Privacy Policy

Last updated: 30 March 2026

CDC Lesson Bot ("we", "our", "the Service") is committed to protecting your privacy. This policy explains what information we collect, how we use it, and how we keep it safe.

1. Information We Collect

When you use CDC Lesson Bot, we collect and store the following:

• Telegram account information — your Telegram user ID, username, and first name. This is provided automatically by the Telegram Bot API when you interact with the bot.
• CDC credentials — your ComfortDelGro Driving Centre learner ID and password, which you provide voluntarily to enable automated booking.
• Booking preferences — your selected time slots, date ranges, and other booking settings.
• Booking history — records of bookings made on your behalf, including dates, times, and status.
• Payment records — transaction amounts, credit balances, and Stripe payment references. We do not store your bank account details or PayNow credentials.

2. How We Use Your Information

Your information is used solely to provide the Service:

• Authenticate with the CDC booking system on your behalf
• Monitor available lesson slots matching your preferences
• Book lessons automatically when matching slots are found
• Process credit purchases via Stripe (PayNow)
• Send you Telegram notifications about bookings and account activity
• Respond to support requests

3. Data Storage and Security

• Password encryption — your CDC password is encrypted at rest using Fernet symmetric encryption (AES-128-CBC). It is never stored in plaintext.
• Database — all data is stored in a PostgreSQL database on a secured virtual private server located in Singapore.
• Access — only the Service operator has access to the server and database. No employees or third parties have direct database access.
• Transmission — all communication between the bot, the CDC API, and Stripe is encrypted via HTTPS/TLS.

4. Third-Party Services

We use the following third-party services to operate:

• Stripe (stripe.com) — payment processing. Stripe receives your payment amount and transaction metadata. See Stripe's privacy policy.
• Telegram (telegram.org) — bot platform for user interaction. See Telegram's privacy policy.
• ComfortDelGro Driving Centre (cdc.com.sg) — driving lesson booking system. Your credentials are used to interact with CDC's booking API on your behalf.
• DigitalOcean (digitalocean.com) — server hosting in Singapore.

5. Data Sharing

We do not sell, trade, or share your personal information with any third parties, except as required to provide the Service (as listed above) or as required by law.

6. Data Retention

Your account data is retained for as long as your account is active. If you wish to delete your account and all associated data, contact us at [email protected] and we will remove your data within 7 days.

7. Your Rights

You may:

• Request a copy of your stored data
• Request deletion of your account and data
• Withdraw your CDC credentials at any time (the bot will stop monitoring)

8. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

9. Contact

If you have questions about this privacy policy or your data, contact us at [email protected].