal obligations.

We collect, use or disclose data with consent where required, or where the PDPA or another applicable law permits or requires it. We will explain additional purposes and obtain fresh consent where required before using existing data for those purposes. Acknowledging this Policy is not blanket consent to unrelated uses.

4 Who Can See Tour Information

Students see the tour information and conversations their membership permits, their own journal and assigned rooming information. Parents ordinarily receive Home, Pre-Trip, Itinerary, Contacts and their parent chats, plus their linked child’s available check-in status. A creator may additionally permit Travel Guide access. Parent accounts cannot access rooming lists, student chats or student journals.

Assigned teachers and tour leaders receive access needed for their duties, including the groups and submitted journals they are authorised to review. Tour creators and authorised administrators manage tour records within their permissions. Master admins have organisation oversight and can access private conversations for legitimate safeguarding, support and audit purposes.

Private chat means access is restricted within the app; it is not a promise that content is unreadable by the operator. Unsubmitted journal drafts are not available to teachers or parents through the app. Authorised technical personnel may need restricted system access for support, security or legal purposes.

Rooming information and updates are limited to the authorised tour audience. Staff must avoid unnecessary room disclosure and verify published assignments. We do not promise that every participant can see every room or record.

5 Service Providers and Other Recipients

We use Vercel for application hosting and delivery, Supabase for authentication, database and private file storage, and Google Workspace SMTP for sign-in email delivery. Optional browser notifications use the relevant browser or device push service. These providers process the information needed for their functions.

We use Scanii, operated by Uva Software, LLC, to check uploaded chat and journal attachments and DOCX or text itinerary files for malware and other unsafe content before sharing or importing them. File contents are sent to Scanii’s Singapore processing endpoint. We send a generic filename and do not attach participant names, email addresses or tour identifiers; information contained inside your file is still processed. This processing is governed by our Data Processing Agreement with Scanii.

Tour creators may search Unsplash for destination photos. The search sends the destination or landmark words they enter to Unsplash; do not include participant or confidential tour information. Choosing a photo records a selection event with Unsplash. Displayed photos load directly from Unsplash’s image service, which receives technical connection information such as an IP address. Photographer credits link to Unsplash, whose own privacy notice applies when you visit it.

Published Wikimedia or Commons images and external links may cause your browser to contact those services and disclose technical information such as an IP address. Opening WhatsApp, maps, airline or other external services makes their own terms and privacy notices relevant. Do not share confidential tour content externally unless authorised.

If a location-based weather feature is enabled, it requests device permission and uses an approximate location for a weather query. It is not a continuous location tracker or a check-in verification tool. The current deployed preview does not enable live weather; the final notice must match the enabled release.

We may disclose necessary information to a school or tour organiser, professional advisers, emergency responders or competent authorities for an authorised operational purpose, to protect an individual where legally permitted, or to meet legal obligations. A hotel or other supplier does not receive unrestricted app access merely because it provides tour services.

6 Processing Outside Singapore

The current development database and application functions are configured in Singapore. This does not mean all data remains in Singapore: hosting delivery, authentication email, provider support, push services, media and other infrastructure may involve overseas processing.

Before overseas transfers, we must establish the applicable safeguards to provide protection comparable to the PDPA, unless another lawful transfer mechanism applies. Provider terms, destinations, subprocessors and transfer arrangements must be confirmed before real-participant rollout; the selected server region alone is insufficient.

Scanii processes submitted file contents in Singapore. Its account administration and limited job metadata, including service identifiers, detection findings and processing times, are handled in the United States. Scanii may use Amazon Web Services, including Amazon Rekognition for image analysis in the same processing region. Its published terms state that submitted files are not used to train detection models. Singapore file processing does not mean every related record remains in Singapore.

7 Children Parents and School Onboarding

We aim to explain data use in language students can understand and collect only information appropriate for the tour. Our client school or organisation decides whether to use the app and must provide the applicable notices and establish the necessary authority or consent before uploading a roster. First-login acknowledgement cannot retrospectively supply missing permission.

Where consent is required for a child below 13, our client school or organisation is responsible for obtaining it from the child’s parent or legal guardian before supplying the child’s data. For children aged 13 to 17, the onboarding process must consider whether the child sufficiently understands the data use and its consequences, and involve a parent or guardian where appropriate. Rave Group remains responsible for its own obligations. Privacy consent and contractual acceptance are assessed separately.

An adult must not accept for a child without authority. Parent–child linking, an uploaded email address or a teacher’s account does not alone establish parental consent. Requests made on behalf of a child are assessed with appropriate identity, authority and child-interest safeguards.

