Privacy
Pristine Mekong Pte. Ltd. collects personal data to run rian gèng. This notice states the purposes, the data, and who to write to.
Organisation
Pristine Mekong Pte. Ltd., UEN 202609906N, of 160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914.
This notice follows Singapore's Personal Data Protection Act 2012. The company's data protection officer can be reached at sawatdii@riangeng.com. Write there to ask for access, correction or deletion, or to withdraw consent.
Data
- Waitlist. The email entered in the form, and the plan picked on the page, yearly or Forever, when one was picked. With them, the marks on the link that led to the page, when the link has them: the short tag, such as x for a post on X, the utm tags that link builders add, the site that linked here, and the page the visit arrived on. The form stores nothing else.
- Mail choices. Whether the account asked for news, the wording it agreed to and the time. A record of each email sent, with its kind, its time and Resend's number for it.
- Account. The email, and a hash of the password held by Supabase. The company does not keep the password.
- Payments. When someone buys a plan, Stripe takes each payment on its own page, so the card and the billing details go to Stripe and Link, and not to the company. The company keeps the plan bought, the date its access ends, the amount and the currency, the email Stripe collected, which becomes the account's email, and Stripe's customer, subscription and Checkout numbers. Each Stripe event's number is kept for 90 days, so a retry is not handled twice.
- Name. The display name on the account, and the name saved in the course settings, when one is entered.
- Progress. Cards, answers, sessions, and settings, stored as one document. Each answer carries its time, how long it took, how often the card was played before it, whether it was new, due or asked again, and a random number that names the browser it was given on. A missed answer also keeps the choice pressed, or what was written, when it is made only of letters, tone marks, spaces, hyphens and apostrophes, up to 40 characters. A session keeps when it began and ended, how many cards were new, and whether it was left unfinished.
- Demo use. On the demo card and the preview: the page, the time, the card, whether it was heard, checked, right or missed, which links and buttons led on, and the marks on the link that led here. For a missed card, what was typed, when it is made only of letters, tone marks, spaces, hyphens and apostrophes, up to 60 characters. That can be any such text, not only the card's romanization. Each page load carries a random number that the browser does not keep, so one visit's checks count together. It is stored with that visit's demo use. Demo use holds no email and no IP address.
- Errors. When a script on the front page, the preview or the course fails and the page does not handle it: the page, the time, and the kind of error, such as TypeError, for up to three kinds each page load. Not the error's message, and nothing that was on the screen or typed. Like demo use, it carries the page load's random number, and the browser's random number only after Allow. Errors hold no email, no IP address and no link marks.
- Counting, with permission. When the visitor allows it, this browser keeps a random number for 13 months, and the marks on the link that first brought it, for 30 days. A later visit then counts as a return, credited to the post that led here. Without permission, the browser keeps neither, so a later visit is not recognized as a return. The visit itself is still counted as demo use.
- Page views. Vercel Web Analytics counts page views without cookies: the page, the referring site, the country, and the browser, system and device type. It keeps nothing in the browser.
- This browser. The progress document in the browser's storage. On a browser two accounts share, each account's cards are kept apart there. A copy of the course itself, the cards and the voice clips, kept so the course opens without a network. Logging out removes the copy of the course. Logging out on the Account page removes the progress document too, once the account holds every answer. The sign-in session, including the email and the access tokens, in the browser's storage. The preview's place, so it opens where it was left. The counting choice, so the question is not asked on every page. A random number, made the first time the course opens, which each answer carries.
- Cookie.
rk_gate, HttpOnly and Secure, for 24 hours after the course opens. The server signs it. It holds the account's random number, the plan and the expiry, so that the voice clips play. It does not contain the email or the password, and it is not used to count visits. - Logs. Vercel and Supabase may record an IP address and the request, for security and operation. The browser calls Supabase directly to sign in and to save progress.
The company does not sell personal data. The site uses no advertising cookies and no cookies for counting visits.
