Trust Center

Information Security Policy

Scope: the Shanhai Tongwen platform (learner, teacher, school and operations portals, public pages and APIs), the data on it and the infrastructure it runs on, and every GACEE staff member or engineer who can reach that data.

1. Our commitments

• Learners', teachers' and schools' data is used only to provide the teaching service: never sold, never used for advertising, never used to train any general-purpose model.
• Data resides in Singapore by default: the platform is deployed in the Singapore region, the deployment configuration enforces the region, and nothing is replicated to another region.
• Teachers decide, AI assists: agents only propose; decisions about learners are approved by a teacher or school and written to a verifiable audit chain.
• What we say matches what is true: compliance statuses and monitoring results in the Trust Center are shown as they are; a check with no signal wired shows "Not connected", never "Passing".

2. What we build to

• Singapore Personal Data Protection Act (PDPA): self-assessed compliance.
• SOC 2 Trust Services Criteria: controls built to the framework; no independent audit report yet.
• ISO/IEC 27001: information security management system built to the standard; not certified yet.

Every control is registered in the control library with an owner, a type (automated check / manual verification / by design) and its evidence. "Readiness" only means the share of controls that pass their checks or have been verified by a person — it is not an audit or a certification.

3. Core requirements

1. Least privilege: access is granted by role; cross-school access is always refused; admin accounts are reviewed every quarter (see Access Control).
2. Encryption: HTTPS everywhere; textbook originals, content packs and backups in object storage use server-side AES-256 encryption; passwords and PINs are stored only as scrypt hashes.
3. Tiered processing: identifiable data (T1) only goes to models inside its own jurisdiction, with no fallback; de-identified data (T2) has names, emails, phone numbers and ID numbers replaced before it is sent; only public content (T3) is routed by cost. Anything unlabelled is treated as T1.
4. Traceability: approvals, certificates, consents, exports, deletions and other writes go into a hash-chained audit log, one chain per organisation, verified entry by entry every day.
5. Recoverability: daily backups and a weekly restore drill (see Backup and Recovery).
6. Continuous monitoring: automated checks run on a fixed schedule and every result is kept; a result older than its freshness window counts as "Due for a check".
7. Incident response: incidents are handled by severity under the Incident Response policy; a notifiable data breach is reported to the regulator within 3 calendar days of that assessment.
8. Suppliers: a subprocessor is used only after it has been registered, assessed and bound by confidentiality and residency terms (see Supplier and Subprocessor Management).

4. Responsibilities

• GACEE leadership: approves this policy, provides resources and receives a security and privacy report once a year.
• Data protection officer: maintains the policies, handles data requests, organises risk assessments and training.
• Platform engineering: builds and maintains the technical controls and responds to check alerts and security incidents.
• GACEE operations: manages tenants and accounts, reviews evidence and maintains the Trust Center.
• Every staff member: follows this policy and reports any security concern immediately.

5. Review

This policy is reviewed at least once a year, and whenever the platform architecture, the applicable law or the compliance status changes materially. Reviews are recorded in the compliance and trust workspace.

Data Retention and Deletion Policy

1. Principles

• We keep only the data needed to provide the teaching service, meet legal obligations and resolve disputes; when the retention period ends, data is deleted or returned.
• Data whose retention period can be worked out from time is deleted automatically by the system every day. Every automatic deletion writes an audit entry with the data category and the count only — never any content.
• Deletions that need a person's judgement — returning or deleting data when an agreement ends, and individual data requests — are carried out by the responsible person after checking their scope, and are written to the audit chain.
• During a legal hold, automatic deletion of the data concerned is suspended (see section 4).
• "Storage lifecycle rule" in the table below is an expiry rule of the storage layer, for backups and older versions.

2. Retention periods

3. Data requests

• A learner, their guardian or their school can ask for personal data to be exported, corrected or deleted; GACEE closes each request within 48 hours of logging it.
• Export: once approved by the responsible person, a JSON file with only that learner's own records is produced and handed to the school to pass on. To protect children, safety cases and the records tied to them (the child's own words when asking for help, the categories detected, who was alerted) are never put in an export file; they are handled only in the school's safeguarding follow-up.
• Correction and deletion: these need a person's judgement and are carried out by the responsible person, who records what was done (data that expires by time is deleted automatically by the system, see section 2).
• Requests and their outcomes are written to the audit chain.