If you believe information about a child was supplied without the necessary authority or consent, contact the DPO so we can investigate and take appropriate action.

8 Choices and Withdrawal of Consent

Where we rely on consent, you or an authorised representative may contact the DPO to withdraw it on reasonable notice. We will explain the likely consequences. Some necessary functions may no longer be available; we will discuss the school’s alternative communication or participation arrangements where relevant.

Withdrawal does not automatically require deletion of every existing record. We may retain or otherwise handle information where required or permitted by law and where legitimate legal or business retention purposes continue. We will stop the consent-based collection, use or disclosure concerned unless another lawful basis applies.

We do not currently use student photos, journals or participant content for websites, social media, advertising or other promotional materials. Any future proposal would require a separate review, notice and appropriate permission before use. Device permission for notifications or location is a separate setting, not a substitute for any consent required under the PDPA.

9 Access Correction and Privacy Requests

Contact privacy@ravegroup.sg to request access to personal data about you or correction of an error or omission, or to raise a privacy concern. Tell us enough to identify the relevant tour and request; avoid sending excessive identity documents or sensitive data by ordinary email.

We may verify identity and authority and apply relevant statutory exceptions, including protection of other people’s information. A parent’s request about a child is assessed under applicable requirements; parent status does not give automatic access to all journal or chat content.

We will respond as soon as reasonably possible. If we cannot complete an access or correction response within 30 days, we will inform you in writing within that period when we expect to respond. If a permitted access fee applies, we will explain it before proceeding. These rights are subject to the PDPA and do not create an unrestricted right to erase every school or audit record.

10 Retention Archives and Removal

We retain personal data only while its purposes continue and retention remains necessary for legal or business purposes. Different records may need different periods. A detailed schedule must specify account and acceptance evidence, audit/security logs, temporary files and backups alongside the agreed review of tour records.

We review chats, journals and participant records 12 months after each tour ends. Following review, information no longer needed will be deleted or anonymised. Records may be retained longer where justified by unresolved incidents, disputes or legal obligations, with periodic review. This is a review point, not a statutory minimum retention period. The app currently provides review prompts; automatic deletion is not enabled.

Archiving a tour, closing a chat, suspending an account or hiding a message does not delete its records. Necessary records may be held longer for an unresolved safeguarding incident, dispute, investigation or legal obligation, with an appropriate scope and review process.

Authorised staff can export submitted journals and chat archives, including relevant attachments and audit history. Hidden chat messages may remain in confidential staff exports. Recipients must protect downloaded copies and follow their school’s approved retention rules. We cannot remotely erase an independently downloaded PDF or ZIP.

Offline essentials are stored in the browser only when requested, expire after seven days, and are cleared on app sign-out. They cannot receive changes or immediate revocation while offline. Device permissions, provider logs and backups may have separate retention arrangements that must be confirmed in the final schedule.

Scanii states that uploaded file contents are deleted when analysis finishes. Our app requests deletion of each scan result and its processing trace after receiving a result, and blocks sharing if cleanup cannot be confirmed. This does not erase every provider record: Scanii may retain checksums, limited job metadata and security records; encrypted backups may remain for up to 90 days, and legal retention exceptions may apply. Without earlier deletion, its published result-record retention is up to 400 days. Contact our DPO with privacy requests about this processing.

11 Security and Incidents

We use account verification, assigned permissions, restricted file access and security records to help protect data. Keep email accounts and devices secure, do not share sign-in links, and report suspected misuse. No internet service or device is entirely risk-free.

Contact privacy@ravegroup.sg promptly if you suspect a data incident. We will assess it and notify the PDPC and affected individuals where the law requires. App chat is not a continuously monitored emergency channel; contact the tour team and emergency services directly when urgent help is needed.

12 Cookies Storage and Policy Changes

Essential cookies support sign-in and session security. Browser storage supports preferences, temporary message drafts and optional offline copies. Clearing storage may sign you out or remove local copies. The current app does not include advertising trackers; new analytics or other non-essential tools require a separate assessment and notice before being introduced.

We will publish the date of an approved update and notify users of material changes appropriately. We will seek additional consent where required; continued use or acknowledgement alone does not authorise every new data purpose.

Privacy contact: Mr. Steven Phua, Data Protection Officer, privacy@ravegroup.sg, 10 Ubi Crescent, #06-84A, Ubi Techpark, Singapore 408564. If a concern remains unresolved, you may contact Singapore’s Personal Data Protection Commission at www.pdpc.gov.sg.