Counting
The same rule holds in every country. The site asks once whether this browser may keep the random number for counting. Allow and Don't allow are offered alike, the page works the same either way, and nothing is kept in this browser for counting before a yes. A browser that sends Global Privacy Control is treated as a no and is not asked. It can still choose Allow in Privacy choices.
A yes holds for 13 months and a no for 6, then the question comes back once. Privacy choices, at the foot of the front page and here, changes the answer at any time. A no removes the random number and the kept link marks from this browser.
Purposes
A waitlist email is collected to send a message when the course is ready for that address. Sending the form is consent for that message. The form itself sends no mail. Every message names the company and says how to stop receiving them. The link's marks count which posts brought people to the list. The plan a waitlist visitor picked is collected to learn which plan people want.
The account, the progress, the browser copy, and the cookie are collected to provide the course the person asked for, including a copy that opens without a network. Progress is also read to see which words and tones are missed, to improve the course.
A payment's details are collected to take the payment, to give the plan that was bought, and to deal with a renewal, a refund or a dispute.
Demo use and page views are collected to learn how many people try a card, how many come back on a later day, which posts brought them, and which cards and tones are missed, to fix the grader and the words. They are not joined to a waitlist email or to an account.
Errors are collected to find and fix what breaks on the site and in the course, and to see within minutes when a new version breaks something. They are not joined to a waitlist email or to an account.
Consent
Joining the waitlist, making an account or buying a plan is consent to the collection, use and disclosure of that data for the purposes above. The browser's random number and the first link's marks are kept only after Allow, in the question on this site. Demo use, errors and page views are counts that name no one, kept to improve the course. A person may withdraw consent at any time by writing to the data protection officer, and the company acts on it within 10 business days.
Processors
Vercel hosts the site, counts page views, and may keep the logs. Supabase stores the account, the progress document, the waitlist, the plan bought, demo use and errors. Resend sends the company's email: the sale confirmation, password emails, and the news for those who asked for it, so it sees the address and the message. Stripe takes payments and keeps the card and billing details under its own privacy notice. Sold through Link, LLC, a Stripe company, takes each payment for the company as merchant of record, collects tax where Managed Payments covers it, and sends the receipt. Stripe and Link also use payment data for their own fraud checks and legal duties. The company uses the processors under their data-processing terms. The site's functions run on Vercel in the United States and the database is Supabase in Singapore, so personal data leaves Singapore. The company relies on each processor's data-processing terms to protect it to a standard comparable to Singapore's Personal Data Protection Act.
Retention
A waitlist email is kept until the one message is sent when the course opens, and in any case for no more than 12 months after sign-up, or until the person asks for it to be removed. Account data and progress are kept while the account exists. After a deletion request, the company deletes what it holds for that person.
A record of a sale is kept in the company's accounts for as long as they need it, and it stays when the account is deleted. It is no longer linked to the account then, and it keeps Stripe's customer number.
Demo use and errors are deleted after 13 months. The random number in the browser lasts 13 months, or until permission is withdrawn or the browser is cleared.
The cookie expires after 24 hours, or sooner when the person logs out. Logging out removes the copy of the course from the browser. Logging out on the Account page removes the progress there as well, and if the account does not yet hold the latest answers the page says so and asks first. A browser that is never logged out of keeps its copies until it is cleared.
The company does not set a published period for host logs. Those logs follow the host's own retention.
Rights
A person may ask what personal data the company holds, ask for a correction, withdraw consent, or ask for deletion. The company replies as soon as it reasonably can. If a reply takes longer than 30 days, the company writes to say when it will answer. A person who is not satisfied may complain to Singapore's Personal Data Protection Commission.
Withdrawing waitlist consent means the address is removed and no course message is sent to it. Deleting account data closes the account. The browser may still hold a local copy until it is cleared.
The course is for people aged 18 or over. The company does not knowingly collect personal data from anyone younger, and deletes it if it learns it has.