4. Legal hold

When a regulator, a court or an investigation requires it, the data protection officer freezes deletion of the data concerned until the hold is lifted in writing. While the hold lasts, the system suspends all automatic deletion for the organisations concerned (and the organisations under them); operations sets and lifts the hold in the tenant settings, and each change is written to the audit chain. Storage lifecycle rules (database backups and older versions of files) run in the storage layer and are not paused by a hold set in the tenant settings: when such data must be preserved, the data protection officer asks the technical lead to preserve it separately.

5. Review

The data protection officer checks how this policy is being carried out every six months and records the result as evidence under the control "Retention and deletion".

Supplier and Subprocessor Management Policy

1. Scope

Every external service that processes platform data on GACEE's behalf (a subprocessor), and every external supplier that can reach the production environment.

2. Current subprocessor categories

The list published in the Trust Center follows the subprocessor register in the compliance and trust workspace and shows only category, purpose, region and data categories.

3. Assessment before use

Before a new subprocessor is used, GACEE operations and platform engineering assess it together and record:

1. Which data it processes and where; identifiable data must stay within its own jurisdiction.
2. Security measures: encryption in transit and at rest, access control, incident-notification duties.
3. Contract terms: confidentiality; processing only on our instructions; no training on our data; zero retention for model services; return or deletion when the agreement ends; cooperation with audits and data requests.
4. Replaceability: whether it can be migrated away from or switched off without interrupting teaching.

4. Changes and notice

• A new or replaced subprocessor is added to the register before it takes effect, and announced in the Trust Center in advance wherever possible.
• A removed subprocessor is marked as removed in the register; the record is kept.

5. Yearly review

The terms, region and security record of every subprocessor are reviewed once a year and recorded as evidence under the control "Subprocessor register and yearly review".

Protection of Minors' Data Policy

1. Who this covers

Learners who need a guardian's consent: for each learner's jurisdiction, the higher of the data-protection law's definition of a child and the civil age of majority (for example 20 in Thailand and 21 in Indonesia, otherwise 18). A learner whose birthday is unknown is always treated as needing consent.

2. Guardian consent

• Before a minor uses any AI feature (asking Xiaomo, AI feedback on speaking and writing, and so on), a guardian's consent is required; without it those features stay off and the learner can still use everything that does not involve AI.
• The consent record holds the guardian's name, the form version, the language and the options ticked; AI features, use of photos and use of the learner's work are ticked separately.
• A guardian can withdraw consent at any time; the related features stop straight away and the withdrawal is written to the audit chain.
• Consent forms are collected by the school and recorded in the school portal.

3. Data minimisation

• We collect only what teaching needs: name, class and learning records — never home addresses, ID numbers or anything else unrelated to teaching.
• Learners' conversations, answers and work are treated as identifiable data (T1) and go only to models inside their own jurisdiction; they are never used to train any general-purpose model.
• Certificate verification discloses only validity and what is necessary; the holder's initials appear only with the verification code.

4. Safety and human oversight

• Agents only propose; decisions about learners are approved by a teacher or school.
• Co-reading comments are reviewed before they appear; showing a learner's essay as a model needs consent to use their work.
• When a learner mentions a safety risk, the agent stops answering and asks a teacher to follow up at once.

5. Requests and complaints

Guardians can ask GACEE, through the school, to access, export, correct or delete data; GACEE closes each request within 48 hours of logging it. If they are not satisfied with the outcome, they can complain to the data-protection regulator where they live.

6. Review

The data protection officer reviews this policy every year and follows consent coverage tenant by tenant (control "Guardian-consent coverage").

Privacy Policy

This policy explains how Shanhai Tongwen (the "platform") collects, uses, stores and protects personal data. The platform is operated by the Global Association of Cultural and Educational Exchange (GACEE, "the Association"); JURIS&EDU AI TECHNOLOGY PTE. LTD. (Singapore), as a data processor, provides technology and operations support for the platform.

1. Who this policy covers

• Learners: people whose accounts are opened by a school, education provider or company, including minors.
• Guardians: parents or other guardians of minor learners.
• Teachers and staff: remote teachers, local teachers, curriculum editors, school administrators, company HR and administrators, and Association operations staff.

Learner accounts are opened by schools, education providers or companies. They are the controllers of their learners' data and decide how the platform is used in their teaching; the Association processes this data as their data processor, as agreed with them.

2. What we collect

We do not collect home addresses, ID numbers or precise location, and we use no advertising or third-party analytics tracking.

3. Why we use it

• To provide teaching: courses, practice, live classes, marking, progress insights, certificates and certificate verification.
• AI-assisted features: the study companion Xiaomo, feedback on speaking and writing, and similar features. A minor needs a guardian's consent before using AI features; without it those features stay off and the learner can still use everything that does not involve AI.
• To keep learners safe: when a learner reveals a possible safety risk in a conversation, we alert their teachers and school so they can follow up.
• Communication: messages, announcements and notifications between teachers, learners, guardians and schools.
• Security and compliance: account security, preventing misuse, audit records, backup and recovery, and meeting legal obligations.

We do not sell personal data, and we do not use learner data for advertising.

4. How AI processes data

• Data that identifies a person (for example a learner's conversations, answers and work) is processed only by model services in the Singapore region.
• To keep learners safe, what learners write is screened automatically for safety risks (such as self-harm, bullying or inappropriate contact): messages, class moments and comments, questions to Xiaomo, what they say in practice dialogues, questions in live classes, co-reading comments, and reading notes. The screening includes model services in the Singapore region. It still runs when a learner's AI features are off: its basis is keeping learners safe, this policy is the notice of it, and schools should explain it to guardians when they collect consent forms; its results are used only for safety alerts and moderation.
• Learner data is not used to train any third-party general-purpose model; our contracts with model service providers prohibit using it for training and require that it is not retained.
• Lesson materials and marking suggestions drafted by AI reach learners only after a teacher confirms them; Xiaomo cites the course material it answers from and passes questions it is unsure about to the teacher.
• Xiaomo answers only from the course material: before an answer reaches a learner, the system checks that what it says is supported by the course material and screens it for safety. An answer to a course question that is not supported or does not pass goes to a teacher instead; when the check or the screening cannot be done at that moment, Xiaomo answers with the course material's own wording. An answer to a progress question ("how am I doing?") that does not pass the screening is replaced by a fixed-format summary generated from the learning records.
• AI answer records: so that a school can check what Xiaomo said when a parent or learner raises a concern about an answer, the platform records each answer Xiaomo and the progress questions give — the learner's question, the answer, the course material it cited, the model and prompt version used, and whether it went to a teacher or was declined. Questions and answers are stored encrypted and deleted automatically after 90 days, and at once when the guardian's consent to AI features is withdrawn (except during a legal hold). The learner's own words are kept only when the safety screening has found no risk; for a safety-related question they are not kept here, they stay only in the school's safety follow-up record, and that question never appears in any export. These records can be seen by: the learner (through a data export); the administrators of the learner's school (the school's safeguarding contact), who must choose a reason each time — the access log is kept for 12 months and every view is recorded in the audit log; and, when a learner, guardian or school makes a data export request, the export file includes these records, prepared by the Association staff who handle data requests under the Data Retention and Deletion Policy and passed on through the school. Teachers, company administrators and other schools cannot see them. The records are not used to train models, and Xiaomo does not read them when answering.
• AI can make mistakes. Important decisions about learners are made by teachers or schools.

5. Where data is stored

The platform's servers, database and file storage are in the Singapore region, and object storage is not replicated to other regions.

The following services are switched on by schools; when they are used, the related data goes to the third party concerned:

• Third-party meeting tools for live classes: the platform creates the meeting (class topic and time) in the meeting tool; when a learner joins, the meeting tool receives the name the learner shows in the meeting. Classes are not recorded by default. The meeting tool processes this data under its own terms and in its own data region.
• Systems a school connects through Connector (for example the school's messaging tools, calendars or spreadsheets): a data flow that carries personal data runs only after a school administrator approves it, and every sync is recorded.

6. Who can see data

• The learner, the teachers of the learner's class, and administrators at the learner's school or company who have the right role.
• Guardians see only their own child. Company HR sees only summaries, attendance and certificates, never employees' answers or conversations.
• AI answer records can be seen only by the learner, by the administrators of the learner's school (choosing a reason, recorded in the audit log), and by the Association staff handling a data export request; see section 4.
• Association operations staff access data only as needed to provide support, handle data requests and keep the platform secure; their access is recorded in the audit log.
• Subprocessors that provide services to the platform (cloud infrastructure, managed database, object storage, model services, email delivery); the list is published in the Trust Center.
• When the law requires it, we disclose data through the proper legal process.

7. How long we keep it

Retention follows the Data Retention and Deletion Policy. In particular:

• Learner accounts and learning records are kept for the term of the school's agreement, and within 30 days after it ends are exported or deleted as the school confirms in writing.
• Messages and class moments are deleted automatically after the retention period the school sets (365 days by default).
• Database backups are kept for 30 days.
• AI answer records are kept for 90 days and deleted at once when the guardian's consent to AI features is withdrawn.

8. Your rights

• You can ask to see, export or correct your personal data, withdraw consent, or ask for deletion.
• Learners and guardians can ask through their school or contact our data protection officer directly. We log and handle each request under the Data Retention and Deletion Policy, and the outcome is written to the audit chain.
• When consent to AI features is withdrawn, those features stop straight away.
• If you are not satisfied with the outcome, you can complain to Singapore's Personal Data Protection Commission (PDPC) or the data protection authority where you live.

9. Minors

The age below which guardian consent is needed depends on the learner's jurisdiction (for example 20 in Thailand, 21 in Indonesia, otherwise 18); a learner whose birthday is unknown is always treated as needing consent. See the Protection of Minors' Data Policy for details.

10. Security

HTTPS across the whole site; access controlled by role; key actions written to a hash-checked audit chain; server-side encryption for object storage; daily backups with a weekly restore drill; offline personal data on shared devices encrypted per account.

11. Security incidents

If a security incident may affect personal data, we notify the Personal Data Protection Commission and the affected schools and people as the law requires, and explain what we have done about it.

12. Cookies and local storage

The platform uses only the cookies it needs to work: the sign-in session, the language preference and the demo-mode marker. For offline learning, lesson packs and learning records are kept in the device's browser storage, and personal data on shared devices is encrypted per account. We use no advertising or analytics cookies.

13. Changes to this policy

When this policy changes, the new version is published in the Trust Center; schools are told in advance about significant changes.

14. Contact us

Data protection officer: dingbo@jurisedu.com

Terms of Service

1. About these terms

Shanhai Tongwen (the "platform") is operated by the Global Association of Cultural and Educational Exchange (GACEE, "the Association"). These terms apply to everyone who uses the platform. Where a school, education provider or company has a separate written agreement with the Association, that agreement prevails; for anything it does not cover, these terms apply.

2. Accounts

• Accounts for learners, teachers and administrators are opened by schools, companies or the Association. Keep your password and PIN safe, and do not share your account.
• After learning on a shared device, sign out or lock your account.
• If you think someone else may be using your account, tell your school or contact us straight away.

3. Acceptable use

When using the platform, do not:

• post content that is unlawful, violent, sexual, discriminatory or bullying, or that infringes other people's rights;
• ask minor learners for contact details, arrange to meet them privately, or make any inappropriate contact;
• impersonate anyone, or get around the platform's moderation and safety measures;
• access, scan, scrape or interfere with the platform or its data without permission;
• upload files that contain malicious code.

The platform moderates messages and class moments. Content that breaks these rules may be hidden or removed, and the accounts involved may be restricted.

4. AI features

• AI features such as Xiaomo support learning, and their answers can be wrong. Xiaomo is not a person and cannot replace teachers, parents or professionals.
• If you or someone near you is in danger, tell an adult nearby straight away or call your local emergency number.
• Teaching content drafted by AI reaches learners only after a teacher confirms it.

5. Content and intellectual property

• Textbooks, lesson materials and other content on the platform are protected by copyright and are used for teaching on the platform under licence.
• Rights in teaching materials that teachers upload or create follow the agreement between the teacher and the school or the Association.
• Content you submit on the platform (homework, work, messages and so on) remains yours; you allow the platform to store and process it to provide teaching, and to show it to people who have permission to see it. Showing or publishing a learner's work needs separate consent to use the work.

6. Third-party services

Live classes may use third-party meeting tools, and schools may connect other systems through Connector. When you use these services, their own terms also apply.

7. Providing and changing the service

• The platform is currently in a pilot phase. We work to keep it stable, but we do not guarantee that it will be uninterrupted or free of errors.
• Maintenance, upgrades or security needs may cause temporary interruptions; schools are told in advance about significant changes.
• We may improve or change features and update these terms when needed; updated terms are published in the Trust Center.

8. Suspension and termination

We may suspend or end the use of an account that breaks these terms or the law, or that puts learners or the platform at risk. When a school or company ends its agreement, data is exported or deleted under the Data Retention and Deletion Policy.

9. Liability

To the extent the law allows, the Association is not liable for losses caused by events beyond its reasonable control, failures of third-party services, or a user breaking these terms. Nothing in these terms limits liability that cannot be limited by law.

10. Governing law

These terms are governed by the laws of Singapore; disputes arising from them are subject to the jurisdiction of the courts of Singapore.

11. Contact us

dingbo@jurisedu.com